SSFIV[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SSFIV.exe
Size

6.6MB
MD5

47adcdccc5ca44adba321f410db6d1e9
SHA1

377e53b0f63fce0f1baad6617e678b2a7ca6da4b
SHA256

a9017416ee8104cdde64d79f1e47697c1dfecb3d58496e4950945c3e37dea537
SHA512

a2d5f492975ce2483cb1e144a0902c6aa62df5715effbca48c93bf72b57dc33f828fb5e7788968084e85bcf9e012e633197657ff1aaaf4b76e0d3504938d2da1
SSDEEP

98304:9E/kA5V4ILI/uNx2BCKocFm87D6IXCJtq6KlKpdU/9WfY:6/k02n3XCJt/cKg

Score

1^/10

Malware Config

Signatures

Files

SSFIV.exe
.exe windows x86

c3dd73985ccb27ed5ba72b71c5ed6a99

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:24:38:4d:5c:99:fc:1d:99:e4:c8:6f:56:0c:91:7e
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/01/2014, 00:00

Not After

29/02/2016, 23:59

Subject

CN=QLOC S.A.,O=QLOC S.A.,L=Warszawa,ST=mazowieckie,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:49:1f:2f:52:ba:4d:07:84:d1:d4:68:62:6a:b8:ca:07:5a:26:10
Signer

Actual PE Digest

66:49:1f:2f:52:ba:4d:07:84:d1:d4:68:62:6a:b8:ca:07:5a:26:10

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=QLOC S.A.,O=QLOC S.A.,L=Warszawa,ST=mazowieckie,C=PL

06/08/2014, 13:01
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

dsound

ord12

xinput9_1_0

XInputGetCapabilities
XInputSetState
XInputGetState

curllib

curl_global_cleanup
curl_global_init
curl_easy_strerror
curl_easy_cleanup
curl_easy_perform
curl_slist_append
curl_easy_setopt
curl_easy_reset
curl_easy_init

ws2_32

inet_ntoa
ntohl
ntohs
htonl
htons

steam_api

SteamRemoteStorage
SteamUtils
SteamUser
SteamFriends
SteamUserStats
SteamAPI_RegisterCallback
SteamMatchmaking
SteamNetworking
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamAPI_RunCallbacks
SteamClient
SteamAPI_UnregisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_Shutdown
SteamApps
SteamAPI_Init

xinput1_3

ord7

cryptopp

?VerifyMessageRepresentative@PK_DeterministicSignatureMessageEncodingMethod@CryptoPP@@UBE_NAAVHashTransformation@2@U?$pair@PBEI@std@@_NPAEI@Z
?ComputeMessageRepresentative@PKCS1v15_SignatureMessageEncodingMethod@CryptoPP@@UBEXAAVRandomNumberGenerator@2@PBEIAAVHashTransformation@2@U?$pair@PBEI@std@@_NPAEI@Z
?MinRepresentativeBitLength@PKCS1v15_SignatureMessageEncodingMethod@CryptoPP@@UBEIII@Z
??0PKCS1v15_SignatureMessageEncodingMethod@CryptoPP@@QAE@XZ
??1SHA1@CryptoPP@@UAE@XZ
??0SHA1@CryptoPP@@QAE@XZ
?GetMaterial@PublicKeyAlgorithm@CryptoPP@@UBEABVCryptoMaterial@2@XZ
?AccessMaterial@PublicKeyAlgorithm@CryptoPP@@UAEAAVCryptoMaterial@2@XZ
?Clone@Clonable@CryptoPP@@UBEPAV12@XZ
?RecoverMessage@PK_Verifier@CryptoPP@@UBE?AUDecodingResult@2@PAEPBEI1I@Z
?RecoverAndRestart@TF_VerifierBase@CryptoPP@@UBE?AUDecodingResult@2@PAEAAVPK_MessageAccumulator@2@@Z
?Recover@PK_Verifier@CryptoPP@@UBE?AUDecodingResult@2@PAEPAVPK_MessageAccumulator@2@@Z
?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z
?VerifyAndRestart@TF_VerifierBase@CryptoPP@@UBE_NAAVPK_MessageAccumulator@2@@Z
?Verify@PK_Verifier@CryptoPP@@UBE_NPAVPK_MessageAccumulator@2@@Z
?InputSignature@TF_VerifierBase@CryptoPP@@UBEXAAVPK_MessageAccumulator@2@PBEI@Z
?RecoverablePartFirst@?$TF_SignatureSchemeBase@VPK_Verifier@CryptoPP@@V?$TF_Base@VTrapdoorFunction@CryptoPP@@VPK_SignatureMessageEncodingMethod@2@@2@@CryptoPP@@UBE_NXZ
?SignatureUpfront@PK_SignatureScheme@CryptoPP@@UBE_NXZ
?AllowNonrecoverablePart@?$TF_SignatureSchemeBase@VPK_Verifier@CryptoPP@@V?$TF_Base@VTrapdoorFunction@CryptoPP@@VPK_SignatureMessageEncodingMethod@2@@2@@CryptoPP@@UBE_NXZ
?IsProbabilistic@?$TF_SignatureSchemeBase@VPK_Verifier@CryptoPP@@V?$TF_Base@VTrapdoorFunction@CryptoPP@@VPK_SignatureMessageEncodingMethod@2@@2@@CryptoPP@@UBE_NXZ
?MaxRecoverableLengthFromSignatureLength@?$TF_SignatureSchemeBase@VPK_Verifier@CryptoPP@@V?$TF_Base@VTrapdoorFunction@CryptoPP@@VPK_SignatureMessageEncodingMethod@2@@2@@CryptoPP@@UBEII@Z
?MaxRecoverableLength@?$TF_SignatureSchemeBase@VPK_Verifier@CryptoPP@@V?$TF_Base@VTrapdoorFunction@CryptoPP@@VPK_SignatureMessageEncodingMethod@2@@2@@CryptoPP@@UBEIXZ
?MaxSignatureLength@PK_SignatureScheme@CryptoPP@@UBEII@Z
?SignatureLength@?$TF_SignatureSchemeBase@VPK_Verifier@CryptoPP@@V?$TF_Base@VTrapdoorFunction@CryptoPP@@VPK_SignatureMessageEncodingMethod@2@@2@@CryptoPP@@UBEIXZ
??0RSAFunction@CryptoPP@@QAE@XZ
??_DRSAFunction@CryptoPP@@QAEXXZ
?deallocate@?$AllocatorWithCleanup@E$0A@@CryptoPP@@QAEXPAXI@Z
?GetWaitObjects@BufferedTransformation@CryptoPP@@UAEXAAVWaitObjectContainer@2@ABVCallStack@2@@Z
?CreatePutSpace@BufferedTransformation@CryptoPP@@UAEPAEAAI@Z
?CanModifyInput@BufferedTransformation@CryptoPP@@UBE_NXZ
?Put2@BaseN_Decoder@CryptoPP@@UAEIPBEIH_N@Z
?PutModifiable2@BufferedTransformation@CryptoPP@@UAEIPAEIH_N@Z
?IsolatedInitialize@HexDecoder@CryptoPP@@UAEXABVNameValuePairs@2@@Z
?IsolatedFlush@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@UAE_N_N0@Z
?IsolatedMessageSeriesEnd@BufferedTransformation@CryptoPP@@UAE_N_N@Z
?Initialize@Filter@CryptoPP@@UAEXABVNameValuePairs@2@H@Z
?Flush@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@UAE_N_NH0@Z
?MessageSeriesEnd@Filter@CryptoPP@@UAE_NH_N@Z
?SetAutoSignalPropagation@BufferedTransformation@CryptoPP@@UAEXH@Z
?GetAutoSignalPropagation@BufferedTransformation@CryptoPP@@UBEHXZ
?MaxRetrievable@BufferedTransformation@CryptoPP@@UBE_KXZ
?AnyRetrievable@BufferedTransformation@CryptoPP@@UBE_NXZ
?Get@BufferedTransformation@CryptoPP@@UAEIAAE@Z
?Peek@BufferedTransformation@CryptoPP@@UBEIPAEI@Z
??1PKCS1v15_SignatureMessageEncodingMethod@CryptoPP@@UAE@XZ
?Final@HashTransformation@CryptoPP@@UAEXPAE@Z
?TotalBytesRetrievable@BufferedTransformation@CryptoPP@@UBE_KXZ
?NumberOfMessages@BufferedTransformation@CryptoPP@@UBEIXZ
?AnyMessages@BufferedTransformation@CryptoPP@@UBE_NXZ
?GetNextMessage@BufferedTransformation@CryptoPP@@UAE_NXZ
?SkipMessages@BufferedTransformation@CryptoPP@@UAEII@Z
?SkipAll@BufferedTransformation@CryptoPP@@UAEXXZ
?GetNextMessageSeries@BufferedTransformation@CryptoPP@@UAE_NXZ
?NumberOfMessagesInThisSeries@BufferedTransformation@CryptoPP@@UBEIXZ
?NumberOfMessageSeries@BufferedTransformation@CryptoPP@@UBEIXZ
?TransferTo2@Filter@CryptoPP@@UAEIAAVBufferedTransformation@2@AA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?CopyRangeTo2@Filter@CryptoPP@@UBEIAAVBufferedTransformation@2@AA_K_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?ChannelCreatePutSpace@BufferedTransformation@CryptoPP@@UAEPAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAI@Z
?ChannelPut2@BufferedTransformation@CryptoPP@@UAEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBEIH_N@Z
?ChannelPutModifiable2@BufferedTransformation@CryptoPP@@UAEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAEIH_N@Z
?StaticAlgorithmName@RSA@CryptoPP@@SAPBDXZ
?StaticAlgorithmName@PKCS1v15_SignatureMessageEncodingMethod@CryptoPP@@SAPBDXZ
?StaticAlgorithmName@SHA1@CryptoPP@@SAPBDXZ
??1SignatureVerificationFilter@CryptoPP@@UAE@XZ
??1HexDecoder@CryptoPP@@UAE@XZ
?NextPut@FilterWithBufferedInput@CryptoPP@@MAEHPBEI@Z
?FlushDerived@FilterWithBufferedInput@CryptoPP@@MAEXXZ
?LastPut@SignatureVerificationFilter@CryptoPP@@MAEXPBEI@Z
?NextPutModifiable@FilterWithBufferedInput@CryptoPP@@MAEXPAEI@Z
?NextPutMultiple@SignatureVerificationFilter@CryptoPP@@MAEXPBEI@Z
?NextPutSingle@FilterWithBufferedInput@CryptoPP@@MAEXPBE@Z
?FirstPut@SignatureVerificationFilter@CryptoPP@@MAEXPBE@Z
?InitializeDerived@FilterWithBufferedInput@CryptoPP@@MAEXABVNameValuePairs@2@@Z
?InitializeDerivedAndReturnNewSizes@SignatureVerificationFilter@CryptoPP@@MAEXABVNameValuePairs@2@AAI11@Z
?ChannelFlush@BufferedTransformation@CryptoPP@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NH1@Z
?Flush@Filter@CryptoPP@@UAE_N_NH0@Z
?IsolatedFlush@FilterWithBufferedInput@CryptoPP@@UAE_N_N0@Z
?IsolatedInitialize@FilterWithBufferedInput@CryptoPP@@UAEXABVNameValuePairs@2@@Z
?PutModifiable2@FilterWithBufferedInput@CryptoPP@@UAEIPAEIH_N@Z
?Put2@FilterWithBufferedInput@CryptoPP@@UAEIPBEIH_N@Z
?AlgorithmName@SignatureVerificationFilter@CryptoPP@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?InputBufferIsEmpty@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@MBE_NXZ
?ShouldPropagateMessageSeriesEnd@Filter@CryptoPP@@MBE_NXZ
?allocate@?$AllocatorWithCleanup@E$0A@@CryptoPP@@QAEPAEIPBX@Z
??1PK_MessageAccumulatorBase@CryptoPP@@UAE@XZ
?ShouldPropagateMessageEnd@Filter@CryptoPP@@MBE_NXZ
?NewDefaultAttachment@Filter@CryptoPP@@MBEPAVBufferedTransformation@2@XZ
?Attach@BufferedTransformation@CryptoPP@@UAEXPAV12@@Z
?ChannelMessageSeriesEnd@BufferedTransformation@CryptoPP@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N@Z
?SetRetrievalChannel@BufferedTransformation@CryptoPP@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Attachable@Filter@CryptoPP@@UAE_NXZ
??0PK_MessageAccumulatorBase@CryptoPP@@QAE@XZ
?AlgorithmName@Algorithm@CryptoPP@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Update@PK_MessageAccumulatorBase@CryptoPP@@UAEXPBEI@Z
?Peek@BufferedTransformation@CryptoPP@@UBEIAAE@Z
?Restart@HashTransformation@CryptoPP@@UAEXXZ
?DigestSize@PK_MessageAccumulator@CryptoPP@@UBEIXZ
?Detach@Filter@CryptoPP@@UAEXPAVBufferedTransformation@2@@Z
?AttachedTransformation@Filter@CryptoPP@@UAEPAVBufferedTransformation@2@XZ
?AttachedTransformation@Filter@CryptoPP@@UBEPBVBufferedTransformation@2@XZ
?BlockSize@HashTransformation@CryptoPP@@UBEIXZ
?OptimalBlockSize@HashTransformation@CryptoPP@@UBEIXZ
?OptimalDataAlignment@HashTransformation@CryptoPP@@UBEIXZ
?CalculateDigest@HashTransformation@CryptoPP@@UAEXPAEPBEI@Z
?Verify@HashTransformation@CryptoPP@@UAE_NPBE@Z
?VerifyDigest@HashTransformation@CryptoPP@@UAE_NPBE0I@Z
?TruncatedFinal@PK_MessageAccumulator@CryptoPP@@UAEXPAEI@Z
?CalculateTruncatedDigest@HashTransformation@CryptoPP@@UAEXPAEIPBEI@Z
?TruncatedVerify@HashTransformation@CryptoPP@@UAE_NPBEI@Z
?VerifyTruncatedDigest@HashTransformation@CryptoPP@@UAE_NPBEI0I@Z
?length@?$PKCS_DigestDecoration@VSHA1@CryptoPP@@@CryptoPP@@2IB
?decoration@?$PKCS_DigestDecoration@VSHA1@CryptoPP@@@CryptoPP@@2QBEB
??0NotImplemented@CryptoPP@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1NotImplemented@CryptoPP@@UAE@XZ
??0NotImplemented@CryptoPP@@QAE@ABV01@@Z
??0Exception@CryptoPP@@QAE@ABV01@@Z
??1StringSource@CryptoPP@@UAE@XZ
?CreateUpdateSpace@HashTransformation@CryptoPP@@UAEPAEAAI@Z
??0StringSource@CryptoPP@@QAE@PBEI_NPAVBufferedTransformation@1@@Z
?Put@BufferedTransformation@CryptoPP@@QAEIPBEI_N@Z
??0SignatureVerificationFilter@CryptoPP@@QAE@ABVPK_Verifier@1@PAVBufferedTransformation@1@I@Z
?Get@BufferedTransformation@CryptoPP@@UAEIPAEI@Z
??0StringSource@CryptoPP@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NPAVBufferedTransformation@1@@Z
??0TF_VerifierBase@CryptoPP@@QAE@XZ
??0StringSource@CryptoPP@@QAE@PBD_NPAVBufferedTransformation@1@@Z
??0HexDecoder@CryptoPP@@QAE@PAVBufferedTransformation@1@@Z
?Skip@BufferedTransformation@CryptoPP@@UAE_K_K@Z
?GetMaxWaitObjectCount@BufferedTransformation@CryptoPP@@UBEIXZ
?ChannelFlush@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NH1@Z

kernel32

GetCurrentDirectoryW
CreateFileW
PeekNamedPipe
GetFullPathNameW
CompareStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
SetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
IsProcessorFeaturePresent
GetExitCodeProcess
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapCreate
SetLastError
WriteConsoleW
GetStdHandle
GetCPInfo
LCMapStringW
FindFirstFileExW
GetDriveTypeW
HeapReAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
ExitThread
GetDateFormatA
GetTimeFormatA
RtlUnwind
HeapFree
HeapAlloc
DecodePointer
EncodePointer
GetStringTypeW
LocalAlloc
CreateProcessA
GetProcessHeap
HeapSize
GetTickCount
GetTimeZoneInformation
LoadLibraryA
IsBadWritePtr
SuspendThread
ReleaseMutex
CreateMutexA
CreateSemaphoreA
GetPrivateProfileStringA
WritePrivateProfileStringA
SetThreadExecutionState
CreateMutexW
SetCurrentDirectoryW
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
GetExitCodeThread
SetThreadIdealProcessor
CreateEventA
GetFileTime
SetThreadAffinityMask
SetEndOfFile
SetFilePointer
GetFileSize
CreateDirectoryA
FlushFileBuffers
MoveFileA
DeleteFileA
CreateThread
GetThreadPriority
VirtualAlloc
VirtualFree
LoadLibraryW
FreeLibrary
WaitForMultipleObjects
MulDiv
lstrcmpW
SetThreadPriority
InterlockedExchangeAdd
ResetEvent
PulseEvent
ReleaseSemaphore
CreateSemaphoreW
TryEnterCriticalSection
GetFileSizeEx
ReadFile
WriteFile
ResumeThread
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLangID
GetModuleFileNameW
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
InterlockedCompareExchange
GetFullPathNameA
InterlockedDecrement
SetEvent
CreateEventW
InterlockedIncrement
GetSystemTime
SystemTimeToFileTime
SetEnvironmentVariableA
Sleep
CreateDirectoryW
GetDiskFreeSpaceExW
WaitForSingleObject
RaiseException
GetVersionExW
GetModuleHandleW
GetProcAddress
GetSystemInfo
GlobalMemoryStatusEx
QueryPerformanceFrequency
QueryPerformanceCounter
SetErrorMode
SetUnhandledExceptionFilter
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ExitProcess
GetFileAttributesA
FindFirstFileA
GetLastError
CreateFileA
GetFileInformationByHandle
CompareFileTime
CloseHandle
FindNextFileA
FindClose
OutputDebugStringA

user32

wsprintfW
GetForegroundWindow
PeekMessageW
GetSystemMetrics
SystemParametersInfoW
GetCursorPos
SetCursor
GetDesktopWindow
GetWindowRect
GetRawInputData
GetClientRect
PostQuitMessage
SetCapture
ReleaseCapture
PostMessageW
EqualRect
DefWindowProcW
OffsetRect
SetWindowPlacement
SetWindowPos
IsWindowVisible
SetFocus
FindWindowW
SetForegroundWindow
LoadIconW
LoadImageW
RegisterClassExW
SetRect
AdjustWindowRect
CreateWindowExW
ShowWindow
SetWindowLongW
GetWindowPlacement
MessageBoxW
DestroyWindow
SetTimer
GetMessageW
TranslateMessage
KillTimer
DispatchMessageW
RegisterWindowMessageW
MsgWaitForMultipleObjects
GetWindowLongW
SetKeyboardState
GetQueueStatus
PostThreadMessageW
GetRawInputDeviceList
GetRawInputDeviceInfoW
RegisterRawInputDevices
GetKeyboardLayout
MessageBoxA
GetAsyncKeyState
IsIconic

gdi32

GetStockObject

shell32

SHGetFolderPathA
SHCreateDirectoryExA

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
CoFreeUnusedLibraries
CoInitializeEx

oleaut32

SysFreeString
SysAllocString

dbghelp

SymInitialize
SymGetModuleInfo64
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymGetSymFromAddr64
SymSetOptions
SymGetLineFromAddr64

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx
D3DXCreateTextureFromFileExA
D3DXLoadSurfaceFromMemory
D3DXAssembleShader
D3DXCreateCubeTextureFromFileInMemoryEx

dinput8

DirectInput8Create

winmm

timeBeginPeriod
timeSetEvent
timeGetTime
timeEndPeriod
timeKillEvent

Exports

Exports

??0GBufferedFile@@IAE@XZ
??0GBufferedFile@@QAE@PAVGFile@@@Z
??0GEvent@@QAE@_N0@Z
??0GImage@@QAE@ABV0@@Z
??0GImage@@QAE@ABVGImageBase@@@Z
??0GImage@@QAE@W4ImageFormat@GImageBase@@KK@Z
??0GImage@@QAE@XZ
??0GMutex@@QAE@_N0@Z
??0GRefCountBaseImpl@@QAE@PAVGRefCountImpl@@@Z
??0GRefCountBaseImpl@@QAE@XZ
??0GSemaphore@@QAE@H_N@Z
??0GSysFile@@QAE@ABVGString@@HH@Z
??0GSysFile@@QAE@XZ
??0GThread@@QAE@ABUCreateParams@0@@Z
??0GThread@@QAE@IH@Z
??0GThread@@QAE@P6AHPAV0@PAX@Z1IHW4ThreadState@0@@Z
??0GWaitCondition@@QAE@XZ
??1GAcquireInterface@@UAE@XZ
??1GBufferedFile@@UAE@XZ
??1GDefaultAcquireInterface@@UAE@XZ
??1GEvent@@UAE@XZ
??1GFxLoader@@UAE@XZ
??1GImage@@UAE@XZ
??1GMutex@@UAE@XZ
??1GRefCountBaseImpl@@UAE@XZ
??1GSemaphore@@UAE@XZ
??1GThread@@UAE@XZ
??1GWaitCondition@@QAE@XZ
??EGSemaphore@@QAEHH@Z
??FGSemaphore@@QAEHH@Z
??YGSemaphore@@QAEHH@Z
??ZGSemaphore@@QAEHH@Z
??_FGEvent@@QAEXXZ
??_FGMutex@@QAEXXZ
??_FGSemaphore@@QAEXXZ
??_FGThread@@QAEXXZ
?Acquire@GWaitable@@QAE_NI@Z
?AcquireMultipleObjects@GAcquireInterface@@SA_NPAPAVGWaitable@@II@Z
?AcquireOneOfMultipleObjects@GAcquireInterface@@SAHPAPAVGWaitable@@II@Z
?AddWaitHandler@GWaitable@@QAE_NP6AXPAX@Z0@Z
?Append@GMatrix2D@@QAEAAV1@ABV1@@Z
?Blend@GColor@@SG?AV1@V1@0M@Z
?BytesAvailable@GBufferedFile@@UAEHXZ
?CallWaitHandlers@GWaitable@@QAEXXZ
?CallWaitHandlers@HandlerArray@GWaitable@@QAEXXZ
?CanAcquire@GAcquireInterface@@UAE_NXZ
?CanAcquire@GEvent@@UAE_NXZ
?CanAcquire@GMutex@@UAE_NXZ
?CanAcquire@GSemaphore@@UAE_NXZ
?ChangeSize@GBufferedFile@@UAE_NH@Z
?Close@GBufferedFile@@UAE_NXZ
?Close@GSysFile@@UAE_NXZ
?ConvertHSIToRGB@GColor@@SGXNNNPAN00@Z
?ConvertRGBToHSI@GColor@@SGXNNNPAN00@Z
?CopyFromStream@GBufferedFile@@UAEHPAVGFile@@H@Z
?CreateWaitableIncrement@GSemaphore@@QAEPAVGWaitable@@H@Z
?DoesFlip@GMatrix2D@@QBE_NXZ
?EncloseTransform@GMatrix2D@@QBEXPAV?$GRect@M@@ABV2@@Z
?Exit@GThread@@UAEXH@Z
?FinishAllThreads@GThread@@SAXXZ
?Flush@GBufferedFile@@UAE_NXZ
?FlushBuffer@GBufferedFile@@IAEXXZ
?Format@GColor@@QBEXPAD@Z
?Format@GMatrix2D@@QBEXPAD@Z
?GetAcquireInterface@GEvent@@UAEPAVGAcquireInterface@@XZ
?GetAcquireInterface@GMutex@@UAEPAVGAcquireInterface@@XZ
?GetAcquireInterface@GSemaphore@@UAEPAVGAcquireInterface@@XZ
?GetAcquireInterface@GWaitable@@UAEPAVGAcquireInterface@@XZ
?GetCPUCount@GThread@@SAHXZ
?GetDefaultAcquireInterface@GDefaultAcquireInterface@@SAPAV1@XZ
?GetDeterminant@GMatrix2D@@QBEMXZ
?GetErrorCode@GSysFile@@UAEHXZ
?GetExitFlag@GThread@@QBE_NXZ
?GetFileStat@GSysFile@@SA_NPAUGFileStat@@ABVGString@@@Z
?GetHSI@GColor@@QBEXPAH00@Z
?GetHSI@GColor@@QBEXPAM00@Z
?GetHSV@GColor@@QBEXPAH00@Z
?GetHSV@GColor@@QBEXPAM00@Z
?GetLength@GBufferedFile@@UAEHXZ
?GetMaxScale@GMatrix2D@@QBEMXZ
?GetRotation@GMatrix2D@@QBENXZ
?GetThreadState@GThread@@QBE?AW4ThreadState@1@XZ
?GetX@GMatrix2D@@QBEMXZ
?GetXScale@GMatrix2D@@QBENXZ
?GetY@GMatrix2D@@QBEMXZ
?GetYScale@GMatrix2D@@QBENXZ
?IsFinished@GThread@@QBE_NXZ
?IsLockedByAnotherThread@GMutex@@QAE_NXZ
?IsSignaled@GEvent@@UBE_NXZ
?IsSignaled@GMutex@@UBE_NXZ
?IsSignaled@GSemaphore@@UBE_NXZ
?IsSignaled@GWaitable@@UBE_NXZ
?IsSuspended@GThread@@QBE_NXZ
?IsValid@GMatrix2D@@QBE_NXZ
?IsValid@GSysFile@@UAE_NXZ
?LGetLength@GBufferedFile@@UAE_JXZ
?LSeek@GBufferedFile@@UAE_J_JH@Z
?LTell@GBufferedFile@@UAE_JXZ
?LoadBuffer@GBufferedFile@@IAEXXZ
?Lock@GMutex@@QAEXXZ
?MSleep@GThread@@SA_NI@Z
?Notify@GWaitCondition@@QAEXXZ
?NotifyAll@GWaitCondition@@QAEXXZ
?ObtainSemaphore@GSemaphore@@QAE_NHI@Z
?OnExit@GThread@@UAEXXZ
?Open@GSysFile@@QAE_NABVGString@@HH@Z
?Prepend@GMatrix2D@@QAEAAV1@ABV1@@Z
?PulseEvent@GEvent@@QAEXXZ
?Read@GBufferedFile@@UAEHPAEH@Z
?Release@HandlerArray@GWaitable@@QAEXXZ
?ReleaseSemaphore@GSemaphore@@QAE_NH@Z
?RemoveWaitHandler@GWaitable@@QAE_NP6AXPAX@Z0@Z
?ResetEvent@GEvent@@QAEXXZ
?Resume@GThread@@QAE_NXZ
?Run@GThread@@UAEHXZ
?Seek@GBufferedFile@@UAEHHH@Z
?SetBufferMode@GBufferedFile@@IAE_NW4BufferModeType@1@@Z
?SetEvent@GEvent@@QAEXXZ
?SetExitFlag@GThread@@QAEX_N@Z
?SetHSI@GColor@@QAEXHHH@Z
?SetHSI@GColor@@QAEXMMM@Z
?SetHSV@GColor@@QAEXHHH@Z
?SetHSV@GColor@@QAEXMMM@Z
?SetIdentity@GMatrix2D@@QAEXXZ
?SetInverse@GMatrix2D@@QAEXABV1@@Z
?SetLerp@GMatrix2D@@QAEXABV1@0M@Z
?SetRefCountMode@GRefCountBaseImpl@@QAE_NI@Z
?SkipBytes@GBufferedFile@@UAEHH@Z
?Sleep@GThread@@SA_NI@Z
?Start@GThread@@UAE_NW4ThreadState@1@@Z
?Suspend@GThread@@QAE_NXZ
?Swap@GMatrix2D@@QAEXPAV1@@Z
?Tell@GBufferedFile@@UAEHXZ
?Transform@GMatrix2D@@QBEXPAV?$GPoint@M@@ABV2@@Z
?TransformByInverse@GMatrix2D@@QBEXPAV?$GPoint@M@@ABV2@@Z
?TransformVector@GMatrix2D@@QBEXPAV?$GPoint@M@@ABV2@@Z
?TryAcquire@GAcquireInterface@@UAE_NXZ
?TryAcquire@GEvent@@UAE_NXZ
?TryAcquire@GMutex@@UAE_NXZ
?TryAcquire@GSemaphore@@UAE_NXZ
?TryAcquireCancel@GAcquireInterface@@UAE_NXZ
?TryAcquireCancel@GEvent@@UAE_NXZ
?TryAcquireCancel@GMutex@@UAE_NXZ
?TryAcquireCancel@GSemaphore@@UAE_NXZ
?TryAcquireCommit@GAcquireInterface@@UAE_NXZ
?TryAcquireCommit@GEvent@@UAE_NXZ
?TryAcquireCommit@GMutex@@UAE_NXZ
?TryAcquireCommit@GSemaphore@@UAE_NXZ
?TryLock@GMutex@@QAE_NXZ
?Unlock@GMutex@@QAEXXZ
?Wait@GEvent@@QAE_NI@Z
?Wait@GWaitCondition@@QAE_NPAVGMutex@@I@Z
?Wait@GWaitable@@QAE_NI@Z
?Write@GBufferedFile@@UAEHPBEH@Z

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 211KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3dd73985ccb27ed5ba72b71c5ed6a99

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

3c:24:38:4d:5c:99:fc:1d:99:e4:c8:6f:56:0c:91:7eCertificate

Extended Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

66:49:1f:2f:52:ba:4d:07:84:d1:d4:68:62:6a:b8:ca:07:5a:26:10Signer

Signature Validations

Verification

06/08/2014, 13:01 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

dsound

xinput9_1_0

curllib

ws2_32

steam_api

xinput1_3

cryptopp

kernel32

user32

gdi32

shell32

ole32

oleaut32

dbghelp

d3d9

d3dx9_43

dinput8

winmm

Exports

Exports

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 211KB - Virtual size: 3.2MB

.rsrc Size: 192KB - Virtual size: 191KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

3c:24:38:4d:5c:99:fc:1d:99:e4:c8:6f:56:0c:91:7e
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

66:49:1f:2f:52:ba:4d:07:84:d1:d4:68:62:6a:b8:ca:07:5a:26:10
Signer

06/08/2014, 13:01
Valid: false

.text
Size: 5.2MB - Virtual size: 5.2MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 211KB - Virtual size: 3.2MB

.rsrc
Size: 192KB - Virtual size: 191KB