MarblesOnStream-Win64-Shipping[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MarblesOnStream-Win64-Shipping.exe
Size

87.2MB
MD5

3bc359e8513d418d243e6dd65ec2740b
SHA1

8574fefc79cd05a2cc542562271c5fb2475b8fe2
SHA256

a5c3c7ba26b1a5467215320242cf2859622db838bc2e92c154ba38eb3056ee83
SHA512

9679a1b94711c4aa79adbac5d230bfdf8a65f24b0a25a65bc3fdc4f658ab336e1e2450940e2ef0a4d8f64b3860895035bd2f97994419716c50e397fc549a8c05
SSDEEP

786432:3nWFBqnWFBcjbyH86KpGUffdU4wf9UajKKDv/QBg:3nWFBqnWFBcjbe86KkUffdbwyAKKDv4C

Score

1^/10

Malware Config

Signatures

Files

MarblesOnStream-Win64-Shipping.exe
.exe windows x64

c186be8dc01b4e2397557eb24a5588b1

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:dd:0b:d6:05:27:3c:00:51:56:c7:33:a7:ce:eb:eb
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/06/2020, 00:00

Not After

21/09/2023, 12:00

Subject

SERIALNUMBER=2558886,CN=Pixel by Pixel Studios Inc.,O=Pixel by Pixel Studios Inc.,L=North York,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13074f6e746172696f,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

90:22:bc:6a:85:99:d4:e1:2e:03:1c:3d:89:f9:4b:5e:b8:f6:a7:72
Signer

Actual PE Digest

90:22:bc:6a:85:99:d4:e1:2e:03:1c:3d:89:f9:4b:5e:b8:f6:a7:72

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2558886,CN=Pixel by Pixel Studios Inc.,O=Pixel by Pixel Studios Inc.,L=North York,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13074f6e746172696f,1.3.6.1.4.1.311.60.2.1.3=#13024341

03/05/2023, 15:48
Valid: true

Chain 1

SERIALNUMBER=2558886,CN=Pixel by Pixel Studios Inc.,O=Pixel by Pixel Studios Inc.,L=North York,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13074f6e746172696f,1.3.6.1.4.1.311.60.2.1.3=#13024341

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

x3daudio1_7

X3DAudioCalculate
X3DAudioInitialize

xapofx1_5

CreateFX

xinput1_3

ord2
ord3

dxgi

CreateDXGIFactory
CreateDXGIFactory1

d3d9

D3DPERF_BeginEvent
D3DPERF_EndEvent

d3d11

D3D11CreateDevice

advapi32

CryptEnumProvidersW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
LookupPrivilegeValueA
AdjustTokenPrivileges
AllocateLocallyUniqueId
CryptAcquireContextW
CryptReleaseContext
GetUserNameW
OpenProcessToken
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
RegCloseKey

user32

GetWindowDisplayAffinity
ChangeDisplaySettingsExW
ChangeDisplaySettingsW
GetClipCursor
ClientToScreen
WindowFromPoint
EnableWindow
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetActiveWindow
AllowSetForegroundWindow
PeekMessageW
RegisterHotKey
UnregisterHotKey
PostQuitMessage
SetWindowPos
DialogBoxParamW
EndDialog
GetDlgItem
SetDlgItemTextW
GetSystemMetrics
SetForegroundWindow
SetWindowTextW
GetWindowRect
MessageBoxW
ScreenToClient
GetUserObjectInformationW
SetCursor
SetCursorPos
ShowCursor
ReleaseCapture
AdjustWindowRectEx
GetClientRect
SetWindowRgn
EndPaint
SetWindowDisplayAffinity
BeginPaint
GetWindowThreadProcessId
EnumDisplayDevicesW
MapVirtualKeyW
IsChild
DisableProcessWindowsGhosting
TranslateMessage
DispatchMessageW
GetMessageExtraInfo
SendMessageW
PostMessageW
DefWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
SetCapture
GetCapture
RegisterTouchWindow
CloseTouchInputHandle
GetTouchInputInfo
SetWindowPlacement
SendInput
GetAsyncKeyState
GetKeyState
IsWindow
GetRawInputDeviceList
RegisterRawInputDevices
ReleaseDC
EnumDisplayDevicesA
GetDC
GetForegroundWindow
SetActiveWindow
UpdateWindow
DrawStateW
EnableMenuItem
GetSystemMenu
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
FlashWindowEx
GetWindowPlacement
GetRawInputDeviceInfoA
GetRawInputData
GetWindowInfo
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
MonitorFromPoint
SystemParametersInfoW
EnumDisplaySettingsW
CreateIconIndirect
LoadImageW
LoadIconW
GetParent
SetParent
GetDesktopWindow
GetCursorPos
GetKeyboardLayout
GetProcessWindowStation
ClipCursor
GetWindowLongW
SetWindowLongW
GetClassLongPtrW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
LoadCursorW
LoadCursorFromFileW
GetTopWindow
GetFocus
SetFocus
GetClipboardData
IsZoomed
IsIconic
IsWindowEnabled

gdi32

CreateFontIndirectW
CreateCompatibleDC
DeleteDC
SwapBuffers
SetPixelFormat
ChoosePixelFormat
GetTextExtentPoint32W
GetObjectW
CreateDIBSection
SetTextAlign
SetTextColor
SetBkMode
SetBkColor
SelectObject
CreateBitmap
TextOutW
CreateRectRgn
CreateRoundRectRgn
DeleteObject
GetDeviceCaps
GetPixel
GetStockObject
PtInRegion

ws2_32

WSACloseEvent
inet_pton
accept
__WSAFDIsSet
inet_addr
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
htons
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
gethostname
WSAStartup
WSACleanup
WSAGetLastError
WSAIoctl
WSAStringToAddressW
WSAAddressToStringW
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
getaddrinfo
freeaddrinfo
getnameinfo
gethostbyname
WSASetLastError
getprotobyname

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertOpenStore
CertGetCertificateContextProperty
CertCloseStore

wldap32

ord32
ord46
ord211
ord301
ord200
ord60
ord30
ord79
ord35
ord33
ord143
ord27
ord26
ord22
ord41
ord50

normaliz

IdnToAscii

dsound

ord11
ord12
ord1
ord3
ord6
ord8

winmm

timeBeginPeriod
timeEndPeriod
waveOutGetNumDevs

kernel32

GetThreadContext
CreateProcessW
ResumeThread
SuspendThread
OpenThread
SwitchToThread
GetExitCodeProcess
TerminateProcess
GetProcessTimes
CreateSemaphoreW
ReleaseSemaphore
QueryPerformanceFrequency
PeekNamedPipe
SetThreadErrorMode
SetLastError
OutputDebugStringW
GetTempPathW
SetFileTime
SetFilePointer
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
GetLongPathNameW
GetFullPathNameW
GetSystemInfo
GetFileSizeEx
GetFileAttributesExW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetEnvironmentVariableW
VerSetConditionMask
FindResourceW
ReadFile
WriteFile
GetOverlappedResult
Thread32Next
Thread32First
K32GetModuleFileNameExW
K32EnumProcessModulesEx
GetDllDirectoryW
GetSystemTime
GetLocalTime
GetVersionExW
GetLogicalProcessorInformationEx
GetNativeSystemInfo
VirtualAlloc
VirtualProtect
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GlobalMemoryStatusEx
GetFinalPathNameByHandleW
GetSystemTimeAsFileTime
SetDllDirectoryW
VirtualQuery
VerifyVersionInfoA
GetSystemDirectoryA
ExpandEnvironmentStringsA
WaitForMultipleObjects
SleepEx
GetModuleHandleA
lstrcmpA
GetProcessId
LoadLibraryExW
GetSystemDirectoryW
CompareFileTime
CreateSemaphoreA
FormatMessageA
GetDateFormatEx
GetTimeFormatEx
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
ResolveLocaleName
GetCurrencyFormatEx
GetNumberFormatEx
LocaleNameToLCID
LCIDToLocaleName
GetUserGeoID
SetThreadAffinityMask
ReOpenFile
GetModuleFileNameW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetGeoInfoW
GetDynamicTimeZoneInformation
GetLocaleInfoEx
GetACP
GetEnvironmentVariableA
VirtualUnlock
GetLargePageMinimum
FlsSetValue
FlsAlloc
VirtualFree
CreateFileMappingW
MoveFileW
GetComputerNameW
VerifyVersionInfoW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemPowerStatus
GetUserPreferredUILanguages
GetUserDefaultLocaleName
LocalAlloc
SetConsoleCtrlHandler
GetConsoleWindow
K32GetProcessMemoryInfo
GetProcessHandleCount
GetVersion
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionEx
OutputDebugStringA
SetFilePointerEx
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
RtlVirtualUnwind
AllocConsole
MultiByteToWideChar
CreateFiber
RtlCaptureContext
DeleteFiber
SwitchToFiber
WideCharToMultiByte
FlushViewOfFile
GetFileSize
GetTickCount64
WaitForSingleObjectEx
IsDebuggerPresent
GetProcessHeap
HeapFree
HeapAlloc
InitializeCriticalSectionAndSpinCount
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
K32GetModuleFileNameExA
K32EnumProcessModules
LoadLibraryA
LoadLibraryExA
GetModuleFileNameA
SetConsoleWindowInfo
RtlLookupFunctionEntry
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
DebugBreak
RtlCaptureStackBackTrace
SetConsoleTextAttribute
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
AttachConsole
InitializeCriticalSection
SetCriticalSectionSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentThreadId
TlsGetValue
TlsSetValue
GetStdHandle
GetCommandLineW
FindClose
FindFirstFileW
GetFileType
GetLastError
SetErrorMode
ReleaseMutex
CreateMutexW
Sleep
LocalFree
WriteConsoleW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
TryEnterCriticalSection
CloseHandle
SetWaitableTimer
CreateWaitableTimerW
LoadLibraryW
FormatMessageW
OpenProcess
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TlsAlloc
TlsFree
HeapSetInformation
SetHandleInformation
CreateFileW
GetFileAttributesW
RaiseException
SetUnhandledExceptionFilter
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcess
GetCurrentProcessId
ExitProcess
CreateThread
GetCurrentThread
SetThreadPriority
FreeConsole

comdlg32

GetOpenFileNameW

shell32

ShellExecuteExW
ShellExecuteW
SHGetKnownFolderPath
SHGetFolderPathW
SHGetPathFromIDListW
DragAcceptFiles
SHGetSpecialFolderPathW
SHBrowseForFolderW
CommandLineToArgvW

ole32

StringFromGUID2
OleUninitialize
CoUninitialize
RegisterDragDrop
CoTaskMemFree
CoCreateGuid
PropVariantClear
ReleaseStgMedium
IIDFromString
CoTaskMemAlloc
CoInitialize
PropVariantCopy
CoCreateInstance
RevokeDragDrop
OleInitialize

oleaut32

SysAllocString
SysFreeString
SafeArrayPutElement
SafeArrayCreateVector
VariantCopy

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiGetClassDevsA
SetupGetInfDriverStoreLocationW
CM_Get_Device_IDW
SetupDiOpenDevRegKey
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDevicePropertyW

dwmapi

DwmIsCompositionEnabled
DwmFlush
DwmGetCompositionTimingInfo
DwmSetWindowAttribute

imm32

ImmDestroyContext
ImmCreateContext
ImmGetProperty
ImmGetIMEFileNameW
ImmGetDescriptionW
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow

uiautomationcore

UiaRaiseAutomationEvent
UiaRaiseAutomationPropertyChangedEvent
UiaClientsAreListening
UiaReturnRawElementProvider
UiaHostProviderFromHwnd

winhttp

WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser

opengl32

wglGetCurrentDC
wglMakeCurrent
wglGetProcAddress
wglCreateContext
wglDeleteContext
wglGetCurrentContext

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_wait
?_Throw_C_error@std@@YAXH@Z
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Thrd_yield

bcrypt

BCryptGenRandom

vcruntime140

__intrinsic_setjmp
__current_exception_context
__current_exception
__RTDynamicCast
__std_type_info_compare
__RTtypeid
__std_exception_destroy
__std_exception_copy
__std_type_info_name
strchr
longjmp
_set_purecall_handler
strrchr
strstr
__std_terminate
__CxxFrameHandler3
memchr
wcsrchr
_CxxThrowException
_purecall
__C_specific_handler
wcsstr
memmove
memset
wcschr
memcpy
memcmp

api-ms-win-crt-runtime-l1-1-0

_getpid
__sys_nerr
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_wassert
_seh_filter_exe
strerror
signal
abort
raise
_exit
exit
strerror_s
_set_app_type
_set_invalid_parameter_handler
_endthreadex
_beginthreadex
_get_narrow_winmain_command_line
_initterm
_initterm_e
_errno
_c_exit
_invoke_watson
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
terminate

api-ms-win-crt-utility-l1-1-0

div
srand
rand
bsearch
qsort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
ftell
__stdio_common_vfprintf
puts
_write
fseek
ferror
fopen_s
_setmode
feof
_fileno
_read
_open
_wfopen
fopen
_isatty
_close
fputs
__p__commode
__stdio_common_vswprintf
_set_fmode
__stdio_common_vsprintf
setbuf
clearerr
setvbuf
_lseeki64
__acrt_iob_func
__stdio_common_vsscanf
fflush
__stdio_common_vfwprintf
__stdio_common_vsnprintf_s
fclose
fgets
fwrite
_fseeki64
fputc
fread

api-ms-win-crt-string-l1-1-0

iswdigit
iswupper
isdigit
strncmp
wcsncmp
strncat
toupper
_strdup
iswalnum
wcscpy_s
wcsncpy_s
isalpha
_wcsnicmp
_wcsicmp
strcpy_s
strncpy_s
isxdigit
strcmp
strpbrk
iswxdigit
isprint
tolower
isalnum
strncpy
iswspace
_stricmp
isupper
islower
isgraph
iswalpha
wcsncpy
iswlower
strspn
strcspn
_strnicmp
strtok
strnlen
isspace

api-ms-win-crt-math-l1-1-0

log10f
truncf
acosf
asinf
log10
sinhf
powf
fmodf
expf
lrintf
_dsign
_finite
lrint
_fpclass
logf
_isnan
_dclass
_dtest
tanf
acos
cos
pow
sin
tan
exp2
__setusermatherr
floorf
sqrt
modff
ldexp
frexp
floor
log
modf
round
ceil
trunc
asin
atan2f
sinf
fmod
atan
sqrtf
cosf
atan2
ceilf
atanf
exp

api-ms-win-crt-convert-l1-1-0

atof
_wtof
wcstod
atoll
_wtoi64
_wtoi
strtoull
_strtoi64
strtol
wcstoul
_wcstoi64
strtod
_strtoui64
_wcstoui64
atoi
strtoll
strtoul

api-ms-win-crt-heap-l1-1-0

_get_heap_handle
_aligned_malloc
_aligned_free
_heapchk
calloc
malloc
realloc
_set_new_mode
free

api-ms-win-crt-environment-l1-1-0

_putenv
getenv
_dupenv_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-filesystem-l1-1-0

_fstat64
rename
_stat32i64
_stat64
_fstat64i32
_stat64i32

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s
_gmtime64
_localtime64
_mktime64
__daylight
__timezone
_tzset
__tzname

api-ms-win-crt-conio-l1-1-0

_cputs

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
agsCheckDriverVersion
agsDeInit
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_CreateDevice
agsDriverExtensionsDX11_CreateFromDevice
agsDriverExtensionsDX11_Destroy
agsDriverExtensionsDX11_DestroyDevice
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsDriverExtensionsDX11_WriteBreadcrumb
agsDriverExtensionsDX12_CreateCommandList
agsDriverExtensionsDX12_CreateDevice
agsDriverExtensionsDX12_CreateFromDevice
agsDriverExtensionsDX12_CreateGraphicsPipelineState
agsDriverExtensionsDX12_Destroy
agsDriverExtensionsDX12_DestroyCommandList
agsDriverExtensionsDX12_DestroyDevice
agsDriverExtensionsDX12_PopMarker
agsDriverExtensionsDX12_PushMarker
agsDriverExtensionsDX12_SetDepthBounds
agsDriverExtensionsDX12_SetMarker
agsInit
agsSetDisplayMode
png_access_version_number
png_benign_error
png_build_grayscale_palette
png_calloc
png_chunk_benign_error
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_read_struct
png_create_read_struct_2
png_create_write_struct
png_create_write_struct_2
png_data_freer
png_destroy_info_struct
png_destroy_read_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_free_default
png_get_IHDR
png_get_PLTE
png_get_bKGD
png_get_bit_depth
png_get_cHRM
png_get_cHRM_fixed
png_get_channels
png_get_chunk_cache_max
png_get_chunk_malloc_max
png_get_color_type
png_get_compression_buffer_size
png_get_compression_type
png_get_copyright
png_get_current_pass_number
png_get_current_row_number
png_get_error_ptr
png_get_filter_type
png_get_gAMA
png_get_gAMA_fixed
png_get_hIST
png_get_header_ver
png_get_header_version
png_get_iCCP
png_get_image_height
png_get_image_width
png_get_int_32
png_get_interlace_type
png_get_io_chunk_name
png_get_io_chunk_type
png_get_io_ptr
png_get_io_state
png_get_libpng_ver
png_get_mem_ptr
png_get_oFFs
png_get_pCAL
png_get_pHYs
png_get_pHYs_dpi
png_get_pixel_aspect_ratio
png_get_pixel_aspect_ratio_fixed
png_get_pixels_per_inch
png_get_pixels_per_meter
png_get_rgb_to_gray_status
png_get_rowbytes
png_get_rows
png_get_sBIT
png_get_sCAL
png_get_sCAL_fixed
png_get_sCAL_s
png_get_sPLT
png_get_sRGB
png_get_signature
png_get_tIME
png_get_tRNS
png_get_text
png_get_uint_16
png_get_uint_31
png_get_uint_32
png_get_unknown_chunks
png_get_user_chunk_ptr
png_get_user_height_max
png_get_user_transform_ptr
png_get_user_width_max
png_get_valid
png_get_x_offset_inches
png_get_x_offset_inches_fixed
png_get_x_offset_microns
png_get_x_offset_pixels
png_get_x_pixels_per_inch
png_get_x_pixels_per_meter
png_get_y_offset_inches
png_get_y_offset_inches_fixed
png_get_y_offset_microns
png_get_y_offset_pixels
png_get_y_pixels_per_inch
png_get_y_pixels_per_meter
png_handle_as_unknown
png_info_init_3
png_init_io
png_longjmp
png_malloc
png_malloc_default
png_malloc_warn
png_permit_mng_features
png_read_end
png_read_image
png_read_info
png_read_png
png_read_row
png_read_rows
png_read_update_info
png_reset_zstream
png_save_int_32
png_save_uint_16
png_save_uint_32
png_set_IHDR
png_set_PLTE
png_set_add_alpha
png_set_bKGD
png_set_background
png_set_background_fixed
png_set_benign_errors
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_chunk_cache_max
png_set_chunk_malloc_max
png_set_compression_buffer_size
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_crc_action
png_set_error_fn
png_set_expand
png_set_expand_16
png_set_expand_gray_1_2_4_to_8
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_filter_heuristics_fixed
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_gamma
png_set_gamma_fixed
png_set_gray_to_rgb
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invalid
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_longjmp_fn
png_set_mem_fn
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_palette_to_rgb
png_set_quantize
png_set_read_fn
png_set_read_status_fn
png_set_read_user_chunk_fn
png_set_read_user_transform_fn
png_set_rgb_to_gray
png_set_rgb_to_gray_fixed
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sCAL_fixed
png_set_sCAL_s
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_strip_16
png_set_strip_alpha
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_tRNS_to_alpha
png_set_text
png_set_unknown_chunk_location
png_set_unknown_chunks
png_set_user_limits
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_cmp
png_start_read_image
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_write_sig
src_callback_new
src_callback_read
src_clone
src_delete
src_error
src_float_to_int_array
src_float_to_short_array
src_get_channels
src_get_description
src_get_name
src_get_version
src_int_to_float_array
src_is_valid_ratio
src_new
src_process
src_reset
src_set_ratio
src_short_to_float_array
src_simple
src_strerror

Sections

.text
Size: 61.7MB - Virtual size: 61.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16.4MB - Virtual size: 16.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.2MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c186be8dc01b4e2397557eb24a5588b1

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0a:dd:0b:d6:05:27:3c:00:51:56:c7:33:a7:ce:eb:ebCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

90:22:bc:6a:85:99:d4:e1:2e:03:1c:3d:89:f9:4b:5e:b8:f6:a7:72Signer

Signature Validations

Verification

03/05/2023, 15:48 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

x3daudio1_7

xapofx1_5

xinput1_3

dxgi

d3d9

d3d11

advapi32

user32

gdi32

ws2_32

crypt32

wldap32

normaliz

dsound

winmm

kernel32

comdlg32

shell32

ole32

oleaut32

iphlpapi

setupapi

dwmapi

imm32

uiautomationcore

winhttp

opengl32

msvcp140

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-conio-l1-1-0

Exports

Exports

Sections

.text Size: 61.7MB - Virtual size: 61.7MB

.rdata Size: 16.4MB - Virtual size: 16.4MB

.data Size: 4.2MB - Virtual size: 6.9MB

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0a:dd:0b:d6:05:27:3c:00:51:56:c7:33:a7:ce:eb:eb
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

90:22:bc:6a:85:99:d4:e1:2e:03:1c:3d:89:f9:4b:5e:b8:f6:a7:72
Signer

03/05/2023, 15:48
Valid: true

.text
Size: 61.7MB - Virtual size: 61.7MB

.rdata
Size: 16.4MB - Virtual size: 16.4MB

.data
Size: 4.2MB - Virtual size: 6.9MB

.pdata
Size: 3.1MB - Virtual size: 3.1MB

.msvcjmc
Size: 512B - Virtual size: 8B

.rodata
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 155KB - Virtual size: 154KB

.rsrc
Size: 73KB - Virtual size: 72KB

.reloc
Size: 1.5MB - Virtual size: 1.5MB