BeamNG[.]drive[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BeamNG.drive.exe
Size

910KB
MD5

8f9710125cb8aa645e918bbe7629865a
SHA1

cff063a659805eb4b52dcb7d3adfb03bb4b8a387
SHA256

f15bda1ca055561c0e356a7bed24b75033168708084ce539c3f5facc7ad3dbde
SHA512

4014251ca49c30aa8487d3f155442418d15bd8971dc9697d89e3d331afab29613ec2a62aad9f19fb2d226295d34c19e0139a8f675716d42be3c0a6f3414b058e
SSDEEP

24576:zSMENW6mAOvHCvLGlIjKNBUibJkkKkkr/r:zgWHdZNYr

Score

1^/10

Malware Config

Signatures

Files

BeamNG.drive.exe
.exe windows x86

9b95d646f7c0b194c6964954b5d89db8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
VerSetConditionMask
CreateFileW
WriteFile
GetLastError
WaitNamedPipeW
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
OpenProcess
GlobalMemoryStatusEx
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FreeLibrary
GetModuleFileNameW
GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LoadLibraryW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetDriveTypeA
FlushFileBuffers
AllocConsole
LocalFree
SetErrorMode
GetCommandLineW
GetCommandLineA
CreateProcessW
WaitForSingleObject
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentProcessId
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
QueryPerformanceCounter
CloseHandle
GetFileAttributesW
FindNextFileW
FindFirstFileW
EncodePointer
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetVolumeInformationA
LoadLibraryA
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetConsoleTitleW
FreeConsole
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
MoveFileW
CopyFileW
RemoveDirectoryW
DeleteFileW
FormatMessageA
ExpandEnvironmentStringsA
SetLastError
VerifyVersionInfoA
SleepEx
Sleep
GetTickCount
GetFileSize
ReadFile
SetFilePointer
FindClose
CreateDirectoryW
GetFileAttributesExW

user32

MessageBoxA
MessageBoxW
EmptyClipboard
SetClipboardData
CloseClipboard
GetMessageA
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
DefWindowProcW
LoadIconW
RegisterClassExA
CreateWindowExA
DestroyWindow
OpenClipboard
UnregisterClassA
SendMessageW

shell32

CommandLineToArgvW
SHGetFolderPathW
SHCreateDirectoryExW
SHGetKnownFolderPath
ShellExecuteW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitialize

advapi32

CryptCreateHash
CryptDestroyHash
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptHashData
OpenProcessToken

ws2_32

ioctlsocket
WSAGetLastError
bind
closesocket
htons
inet_addr
sendto
socket
WSAStartup
WSACleanup
__WSAFDIsSet
select
WSASetLastError
recv
send
connect
getpeername
getsockname
getsockopt
ntohs
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo

shlwapi

PathFileExistsW

msvcp120

?_Incref@facet@locale@std@@UAEXXZ
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??1_Lockit@std@@QAE@XZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Getcoll
_Strcoll
_Strxfrm
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
??0facet@locale@std@@IAE@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??0_Lockit@std@@QAE@H@Z

msvcr120

_CxxThrowException
__CxxFrameHandler3
memcpy
memset
__iob_func
getc
_snwprintf
exit
fclose
fflush
fgetc
fgetpos
fputc
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_lock_file
_unlock_file
memcpy_s
modf
??_V@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
sprintf_s
sscanf
strpbrk
isxdigit
strtoul
calloc
isdigit
strncmp
sprintf
strtol
strrchr
fgets
fopen
fputs
qsort
strtoll
tolower
isalpha
strncpy
strstr
fread
fseek
isspace
toupper
isalnum
_gmtime64
getenv
strerror
__sys_nerr
_errno
_stat64i32
isupper
printf
_snprintf_s
_localtime64_s
fopen_s
ftell
strtod
_waccess
_wchmod
_mbsicmp
rewind
_wfopen
wcsncpy_s
_wmkdir
_wrename
_wstat64
freopen
_mktime64
atoi
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_except1
??1type_info@@UAE@XZ
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
?terminate@@YAXXZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_vsnprintf_s
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
_time64
_localtime64
strftime
??0bad_cast@std@@QAE@PBD@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
strchr
memmove
memchr
realloc
malloc
free
_snprintf
_hypot
??3@YAXPAX@Z
??2@YAPAXI@Z
fprintf
_strdup
_read
_write
_purecall
_stricmp

comctl32

ord345

powrprof

PowerGetActiveScheme
PowerSetActiveScheme

oleaut32

SysFreeString
SysAllocString

Exports

Exports

NvOptimusEnablement
PHYSFS_addToSearchPath
PHYSFS_close
PHYSFS_deinit
PHYSFS_delete
PHYSFS_deregisterArchiver
PHYSFS_enumerateFiles
PHYSFS_enumerateFilesCallback
PHYSFS_enumerateFilesWithAttrb
PHYSFS_eof
PHYSFS_exists
PHYSFS_fileLength
PHYSFS_flush
PHYSFS_freeList
PHYSFS_getAllocator
PHYSFS_getBaseDir
PHYSFS_getCdRomDirs
PHYSFS_getCdRomDirsCallback
PHYSFS_getDirSeparator
PHYSFS_getErrorByCode
PHYSFS_getLastError
PHYSFS_getLastErrorCode
PHYSFS_getLastModTime
PHYSFS_getLinkedVersion
PHYSFS_getMountPoint
PHYSFS_getPrefDir
PHYSFS_getRealDir
PHYSFS_getSearchPath
PHYSFS_getSearchPathCallback
PHYSFS_getUserDir
PHYSFS_getWriteDir
PHYSFS_init
PHYSFS_isDirectory
PHYSFS_isInit
PHYSFS_isSymbolicLink
PHYSFS_mkdir
PHYSFS_mount
PHYSFS_mountHandle
PHYSFS_mountIo
PHYSFS_mountMemory
PHYSFS_openAppend
PHYSFS_openRead
PHYSFS_openWrite
PHYSFS_permitSymbolicLinks
PHYSFS_read
PHYSFS_readBytes
PHYSFS_readSBE16
PHYSFS_readSBE32
PHYSFS_readSBE64
PHYSFS_readSLE16
PHYSFS_readSLE32
PHYSFS_readSLE64
PHYSFS_readUBE16
PHYSFS_readUBE32
PHYSFS_readUBE64
PHYSFS_readULE16
PHYSFS_readULE32
PHYSFS_readULE64
PHYSFS_registerArchiver
PHYSFS_removeFromSearchPath
PHYSFS_seek
PHYSFS_setAllocator
PHYSFS_setBuffer
PHYSFS_setErrorCode
PHYSFS_setSaneConfig
PHYSFS_setWriteDir
PHYSFS_stat
PHYSFS_supportedArchiveTypes
PHYSFS_swapSBE16
PHYSFS_swapSBE32
PHYSFS_swapSBE64
PHYSFS_swapSLE16
PHYSFS_swapSLE32
PHYSFS_swapSLE64
PHYSFS_swapUBE16
PHYSFS_swapUBE32
PHYSFS_swapUBE64
PHYSFS_swapULE16
PHYSFS_swapULE32
PHYSFS_swapULE64
PHYSFS_symbolicLinksPermitted
PHYSFS_tell
PHYSFS_unmount
PHYSFS_utf8FromLatin1
PHYSFS_utf8FromUcs2
PHYSFS_utf8FromUcs4
PHYSFS_utf8FromUtf16
PHYSFS_utf8ToUcs2
PHYSFS_utf8ToUcs4
PHYSFS_utf8ToUtf16
PHYSFS_write
PHYSFS_writeBytes
PHYSFS_writeSBE16
PHYSFS_writeSBE32
PHYSFS_writeSBE64
PHYSFS_writeSLE16
PHYSFS_writeSLE32
PHYSFS_writeSLE64
PHYSFS_writeUBE16
PHYSFS_writeUBE32
PHYSFS_writeUBE64
PHYSFS_writeULE16
PHYSFS_writeULE32
PHYSFS_writeULE64

Sections

.text
Size: 474KB - Virtual size: 474KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b95d646f7c0b194c6964954b5d89db8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

advapi32

ws2_32

shlwapi

msvcp120

msvcr120

comctl32

powrprof

oleaut32

Exports

Exports

Sections

.text Size: 474KB - Virtual size: 474KB

.rdata Size: 135KB - Virtual size: 134KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 276KB - Virtual size: 276KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 474KB - Virtual size: 474KB

.rdata
Size: 135KB - Virtual size: 134KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 276KB - Virtual size: 276KB

.reloc
Size: 20KB - Virtual size: 20KB