F1_2013[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

F1_2013.exe
Size

16.6MB
MD5

bd107917399109301408c013566d52bc
SHA1

8c334652af0fb072271a3779628d9a69f3fae678
SHA256

2afa50e4ea6e5501b52575efcf4db77588954c2625e1f6c3645818afcc766378
SHA512

8e05ac941889c8780dc5d1ce6dc3dde43b5fa14b70d2b6d0a1168711577761784202795b878e8978b66b4defca59e635073258104d86bba343b77fecbe972f1b
SSDEEP

393216:xFZfjagnMZOUFV7ETjAzbPmXHEsDgdTYDShtAoE/BoFOyVkINOC08BoA4jOjrvvU:xFZfjagnMZOUFV7ETjAzbPmXHEsDgdTW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
F1_2013.exe

Files

F1_2013.exe
.exe windows x86

294e87f331733a5b3da011b8a412a18d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

binkw32

_BinkOpenXAudio2@4
_BinkSetSoundSystem@8
_BinkSetSoundTrack@8
_BinkOpen@8
_BinkGetFrameBuffersInfo@8
_BinkRegisterFrameBuffers@8
_BinkDoFrame@4
_BinkNextFrame@4
_BinkShouldSkip@4
_BinkPause@8
_BinkWait@4
_BinkSetSpeakerVolumes@20
_BinkClose@4
_BinkGoto@12
_BinkSetMemory@8
_BinkSetVolume@12

dinput8

DirectInput8Create

dsound

ord9

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shlwapi

StrStrIA
PathRemoveFileSpecA

ws2_32

WSAStartup
WSACleanup
recv
select
closesocket
setsockopt
accept
connect
htons
listen
ioctlsocket
send
recvfrom
ntohs
sendto
inet_addr
gethostbyname
bind
__WSAFDIsSet
WSAGetLastError
socket

iphlpapi

CancelIPChangeNotify
NotifyAddrChange
GetAdaptersAddresses

xinput1_3

ord4
ord3
ord2

steam_api

SteamApps
SteamMatchmaking
SteamAPI_WriteMiniDump
SteamAPI_RunCallbacks
SteamAPI_RegisterCallResult
SteamAPI_SetMiniDumpComment
SteamAPI_Init
SteamRemoteStorage
SteamAPI_Shutdown
SteamUser
SteamUserStats
SteamAPI_UnregisterCallResult
SteamNetworking
SteamFriends
SteamUtils
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamAPI_RestartAppIfNecessary

winmm

timeBeginPeriod

imagehlp

ImageGetCertificateHeader
ImageEnumerateCertificates
ImageGetCertificateData

imm32

ImmDisableIME

setupapi

CM_Get_Device_ID_Size
CM_Get_Device_IDW
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInfo

hid

HidD_GetAttributes
HidD_GetHidGuid

kernel32

DecodePointer
EncodePointer
UnhandledExceptionFilter
TerminateProcess
GetModuleHandleW
GetDiskFreeSpaceA
TryEnterCriticalSection
GetComputerNameExA
LocalFree
SetThreadExecutionState
GetCommandLineA
RtlUnwind
SetEnvironmentVariableA
GetCPInfo
GetOEMCP
IsValidCodePage
GetStdHandle
GetLocaleInfoW
LCMapStringW
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
HeapCreate
FlushFileBuffers
MultiByteToWideChar
SetCurrentDirectoryA
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetUserDefaultLCID
GetACP
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CompareStringW
CreateEventW
SleepEx
HeapReAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetComputerNameA
OutputDebugStringA
DebugBreak
GetLastError
CreateDirectoryA
GetModuleHandleA
HeapSetInformation
CloseHandle
ReadFile
CreateFileA
FindClose
FindNextFileA
FindFirstFileA
WideCharToMultiByte
GetCommandLineW
SetThreadIdealProcessor
GetFileInformationByHandle
GetCurrentThread
CreateMutexA
SetProcessAffinityMask
GetCurrentProcess
GetUserDefaultLangID
GetLocalTime
SetUnhandledExceptionFilter
CreateDirectoryW
ExitProcess
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
GetProcAddress
OpenProcess
ResetEvent
WaitForSingleObject
GetOverlappedResult
SetEndOfFile
SetFilePointerEx
WriteFile
GetLocaleInfoA
DeleteFileA
CreateEventA
InterlockedExchange
GetVersionExA
CreateSemaphoreA
RaiseException
GetCurrentThreadId
ResumeThread
SuspendThread
ReleaseMutex
WaitForMultipleObjects
SetEvent
ReleaseSemaphore
SetThreadPriority
GetThreadPriority
CreateThread
FormatMessageA
SetThreadAffinityMask
GetProcessAffinityMask
VirtualFree
VirtualAlloc
CancelIo
ReadFileEx
WaitForSingleObjectEx
WaitForMultipleObjectsEx
GetFileAttributesA
GetFileAttributesExA
RemoveDirectoryA
GetFileSizeEx
GetModuleFileNameA
GetFullPathNameA
GetCurrentDirectoryA
SetFileAttributesA
SetFilePointer
GetDiskFreeSpaceExA
lstrlenA
GetLogicalProcessorInformation
DeleteFileW
GetTempFileNameW
GetTempPathW
GetSystemDirectoryA
lstrlenW
FindFirstFileW
CreateFileW
FindNextFileW
RemoveDirectoryW
MoveFileExW
GetFileAttributesW
CopyFileW
lstrcmpiA
GetWindowsDirectoryA
IsProcessorFeaturePresent
InterlockedCompareExchange
lstrcmpiW
GetFullPathNameW
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
VirtualQuery
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
GetTickCount
GetTimeZoneInformation
GetSystemTime
FileTimeToSystemTime
OpenFileById
InterlockedIncrement
InterlockedDecrement
GetWindowsDirectoryW
GetSystemDirectoryW
GetModuleFileNameW
HeapAlloc
HeapFree
GetProcessHeap
LockResource
LoadResource
SizeofResource
FindResourceW
GetConsoleWindow
GetCurrentDirectoryW
GetEnvironmentStringsW
GetStartupInfoW
SetLastError
GetCurrentProcessId
GetModuleHandleExA
HeapSize
OpenEventA
OutputDebugStringW
DuplicateHandle
DeviceIoControl
GetFileInformationByHandleEx
GetSystemInfo
GetSystemTimeAsFileTime

user32

PeekMessageA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
SystemParametersInfoA
EnumDisplayDevicesA
PostMessageA
RegisterDeviceNotificationA
UnregisterDeviceNotification
LoadIconA
TranslateMessage
UnregisterClassA
MessageBoxA
DestroyWindow
LoadCursorA
RegisterClassExA
LoadBitmapA
ShowCursor
CreateWindowExA
GetDC
ShowWindow
UpdateWindow
SetFocus
DispatchMessageA
EnumDisplaySettingsA
SendInput
GetRawInputDeviceList
UnregisterClassW
DispatchMessageW
PeekMessageW
RegisterDeviceNotificationW
GetWindowLongW
MessageBoxW
ReleaseDC
SetWindowLongW
CallWindowProcW
GetForegroundWindow
wsprintfA
RegisterClassExW
SetWindowPos
BeginPaint
EndPaint
PostQuitMessage
GetSystemMetrics
DefWindowProcA
IsWindowVisible
SetRect
AdjustWindowRect
CreateWindowExW
SetWindowLongA
SetForegroundWindow
GetWindowLongA
ClipCursor
ReleaseCapture
GetWindowRect
DefWindowProcW
GetWindowTextA
GetClientRect

gdi32

GetDIBits
CreateBrushIndirect
CreateCompatibleDC
SelectObject
GetObjectA
GetStockObject
CreateDCA
ExtEscape
DeleteDC
BitBlt
DeleteObject

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegOpenKeyExW
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExW
RegEnumKeyA

shell32

CommandLineToArgvW
SHGetFolderPathA

ole32

CoInitializeEx
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

d3dcompiler_43

D3DReflect
D3DCompile

d3d9

Direct3DCreate9

d3dx9_43

D3DXCompileShader
D3DXGetShaderConstantTableEx
D3DXSaveSurfaceToFileA
D3DXGetShaderInputSemantics

winhttp

WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpWriteData
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpOpen
WinHttpCloseHandle
WinHttpQueryOption
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetOption

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
PFXImportCertStore
CertAddEncodedCertificateToStore
CertCloseStore
CertOpenStore
CertGetNameStringA
CryptVerifyMessageSignature
CertGetIssuerCertificateFromStore

wintrust

WinVerifyTrust

Exports

Exports

??1CAkRegisteredObj@@QAE@XZ
?AddBehavioralExtension@SoundEngine@AK@@YA?AW4AKRESULT@@P6AX_N@Z@Z
?AddLanguageChangeObserver@StreamMgr@AK@@YA?AW4AKRESULT@@P6AXQB_WPAX@Z1@Z
?AddPlayerMotionDevice@MotionEngine@AK@@YA?AW4AKRESULT@@EKKPAX@Z
?Break@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?CancelBankCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CancelEventCallback@SoundEngine@AK@@YAXK@Z
?CancelEventCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CheckPoolId@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ClearBanks@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ClearPreparedEvents@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?Close@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?Create@StreamMgr@AK@@YAPAVIAkStreamMgr@2@ABUAkStreamMgrSettings@@@Z
?CreateDevice@StreamMgr@AK@@YAKABUAkDeviceSettings@@PAVIAkLowLevelIOHook@12@@Z
?CreatePool@MemoryMgr@AK@@YAJPAXKKKK@Z
?DestroyDevice@StreamMgr@AK@@YA?AW4AKRESULT@@K@Z
?DestroyPool@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@K@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@K@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@K@Z
?Falign@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?Free@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?GetActiveGameObjects@Query@SoundEngine@AK@@YA?AW4AKRESULT@@AAV?$AkArray@IIUArrayPoolDefault@@$0CA@@@@Z
?GetActiveListeners@Query@SoundEngine@AK@@YA?AW4AKRESULT@@IAAK@Z
?GetAuxBusVolumes@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KAAUAkSpeakerVolumes@@@Z
?GetBlock@MemoryMgr@AK@@YAPAXJ@Z
?GetBlockSize@MemoryMgr@AK@@YAKJ@Z
?GetCurrentLanguage@StreamMgr@AK@@YAPB_WXZ
?GetCustomPropertyValue@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KKAAJ@Z
?GetCustomPropertyValue@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KKAAM@Z
?GetDefaultDeviceSettings@StreamMgr@AK@@YAXAAUAkDeviceSettings@@@Z
?GetDefaultInitSettings@SoundEngine@AK@@YAXAAUAkInitSettings@@@Z
?GetDefaultPlatformInitSettings@SoundEngine@AK@@YAXAAUAkPlatformInitSettings@@@Z
?GetDefaultSettings@StreamMgr@AK@@YAXAAUAkStreamMgrSettings@@@Z
?GetEventIDFromPlayingID@Query@SoundEngine@AK@@YAKK@Z
?GetFileLocationResolver@StreamMgr@AK@@YAPAVIAkFileLocationResolver@12@XZ
?GetGameObjectAuxSendValues@Query@SoundEngine@AK@@YA?AW4AKRESULT@@IPAUAkAuxSendValue@@AAK@Z
?GetGameObjectDryLevelValue@Query@SoundEngine@AK@@YA?AW4AKRESULT@@IAAM@Z
?GetGameObjectFromPlayingID@Query@SoundEngine@AK@@YAIK@Z
?GetIDFromString@SoundEngine@AK@@YAKPBD@Z
?GetIDFromString@SoundEngine@AK@@YAKPB_W@Z
?GetIsGameObjectActive@Query@SoundEngine@AK@@YA_NI@Z
?GetListenerPosition@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KAAUAkListenerPosition@@@Z
?GetListenerSpatialization@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KAA_NAAUAkSpeakerVolumes@@@Z
?GetMaxPools@MemoryMgr@AK@@YAJXZ
?GetMaxRadius@Query@SoundEngine@AK@@YA?AW4AKRESULT@@AAV?$AkArray@UGameObjDst@Query@SoundEngine@AK@@ABU1234@UArrayPoolDefault@@$0CA@@@@Z
?GetMaxRadius@Query@SoundEngine@AK@@YAMI@Z
?GetNumPools@MemoryMgr@AK@@YAJXZ
?GetObjAndAddref@CAkRegistryMgr@@QAEPAVCAkRegisteredObj@@I@Z
?GetObjectObstructionAndOcclusion@Query@SoundEngine@AK@@YA?AW4AKRESULT@@IKAAM0@Z
?GetPanningRule@SoundEngine@AK@@YA?AW4AkPanningRule@@XZ
?GetPlayingIDsFromGameObject@Query@SoundEngine@AK@@YA?AW4AKRESULT@@IAAKPAK@Z
?GetPoolAttributes@MemoryMgr@AK@@YA?AW4AkMemPoolAttributes@@J@Z
?GetPoolID@StreamMgr@AK@@YAJXZ
?GetPoolMemoryUsed@MemoryMgr@AK@@YAXJAAUPoolMemInfo@12@@Z
?GetPoolName@MemoryMgr@AK@@YAPA_WJ@Z
?GetPoolStats@MemoryMgr@AK@@YA?AW4AKRESULT@@JAAUPoolStats@12@@Z
?GetPosition@Query@SoundEngine@AK@@YA?AW4AKRESULT@@IAAUAkSoundPosition@@@Z
?GetPositioningInfo@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KAAUAkPositioningInfo@@@Z
?GetRTPCValue@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KIAAMAAW4RTPCValue_type@123@@Z
?GetRTPCValue@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIAAMAAW4RTPCValue_type@123@@Z
?GetRTPCValue@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIAAMAAW4RTPCValue_type@123@@Z
?GetSourcePlayPosition@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ_N@Z
?GetSpeakerConfiguration@SoundEngine@AK@@YAKXZ
?GetState@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KAAK@Z
?GetState@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PBDAAK@Z
?GetState@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WAAK@Z
?GetSwitch@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KIAAK@Z
?GetSwitch@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIAAK@Z
?GetSwitch@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIAAK@Z
?GetTimeStamp@Monitor@AK@@YAJXZ
?Init@SoundEngine@AK@@YA?AW4AKRESULT@@PAUAkInitSettings@@PAUAkPlatformInitSettings@@@Z
?IsInitialized@MemoryMgr@AK@@YA_NXZ
?IsInitialized@SoundEngine@AK@@YA_NXZ
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KJ@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1J@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2JAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKP6AXKW43@JPAX@Z2AAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2JAAK@Z
?LockPlaylist@DynamicSequence@SoundEngine@AK@@YAPAVPlaylist@123@K@Z
?Malign@MemoryMgr@AK@@YAPAXJIK@Z
?Malloc@MemoryMgr@AK@@YAPAXJI@Z
?Open@DynamicSequence@SoundEngine@AK@@YAKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXW4DynamicSequenceType@123@@Z
?Pause@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@KJW4AkCurveInterpolation@@@Z
?Play@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@KJW4AkCurveInterpolation@@@Z
?PlaySourcePlugin@SoundEngine@AK@@YAKKKI@Z
?PostCode@Monitor@AK@@YA?AW4AKRESULT@@W4ErrorCode@12@W4ErrorLevel@12@@Z
?PostEvent@SoundEngine@AK@@YAKKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@K@Z
?PostEvent@SoundEngine@AK@@YAKPBDIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@K@Z
?PostEvent@SoundEngine@AK@@YAKPB_WIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@K@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PBDW4ErrorLevel@12@@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PB_WW4ErrorLevel@12@@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@KI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PBDI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WI@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KP6AXKW43@JPAX@Z2W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WW4AkBankContent@12@@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WKP6AXKW43@JPAX@Z3@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKKP6AXKW43@JPAX@Z4@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDKP6AXKW43@JPAX@Z5@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WKP6AXKW43@JPAX@Z5@Z
?QueryAudioObjectIDs@Query@SoundEngine@AK@@YA?AW4AKRESULT@@KAAKPAUAkObjectInfo@@@Z
?QueryAudioObjectIDs@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PBDAAKPAUAkObjectInfo@@@Z
?QueryAudioObjectIDs@Query@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WAAKPAUAkObjectInfo@@@Z
?RegisterCodec@SoundEngine@AK@@YA?AW4AKRESULT@@KKP6APAVIAkSoftwareCodec@@PAX@Z1@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@IPBD@Z
?RegisterGlobalCallback@SoundEngine@AK@@YA?AW4AKRESULT@@P6AX_N@Z@Z
?RegisterMotionDevice@MotionEngine@AK@@YAXKKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@Z@Z
?RegisterPlugin@SoundEngine@AK@@YA?AW4AKRESULT@@W4AkPluginType@@KKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@ZP6APAVIAkPluginParam@2@1@Z@Z
?ReleaseBlock@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?RemoveBehavioralExtension@SoundEngine@AK@@YA?AW4AKRESULT@@P6AX_N@Z@Z
?RemoveLanguageChangeObserver@StreamMgr@AK@@YAXPAX@Z
?RemovePlayerMotionDevice@MotionEngine@AK@@YAXEKK@Z
?RenderAudio@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KIJW4AkCurveInterpolation@@@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIJW4AkCurveInterpolation@@@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIJW4AkCurveInterpolation@@@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKKPAKKK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPBDPAPBDKK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPB_WPAPB_WKK@Z
?Resume@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@KJW4AkCurveInterpolation@@@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KIM_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIM_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIM_N@Z
?SetActiveListeners@SoundEngine@AK@@YA?AW4AKRESULT@@IK@Z
?SetActorMixerEffect@SoundEngine@AK@@YA?AW4AKRESULT@@KKK@Z
?SetAttenuationScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetAuxBusVolumes@SoundEngine@AK@@YA?AW4AKRESULT@@KABUAkSpeakerVolumes@@@Z
?SetBankLoadIOSettings@SoundEngine@AK@@YA?AW4AKRESULT@@MD@Z
?SetBusEffect@SoundEngine@AK@@YA?AW4AKRESULT@@KKK@Z
?SetBusEffect@SoundEngine@AK@@YA?AW4AKRESULT@@PBDKK@Z
?SetBusEffect@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WKK@Z
?SetCurrentLanguage@StreamMgr@AK@@YA?AW4AKRESULT@@PB_W@Z
?SetFileLocationResolver@StreamMgr@AK@@YAXPAVIAkFileLocationResolver@12@@Z
?SetGameObjectAuxSendValues@SoundEngine@AK@@YA?AW4AKRESULT@@IPAUAkAuxSendValue@@K@Z
?SetGameObjectOutputBusVolume@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetListenerPipeline@SoundEngine@AK@@YA?AW4AKRESULT@@K_N0@Z
?SetListenerPosition@SoundEngine@AK@@YA?AW4AKRESULT@@ABUAkListenerPosition@@K@Z
?SetListenerScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@KM@Z
?SetListenerSpatialization@SoundEngine@AK@@YA?AW4AKRESULT@@K_NPAUAkSpeakerVolumes@@@Z
?SetLocalOutput@Monitor@AK@@YA?AW4AKRESULT@@KP6AXW4ErrorCode@12@PB_WW4ErrorLevel@12@KI@Z@Z
?SetMaxNumVoicesLimit@SoundEngine@AK@@YA?AW4AKRESULT@@G@Z
?SetMonitoring@MemoryMgr@AK@@YA?AW4AKRESULT@@J_N@Z
?SetMultiplePositions@SoundEngine@AK@@YA?AW4AKRESULT@@IPBUAkSoundPosition@@GW4MultiPositionType@12@@Z
?SetObjectObstructionAndOcclusion@SoundEngine@AK@@YA?AW4AKRESULT@@IKMM@Z
?SetPanningRule@SoundEngine@AK@@YA?AW4AKRESULT@@W4AkPanningRule@@@Z
?SetPlayerListener@MotionEngine@AK@@YAXEE@Z
?SetPlayerVolume@MotionEngine@AK@@YAXEM@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPBD@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPB_W@Z
?SetPosition@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetPositionInternal@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetRTPCInternal@CAkRTPCMgr@@QAE?AW4AKRESULT@@KMPAVCAkRegisteredObj@@AAUTransParams@@W4AkValueMeaning@@@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KMIJW4AkCurveInterpolation@@@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDMIJW4AkCurveInterpolation@@@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WMIJW4AkCurveInterpolation@@@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@KK@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@KKI@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0I@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0I@Z
?SetVolumeThreshold@SoundEngine@AK@@YA?AW4AKRESULT@@M@Z
?StartOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W@Z
?StartProfilerCapture@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W@Z
?Stop@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@KJW4AkCurveInterpolation@@@Z
?StopAll@SoundEngine@AK@@YAXI@Z
?StopOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?StopPlayingID@SoundEngine@AK@@YAXKJW4AkCurveInterpolation@@@Z
?StopProfilerCapture@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?StopSourcePlugin@SoundEngine@AK@@YA?AW4AKRESULT@@KKK@Z
?Term@MemoryMgr@AK@@YAXXZ
?Term@SoundEngine@AK@@YAXXZ
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WPAJ@Z
?UnlockPlaylist@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?UnregisterAllGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?UnregisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?UnregisterGlobalCallback@SoundEngine@AK@@YA?AW4AKRESULT@@P6AX_N@Z@Z
?g_DefaultPoolId@@3JA
?g_LEngineDefaultPoolId@@3JA
?g_pAssertHook@@3P6AXPBD0H@ZA
?g_pRTPCMgr@@3PAVCAkRTPCMgr@@A
?g_pRegistryMgr@@3PAVCAkRegistryMgr@@A
?m_pStreamMgr@IAkStreamMgr@AK@@1PAV12@A

Sections

.text
Size: 11.7MB - Virtual size: 11.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 338KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 758KB - Virtual size: 757KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 983KB - Virtual size: 982KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

294e87f331733a5b3da011b8a412a18d

Headers

DLL Characteristics

File Characteristics

Imports

binkw32

dinput8

dsound

version

shlwapi

ws2_32

iphlpapi

xinput1_3

steam_api

winmm

imagehlp

imm32

setupapi

hid

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

d3dcompiler_43

d3d9

d3dx9_43

winhttp

crypt32

wintrust

Exports

Exports

Sections

.text Size: 11.7MB - Virtual size: 11.7MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 338KB - Virtual size: 1.7MB

.tls Size: 512B - Virtual size: 13B

.version Size: 512B - Virtual size: 4B

.rsrc Size: 758KB - Virtual size: 757KB

.reloc Size: 983KB - Virtual size: 982KB

.text
Size: 11.7MB - Virtual size: 11.7MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 338KB - Virtual size: 1.7MB

.tls
Size: 512B - Virtual size: 13B

.version
Size: 512B - Virtual size: 4B

.rsrc
Size: 758KB - Virtual size: 757KB

.reloc
Size: 983KB - Virtual size: 982KB