limbo[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

limbo.exe
Size

4.9MB
MD5

5f32b0503c2b21b6e9ad108053611b80
SHA1

3d2b446e56e91920cf5df45a04cf9ca189195878
SHA256

843bc0b82253fe7b122c8a05e41bae5ab28e844185f2c9a273563e635f083ddf
SHA512

32bcd388183b9aafe8c362b2ed69f1d2a3d8c4a5ecee45816212d641e8a0123c6af7f357a40ffcab533a96e895dfb7a61fd31c9bf147c973dc8dc86d3af77cb5
SSDEEP

49152:9rHd4jQ3KOlwxahMGKEgng4f/r7Ue5FA8bjt/RF9b/TgTcjnYh0p17bu:9jCQ3KOCahMjye5FAsB/RXnlp17bu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
limbo.exe

Files

limbo.exe
.exe windows x86

91431b8da2f6fe77da23d4b63ced4306

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
SetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetLocalTime
GetFileSize
MulDiv
FindClose
FindNextFileA
FindFirstFileA
GetFullPathNameA
OutputDebugStringA
WideCharToMultiByte
GetProcAddress
LoadLibraryA
HeapValidate
GetProcessHeaps
MultiByteToWideChar
CopyFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
GetLocaleInfoW
IsValidLocale
SetEvent
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetLastError
GetACP
CreateFileA
VirtualAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
HeapReAlloc
HeapDestroy
HeapCreate
SetHandleCount
InitializeCriticalSectionAndSpinCount
FreeLibrary
SetConsoleCtrlHandler
FatalAppExitA
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
GetModuleHandleA
CreateEventA
Sleep
CreateThread
SetThreadPriority
DeleteCriticalSection
GetSystemInfo
GetTickCount
GetCurrentThreadId
SleepEx
VirtualQuery
SetUnhandledExceptionFilter
GlobalFree
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
CreateToolhelp32Snapshot
GlobalAlloc
GetModuleFileNameA
Module32First
Module32Next
InitializeCriticalSection
WriteFile
ReadFile
CloseHandle
EnumSystemLocalesA
CreateFileW
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
LCMapStringA
GetCPInfo
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
GetDriveTypeA
HeapAlloc
MoveFileA
DeleteFileA
GetFileType
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
HeapFree
GetModuleHandleW
RaiseException
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetOEMCP
VirtualFree
RtlUnwind
InterlockedExchange
InterlockedCompareExchange
WaitForMultipleObjectsEx
SetThreadAffinityMask
InterlockedDecrement
InterlockedIncrement
ExitProcess
QueryPerformanceFrequency
SetFilePointer
ResetEvent
CreateEventW

user32

SetCapture
SystemParametersInfoA
DispatchMessageA
TranslateMessage
PeekMessageA
SetWindowPos
AdjustWindowRect
GetClassLongA
GetSystemMetrics
SendMessageA
SetFocus
ShowWindow
ShowCursor
GetSysColor
ValidateRect
GetMenuItemInfoA
SetCursor
LoadCursorA
GetCursor
CreatePopupMenu
DestroyWindow
MessageBoxA
GetWindowRect
ClientToScreen
GetParent
GetWindowLongA
PostMessageA
GetClientRect
GetDC
FillRect
CreateWindowExA
ReleaseDC
ReleaseCapture
GetCursorPos
InsertMenuItemA
GetForegroundWindow
MessageBoxW
SetWindowTextA
SetWindowLongA
LoadIconA
WaitMessage
PostQuitMessage
SetCursorPos
RegisterClassA
DefWindowProcA
ScreenToClient

gdi32

CreateCompatibleDC
GetTextMetricsA
DeleteDC
GetDeviceCaps
CreateFontA
SetTextColor
SetTextAlign
SetBkColor
GetStockObject
CreateBitmap
CreateSolidBrush
CreateDIBSection
SetMapMode
GetTextExtentPoint32A
ExtTextOutA
CreatePatternBrush
PatBlt
CreatePen
SelectObject
Rectangle
DeleteObject
GetCurrentObject
MoveToEx
LineTo
AddFontResourceA

comdlg32

GetOpenFileNameA
GetSaveFileNameA

shell32

SHGetPathFromIDListA
DragFinish
DragQueryPoint
DragQueryFileA
SHBrowseForFolderA
ShellExecuteA

misty_api

SteamAPI_RunCallbacks
SteamUtils
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamUser
SteamAPI_RegisterCallback
SteamRemoteStorage
SteamApps
SteamAPI_Init
SteamUserStats
SteamFriends
SteamAPI_UnregisterCallback
SteamAPI_Shutdown

dinput8

DirectInput8Create

d3d9

Direct3DCreate9

d3dx9_43

D3DXCompileShader
D3DXGetPixelShaderProfile
D3DXGetVertexShaderProfile
D3DXCreateTextureFromFileExA

comctl32

ord17
CreateToolbarEx

dbghelp

SymLoadModule
SymSetOptions
SymGetSymFromAddr
SymGetModuleBase
SymFunctionTableAccess
StackWalk
SymGetModuleInfo
SymGetLineFromAddr
SymCleanup
SymInitialize

xinput1_3

ord2
ord3

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

Exports

Exports

?AddPlayerMotionDevice@MotionEngine@AK@@YA?AW4AKRESULT@@EKKPAX@Z
?Break@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?BypassEnvironment@SoundEngine@AK@@YA?AW4AKRESULT@@K_N@Z
?CancelBankCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CancelEventCallback@SoundEngine@AK@@YAXK@Z
?CancelEventCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CheckPoolId@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ClearBanks@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ClearPreparedEvents@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?Close@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?Create@StreamMgr@AK@@YAPAVIAkStreamMgr@2@ABUAkStreamMgrSettings@@@Z
?CreateDevice@StreamMgr@AK@@YAKABUAkDeviceSettings@@PAVIAkLowLevelIOHook@12@@Z
?CreatePool@MemoryMgr@AK@@YAJPAXKKKK@Z
?CreateVorbisFilePlugin@@YAPAVIAkSoftwareCodec@@PAX@Z
?DestroyDevice@StreamMgr@AK@@YA?AW4AKRESULT@@K@Z
?DestroyPool@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?Falign@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?Free@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?GetBlock@MemoryMgr@AK@@YAPAXJ@Z
?GetDefaultDeviceSettings@StreamMgr@AK@@YAXAAUAkDeviceSettings@@@Z
?GetDefaultInitSettings@SoundEngine@AK@@YAXAAUAkInitSettings@@@Z
?GetDefaultPlatformInitSettings@SoundEngine@AK@@YAXAAUAkPlatformInitSettings@@@Z
?GetDefaultSettings@StreamMgr@AK@@YAXAAUAkStreamMgrSettings@@@Z
?GetFileLocationResolver@StreamMgr@AK@@YAPAVIAkFileLocationResolver@12@XZ
?GetIDFromString@SoundEngine@AK@@YAKPBD@Z
?GetIDFromString@SoundEngine@AK@@YAKPB_W@Z
?GetMaxPools@MemoryMgr@AK@@YAJXZ
?GetNumPools@MemoryMgr@AK@@YAJXZ
?GetPoolAttributes@MemoryMgr@AK@@YA?AW4AkMemPoolAttributes@@J@Z
?GetPoolMemoryUsed@MemoryMgr@AK@@YAXJAAUPoolMemInfo@12@@Z
?GetPoolName@MemoryMgr@AK@@YAPA_WJ@Z
?GetPoolStats@MemoryMgr@AK@@YA?AW4AKRESULT@@JAAUPoolStats@12@@Z
?GetSourcePlayPosition@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ@Z
?GetSpeakerConfiguration@SoundEngine@AK@@YAKXZ
?GetTimeStamp@Monitor@AK@@YAJXZ
?Init@SoundEngine@AK@@YA?AW4AKRESULT@@PAUAkInitSettings@@PAUAkPlatformInitSettings@@@Z
?IsInitialized@MemoryMgr@AK@@YA_NXZ
?IsInitialized@SoundEngine@AK@@YA_NXZ
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KJ@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1J@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2JAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKP6AXKW43@JPAX@Z2AAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2JAAK@Z
?LockPlaylist@DynamicSequence@SoundEngine@AK@@YAPAVPlaylist@123@K@Z
?Malign@MemoryMgr@AK@@YAPAXJIK@Z
?Malloc@MemoryMgr@AK@@YAPAXJI@Z
?Open@DynamicSequence@SoundEngine@AK@@YAKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXW4DynamicSequenceType@123@@Z
?Pause@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?Play@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?PostCode@Monitor@AK@@YA?AW4AKRESULT@@W4ErrorCode@12@W4ErrorLevel@12@@Z
?PostEvent@SoundEngine@AK@@YAKKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAX@Z
?PostEvent@SoundEngine@AK@@YAKPBDIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAX@Z
?PostEvent@SoundEngine@AK@@YAKPB_WIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAX@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PBDW4ErrorLevel@12@@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PB_WW4ErrorLevel@12@@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@KI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PBDI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WI@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KP6AXKW43@JPAX@Z2W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WW4AkBankContent@12@@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WKP6AXKW43@JPAX@Z3@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKKP6AXKW43@JPAX@Z4@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDKP6AXKW43@JPAX@Z5@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WKP6AXKW43@JPAX@Z5@Z
?RegisterCodec@SoundEngine@AK@@YA?AW4AKRESULT@@KKP6APAVIAkSoftwareCodec@@PAX@Z1@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@IPBD@Z
?RegisterMotionDevice@MotionEngine@AK@@YAXKKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@Z@Z
?RegisterPlugin@SoundEngine@AK@@YA?AW4AKRESULT@@W4AkPluginType@@KKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@ZP6APAVIAkPluginParam@2@1@Z@Z
?ReleaseBlock@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?RemovePlayerMotionDevice@MotionEngine@AK@@YAXEKK@Z
?RenderAudio@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KI@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDI@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WI@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKKPAKK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPBDPAPBDK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPB_WPAPB_WK@Z
?Resume@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KIJ@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIJ@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIJ@Z
?SetActiveListeners@SoundEngine@AK@@YA?AW4AKRESULT@@IK@Z
?SetAttenuationScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetBankLoadIOSettings@SoundEngine@AK@@YA?AW4AKRESULT@@MD@Z
?SetEnvironmentVolume@SoundEngine@AK@@YA?AW4AKRESULT@@KM@Z
?SetEnvironmentVolumes@SoundEngine@AK@@YA?AW4AKRESULT@@KABUAkSpeakerVolumes@@@Z
?SetFileLocationResolver@StreamMgr@AK@@YAXPAVIAkFileLocationResolver@12@@Z
?SetGameObjectDryLevelValue@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetGameObjectEnvironmentsValues@SoundEngine@AK@@YA?AW4AKRESULT@@IPAUAkEnvironmentValue@@K@Z
?SetListenerPipeline@SoundEngine@AK@@YA?AW4AKRESULT@@K_N0@Z
?SetListenerPosition@SoundEngine@AK@@YA?AW4AKRESULT@@ABUAkListenerPosition@@K@Z
?SetListenerScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@KM@Z
?SetListenerSpatialization@SoundEngine@AK@@YA?AW4AKRESULT@@K_NPAUAkSpeakerVolumes@@@Z
?SetLocalOutput@Monitor@AK@@YA?AW4AKRESULT@@KP6AXW4ErrorCode@12@PB_WW4ErrorLevel@12@KI@Z@Z
?SetMonitoring@MemoryMgr@AK@@YA?AW4AKRESULT@@J_N@Z
?SetMultiplePositions@SoundEngine@AK@@YA?AW4AKRESULT@@IPBUAkSoundPosition@@GW4MultiPositionType@12@@Z
?SetObjectObstructionAndOcclusion@SoundEngine@AK@@YA?AW4AKRESULT@@IKMM@Z
?SetPlayerListener@MotionEngine@AK@@YAXEE@Z
?SetPlayerVolume@MotionEngine@AK@@YAXEM@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPBD@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPB_W@Z
?SetPosition@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetPositionInternal@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KMI@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDMI@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WMI@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@KK@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@KKI@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0I@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0I@Z
?SetVolumeThreshold@SoundEngine@AK@@YA?AW4AKRESULT@@M@Z
?StartOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W@Z
?Stop@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?StopAll@SoundEngine@AK@@YAXI@Z
?StopOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?StopPlayingID@SoundEngine@AK@@YAXK@Z
?Term@MemoryMgr@AK@@YAXXZ
?Term@SoundEngine@AK@@YAXXZ
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WPAJ@Z
?UnlockPlaylist@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?UnregisterAllGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?UnregisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?m_pStreamMgr@IAkStreamMgr@AK@@1PAV12@A

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 560KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 386KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 573KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91431b8da2f6fe77da23d4b63ced4306

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

shell32

misty_api

dinput8

d3d9

d3dx9_43

comctl32

dbghelp

xinput1_3

ole32

Exports

Exports

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 560KB - Virtual size: 560KB

.data Size: 84KB - Virtual size: 386KB

.idata Size: 9KB - Virtual size: 8KB

.rsrc Size: 573KB - Virtual size: 572KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 560KB - Virtual size: 560KB

.data
Size: 84KB - Virtual size: 386KB

.idata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 573KB - Virtual size: 572KB