dontstarve_steam[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dontstarve_steam.exe
Size

2.7MB
MD5

6c8ccca7b1ec3b037236c9c09c5ed290
SHA1

b2c7ee296b375a885770557d9535cefbad1d9c73
SHA256

9ba09356a98dc0f0e86ee947ff8ff20dd85c3f100408203729667d1acebfcdfd
SHA512

71569d016f6df386463d93287ce0e3d11d4af1d57dd5cccfa2972e55b29fac0cdb9e2793b4fe4af5c03825eed25cf4b1d110497282ff2c6b0fd7f67e8c5356b1
SSDEEP

49152:wjmHibmU2hAbD0jZ8fWBbmUQUilrF9Vq7LeZtqCLScbWwp/bjI3FT+e9Ugs:wiHiq2D0jqfWB3QUixVq7L4J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dontstarve_steam.exe

Files

dontstarve_steam.exe
.exe windows x86

Password:

07df3047f0a3ec6498b3e46671891eb9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libglesv2

ord54
ord7
ord22
ord106
ord109
ord61
ord32
ord2
ord3
ord90
ord66
ord65
ord58
ord55
ord77
ord72
ord34
ord112
ord117
ord121
ord125
ord128
ord129
ord130
ord113
ord27
ord99
ord21
ord68
ord69
ord26
ord16
ord19
ord20
ord37
ord102
ord17
ord1
ord97
ord114
ord44
ord141
ord131
ord30
ord52
ord50
ord13
ord29
ord142
ord64
ord91
ord48
ord47
ord15
ord41
ord4
ord53
ord6
ord95
ord5
ord100
ord104
ord92
ord28
ord49
ord33
ord45
ord11
ord39
ord43
ord36
ord40
ord31

libegl

ord32
ord23
ord9
ord7
ord6
ord34
ord3
ord2
ord25

wsock32

shutdown
gethostname
gethostbyname
gethostbyaddr
htonl
inet_addr
inet_ntoa
WSAStartup
WSAGetLastError
recv
send
setsockopt
getsockname
ntohs
bind
htons
getsockopt
getpeername
closesocket
socket
connect
WSASetLastError
sendto
recvfrom
accept
listen
__WSAFDIsSet
select
WSACleanup

ws2_32

getaddrinfo
freeaddrinfo

wldap32

ord41
ord46
ord147
ord79
ord142
ord127
ord27
ord26
ord208
ord216
ord145
ord14
ord118
ord301
ord133
ord167

winmm

timeEndPeriod
timeBeginPeriod

fmodex

?remove@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?addDSP@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAPAVDSPConnection@2@@Z
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?setParameter@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
?setSpeakerMode@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?setStreamBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?setFileSystem@System@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PBDHPAIPAPAX2@ZP6G?AW43@PAX4@ZP6G?AW43@44I14@ZP6G?AW43@4I4@ZP6G?AW43@PAUFMOD_ASYNCREADINFO@@4@Z5H@Z
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ

fmod_event

?stop@Event@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?init@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@HIPAXI@Z
?setMediaPath@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PBD@Z
?load@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAUFMOD_EVENT_LOADINFO@@PAPAVEventProject@2@@Z
?getState@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getSystemObject@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?getCategory@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVEventCategory@2@@Z
?getReverbPreset@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAUFMOD_REVERB_PROPERTIES@@PAH@Z
?setReverbProperties@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_REVERB_PROPERTIES@@@Z
?getNumProjects@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?unload@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DListenerAttributes@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getProjectByIndex@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVEventProject@2@@Z
?update@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@XZ
FMOD_EventSystem_Create
?getEvent@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAPAVEvent@2@@Z
?start@Event@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getParameter@Event@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVEventParameter@2@@Z
?setValue@EventParameter@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DAttributes@Event@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?release@Event@FMOD@@QAG?AW4FMOD_RESULT@@_N0@Z
?setVolume@Event@FMOD@@QAG?AW4FMOD_RESULT@@M@Z

xinput1_3

ord4
ord3
ord2
ord8
ord5

dinput8

DirectInput8Create

steam_api

SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
SteamRemoteStorage
SteamApps
SteamAPI_Init
SteamClient
SteamUtils
SteamUserStats
SteamAPI_Shutdown
SteamAPI_SetMiniDumpComment
SteamAPI_WriteMiniDump
SteamAPI_RunCallbacks
SteamUser
SteamAPI_RestartAppIfNecessary

kernel32

CloseHandle
CreateProcessA
GetProcAddress
GetModuleHandleA
SetCurrentDirectoryA
IsDebuggerPresent
OutputDebugStringA
GetVersion
GetCurrentDirectoryA
GetFullPathNameA
FindClose
FindNextFileA
FindFirstFileA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
SleepEx
FormatMessageA
GetTickCount
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
FreeLibrary
LoadLibraryW
Sleep
ExpandEnvironmentStringsA
GetCurrentThreadId
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
CreateDirectoryA
GetLongPathNameA
InterlockedExchange
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
QueryPerformanceFrequency
RaiseException
ResumeThread
SetThreadPriority
InitializeCriticalSectionAndSpinCount
CreateSemaphoreA
InterlockedDecrement
ReleaseSemaphore
InterlockedIncrement
CreateMutexA
ReleaseMutex
InterlockedCompareExchange
GetFileAttributesA
DeleteFileA
RemoveDirectoryA
GetModuleFileNameA
GetSystemTimeAsFileTime
WaitForSingleObject

user32

TranslateMessage
DispatchMessageA
MessageBoxA
GetUserObjectInformationW
PeekMessageA
LoadCursorA
RegisterClassA
CreateWindowExA
ShowWindow
GetDC
EnumDisplayDevicesA
GetWindowLongA
InvalidateRect
DefWindowProcA
SetCursor
ChangeDisplaySettingsExA
SetWindowLongA
MoveWindow
ClipCursor
MapWindowPoints
GetCursorPos
SetCursorPos
EnumDisplaySettingsA
MonitorFromPoint
AdjustWindowRect
MonitorFromWindow
GetMonitorInfoA
SetWindowPos
GetWindowRect
GetClientRect
SetCapture
ReleaseCapture
MapVirtualKeyA
GetForegroundWindow
SystemParametersInfoA
GetDesktopWindow
GetProcessWindowStation

gdi32

GetStockObject

advapi32

DeregisterEventSource
RegisterEventSourceA
ReportEventA

shell32

SHGetFolderPathA
SHCreateDirectoryExA
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA

ole32

CoInitialize
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

oleaut32

SysAllocString
SysFreeString

msvcp90

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?epsilon@?$numeric_limits@N@std@@SANXZ
??$?5DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?epsilon@?$numeric_limits@M@std@@SAMXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?eof@ios_base@std@@QBE_NXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
_Inf
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??0?$allocator@D@std@@QAE@XZ
??0?$allocator@D@std@@QAE@ABV01@@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?max_size@?$allocator@D@std@@QBEIXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?infinity@?$numeric_limits@M@std@@SAMXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDU_Size_type_nosscl@01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADU_Size_type_nosscl@01@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@D@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?width@ios_base@std@@QAEHH@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z

msvcr90

__CxxFrameHandler3
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_purecall
_snprintf
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
memset
printf
_time64
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
strstr
memcpy
strncmp
_CIexp
_CIlog
_CIpow
_CIsqrt
_CIcos
_CIsin
ceil
toupper
isgraph
_CIfmod
rand
??0exception@std@@QAE@ABQBDH@Z
_wassert
_CIatan2
floor
strcspn
_isnan
_stricmp
clock
strtol
fclose
fread
ftell
fseek
fopen
abort
calloc
realloc
free
malloc
_errno
tolower
sscanf
strchr
fwrite
__iob_func
isxdigit
strncpy
strtoul
strrchr
memmove
_strtoi64
fgets
qsort
fputs
isdigit
sprintf
fputc
_beginthreadex
strerror
__sys_nerr
fflush
isalnum
isspace
memchr
_fstat64
_lseeki64
getenv
_gmtime64
isalpha
_stat64i32
_open
_stat64
wcsstr
_vsnprintf
vfprintf
_exit
raise
strcmp
fprintf
_strnicmp
ferror
_setmode
_fileno
feof
_wfopen
_localtime64
isupper
islower
isprint
_ftime64
signal
_getch
_CItan
swscanf
_mbslen
fopen_s
remove
_mbsicmp
atof
ungetc
freopen
getc
strtod
strncat
_setjmp3
exit
longjmp
strcoll
iscntrl
localeconv
_difftime64
_mktime64
strftime
_CIsinh
_CIcosh
_CItanh
_CIasin
_CIacos
_CIatan
modf
_CIlog10
frexp
ldexp
srand
_HUGE
ispunct
strpbrk
_pclose
strtok
_popen
tmpfile
fscanf
clearerr
setvbuf
_finite
??8type_info@@QBE_NABV0@@Z
_amsg_exit
__getmainargs
_cexit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_strdup
_close
_write
_read
atoi

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password:

07df3047f0a3ec6498b3e46671891eb9

Headers

DLL Characteristics

File Characteristics

Imports

libglesv2

libegl

wsock32

ws2_32

wldap32

winmm

fmodex

fmod_event

xinput1_3

dinput8

steam_api

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 376KB - Virtual size: 375KB

.data Size: 46KB - Virtual size: 63KB

.rsrc Size: 84KB - Virtual size: 84KB

.reloc Size: 112KB - Virtual size: 112KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 376KB - Virtual size: 375KB

.data
Size: 46KB - Virtual size: 63KB

.rsrc
Size: 84KB - Virtual size: 84KB

.reloc
Size: 112KB - Virtual size: 112KB