hoi4_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hoi4_JC.exe
Size

39.5MB
MD5

5e7a844e658b8a6dd81a3c2a591aa56f
SHA1

21dc96789a332fd8b2bf7372b2c17a6a330ac7b8
SHA256

3233f4d197971cbe09fe386402c9c91a3161e837967557c5519e8c0382bd12f3
SHA512

9c2788e0b94c81406f8a3cd08c39bbf16de2b9a48e2ee40361d7176da81879a5a180faf91a1f4e8d37e2c9158f0c8ad1444946fe97c542e95e2fd46fd67b9d23
SSDEEP

393216:Et4+swlhkkeEoZrpzh/8HWCFyt5ilI5tltqXa78kvDwo:u4+swlhkkeEkh/85FynVwkrwo

Score

1^/10

Malware Config

Signatures

Files

hoi4_JC.exe
.exe windows:6 windows x64

72b47a36b622b088823dc27eff824ba2

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/11/2022, 00:00

Not After

15/12/2023, 23:59

Subject

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cd:ad:21:e6:d4:23:6d:a7:95:18:71:0a:a1:34:07:32:a0:71:77:57
Signer

Actual PE Digest

cd:ad:21:e6:d4:23:6d:a7:95:18:71:0a:a1:34:07:32:a0:71:77:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

steam_api64

SteamAPI_UnregisterCallResult
SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_IsSteamRunning
SteamInternal_FindOrCreateUserInterface
SteamAPI_RegisterCallResult
SteamAPI_Shutdown
SteamAPI_Init
SteamInternal_GameServer_Init
SteamGameServer_Shutdown
SteamGameServer_RunCallbacks
SteamInternal_FindOrCreateGameServerInterface
SteamGameServer_GetHSteamUser
SteamInternal_CreateInterface
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamAPI_RunCallbacks

pops_api

POPS_SocialGetOpenFriendRequests
POPS_SocialGetFriendsList
POPS_SocialJoinRoom
POPS_SocialListenMessages
POPS_SocialListenFriendListUpdates
POPS_SocialListenPresence
POPS_SocialListenRichPresence
POPS_SocialListenMultiplayerAction
POPS_FileStorageSave
POPS_FileStorageList
POPS_FileStorageRead
POPS_FileStorageDelete
POPS_SocialProfileCreate
POPS_SocialProfileRetrieve
POPS_SocialProfileQuery
POPS_AccountConnectAccountSteam
POPS_AccountConnections
POPS_AccountIsOnline
POPS_AccountLogInSteamTicket
POPS_AccountLogInWithAuthToken
POPS_AccountLogIn
POPS_AccountGetDetails
POPS_SetRootPath
POPS_SetFileIO
POPS_SocialRemoveFriend
POPS_GenerateGUID
POPS_SocialSendMultiplayerActionToAccountID
POPS_SocialSendMessageToAccountID
POPS_SocialSendPrivateMessageToRoom
POPS_SocialSendMessageToRoom
POPS_SocialSetRichPresence
POPS_AchievementsSend
POPS_AchievementsStoreToDisk
POPS_AchievementsGet
POPS_AchievementsList
POPS_AccountGetGuid
POPS_TokenRetrieveCurrent
POPS_Initialize
POPS_Shutdown
POPS_RunCallbacks
POPS_AutoStandardTelemetryEnable
POPS_TelemetrySendMulti
POPS_SocialSetPresence
POPS_AccountCreate
POPS_AccountGetCountries
POPS_SocialRespondToFriendRequest
POPS_SocialAddFriend
POPS_SocialListenStatus
POPS_SocialSetXMPPLogLevel
POPS_SocialDisconnect
POPS_SocialConnect
POPS_AppGetChildren
POPS_NewsletterSubscribe

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
CM_Get_Device_IDA
CM_Get_Parent
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInfo

imm32

ImmGetIMEFileNameA
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetCandidateListW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveInGetNumDevs
waveOutGetDevCapsW
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
timeGetTime
waveOutGetNumDevs
waveInGetDevCapsW
waveInPrepareHeader
waveInClose
waveOutGetErrorTextW
timeBeginPeriod
timeEndPeriod
waveInOpen

tbb

?allocate@allocate_additional_child_of_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?free@allocate_additional_child_of_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?destroy@task_base@internal@interface5@tbb@@SAXAEAVtask@4@@Z
?allocate@allocate_root_with_context_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?free@allocate_root_with_context_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?allocate@allocate_continuation_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate@allocate_child_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?is_group_execution_cancelled@task_group_context@tbb@@QEBA_NXZ
?init@task_group_context@tbb@@IEAAXXZ
?note_affinity@task@tbb@@UEAAXG@Z
?deallocate_via_handler_v3@internal@tbb@@YAXPEAX@Z
?allocate_via_handler_v3@internal@tbb@@YAPEAX_K@Z
?internal_max_concurrency@task_arena_base@internal@interface7@tbb@@KAHPEBVtask_arena@34@@Z
?isolate_within_arena@internal@interface7@tbb@@YAXAEAVdelegate_base@123@_J@Z
?get_initial_auto_partitioner_divisor@internal@tbb@@YA_KXZ
?NFS_Allocate@internal@tbb@@YAPEAX_K0PEAX@Z
?NFS_Free@internal@tbb@@YAXPEAX@Z
?observe@task_scheduler_observer_v3@internal@tbb@@QEAAX_N@Z
??1concurrent_vector_base_v3@internal@tbb@@IEAA@XZ
?internal_grow_by@concurrent_vector_base_v3@internal@tbb@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z
?internal_clear@concurrent_vector_base_v3@internal@tbb@@IEAA_KP6AXPEAX_K@Z@Z
?thread_get_id_v3@internal@tbb@@YA?AVid@tbb_thread_v3@12@XZ
?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z
??1task_group_context@tbb@@QEAA@XZ

ws2_32

ntohl
WSAStartup
getaddrinfo
freeaddrinfo
getnameinfo
gethostname
htonl

opengl32

glCullFace
glCopyTexSubImage2D
glColorMask
glColor4f
glDeleteTextures
glClear
glBlendFunc
glBindTexture
glBegin
glAlphaFunc
glDepthFunc
glClearColor
wglGetProcAddress
wglGetCurrentDC
glViewport
glVertex2f
glTexSubImage2D
glTexParameteri
glTexParameterf
glTexImage2D
glTexEnvf
glStencilOp
glStencilMask
glStencilFunc
glScissor
glReadPixels
glPolygonMode
glPixelStorei
glOrtho
glMatrixMode
glLoadIdentity
glLineWidth
glGetTexImage
glGetString
glDepthMask
glGetFloatv
glGetError
glGetBooleanv
glGenTextures
glFrontFace
glEnd
glEnable
glDrawElements
glDrawArrays
glDisable
glGetIntegerv

d3dx9_43

D3DXCreateCubeTexture
D3DXLoadSurfaceFromSurface
D3DXCompileShader
D3DXCreateLine
D3DXSaveSurfaceToFileInMemory
D3DXLoadSurfaceFromMemory
D3DXCreateTexture
D3DXSaveTextureToFileInMemory

d3d9

Direct3DCreate9Ex
Direct3DCreate9

xinput1_3

ord4
ord2

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

shlwapi

PathFileExistsW
PathAppendW

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetTempPathW
DuplicateHandle
GetFileType
LoadLibraryExW
TlsFree
RtlUnwind
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
GetCPInfo
CompareStringEx
GetLocaleInfoEx
GetLocaleInfoW
LCMapStringEx
EncodePointer
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetExitCodeThread
GetStringTypeW
GetStartupInfoW
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
IsValidLocale
FreeLibraryAndExitThread
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
LCMapStringW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
MoveFileExW
SetStdHandle
HeapSize
IsValidCodePage
GetACP
CreateEventA
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetVolumeInformationA
RemoveDirectoryW
GetFileSize
GetFileAttributesExW
GetDriveTypeA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
VirtualProtect
CreatePipe
QueryFullProcessImageNameW
GetSystemDefaultUILanguage
GetComputerNameA
GetNativeSystemInfo
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
InitializeCriticalSectionEx
DecodePointer
LocalAlloc
SetUnhandledExceptionFilter
CreateProcessW
ReadProcessMemory
GetVersionExA
GetThreadContext
GetThreadId
ResumeThread
SuspendThread
SetLastError
GetFileAttributesA
GetCurrentDirectoryA
RtlCaptureContext
SwitchToThread
SetFileAttributesA
CreateDirectoryA
GetCurrentProcessId
ExitThread
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
K32GetProcessMemoryInfo
ReadDirectoryChangesW
CloseHandle
GetLastError
CreateProcessA
LocalFree
FormatMessageA
Sleep
OutputDebugStringA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalExit
WinExec
GetExitCodeProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetStdHandle
WriteFile
OutputDebugStringW
AttachConsole
GetConsoleMode
WriteConsoleW
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetFilePointerEx
SetErrorMode
GetTickCount
GetModuleFileNameW
GetModuleHandleW
SetThreadExecutionState
GetCurrentProcess
ExitProcess
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
LoadLibraryW
CreateToolhelp32Snapshot
Process32First
Process32Next
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetCurrentThreadId
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
VirtualAlloc
VirtualFree
VirtualQuery
GetEnvironmentVariableA
SetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
VerSetConditionMask
CreateFileA
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
WaitForSingleObject
CreateEventW
FormatMessageW
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
GlobalAlloc
GlobalUnlock
GlobalLock
CompareStringA
MulDiv
GetModuleHandleExW
WideCharToMultiByte
GetSystemPowerStatus
GetLocaleInfoA
GetModuleFileNameA
GlobalFree
MultiByteToWideChar
GetModuleHandleA
GetProcessAffinityMask
SetThreadAffinityMask
SleepEx

user32

GetWindowRect
AdjustWindowRectEx
SetCursor
GetCursorPos
GetClipCursor
ClientToScreen
ScreenToClient
ClipCursor
IsRectEmpty
GetWindowLongW
CallNextHookEx
LoadIconW
DestroyIcon
GetRawInputData
RegisterWindowMessageA
GetDoubleClickTime
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
OpenClipboard
GetClientRect
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
GetDC
ReleaseDC
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
SetCapture
ReleaseCapture
SetCursorPos
LoadCursorW
CopyImage
CreateIconIndirect
RegisterRawInputDevices
SendMessageW
RegisterClassW
CreateWindowExW
ShowWindow
SetLayeredWindowAttributes
FlashWindowEx
SetWindowPos
GetFocus
SetForegroundWindow
SetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
IntersectRect
PtInRect
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
SetWindowsHookExW
UnhookWindowsHookEx
CreateIconFromResource
SetWindowRgn
GetDesktopWindow
GetRawInputDeviceInfoA
GetRawInputDeviceList
PostThreadMessageW
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetFocus
DrawTextW
SystemParametersInfoA
SystemParametersInfoW
IsChild
LoadCursorA
UpdateWindow
FindWindowExA
LoadCursorFromFileA
DefWindowProcA
MessageBoxIndirectA
GetPropW
ValidateRect
InvalidateRect
GetUpdateRect
GetForegroundWindow
GetMenu
GetSystemMetrics
KillTimer
SetTimer
GetAsyncKeyState
GetKeyState
IsIconic
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageExtraInfo
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
MessageBoxA
GetActiveWindow
CloseClipboard

gdi32

CreateDCW
DeleteDC
GetICMProfileW
CreateCompatibleDC
DeleteObject
SetPixel
SetPixelFormat
ChoosePixelFormat
CreateRectRgn
CombineRgn
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateBitmap
GetDIBits
GetDeviceCaps
CreateCompatibleBitmap
GetTextMetricsW
DescribePixelFormat
GetObjectA
GetTextExtentPoint32A
CreateFontIndirectW
BitBlt
SelectObject
GetPixelFormat
CreateDIBSection
SwapBuffers

shell32

CommandLineToArgvW
SHCreateDirectoryExW
ShellExecuteW
DragAcceptFiles
SHGetFolderPathW
ExtractIconExW
DragFinish
DragQueryFileW
ShellExecuteExA
ShellExecuteA

ole32

PropVariantClear
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString

advapi32

GetUserNameA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom

nakama-cpp

NRtClient_disconnect
NRtClient_joinChat
NRtClient_leaveChat
NRtClient_writeChatMessage
NRtClient_updateChatMessage
NRtClient_removeChatMessage
NRtClient_createMatch
NRtClient_joinMatch
NRtClient_joinMatchByToken
NRtClient_leaveMatch
NRtClient_addMatchmaker
NRtClient_removeMatchmaker
NRtClient_sendMatchData
NRtClient_followUsers
NRtClient_unfollowUsers
NRtClient_rpc
NRtClient_setConnectCallback
NRtClient_setDisconnectCallback
NRtClient_setErrorCallback
NRtClient_setChannelMessageCallback
NRtClient_setChannelPresenceCallback
NRtClient_setMatchmakerMatchedCallback
NRtClient_setMatchDataCallback
NRtClient_setMatchPresenceCallback
NRtClient_setNotificationsCallback
NRtClient_setStatusPresenceCallback
NRtClient_setStreamPresenceCallback
NRtClient_setStreamDataCallback
NRtClient_destroy
NStringMap_getKeys
NClient_setUserData
NClient_getUserData
NClient_disconnect
NClient_tick
NClient_createRtClientEx
NClient_authenticateDevice
NClient_authenticateEmail
NClient_authenticateFacebook
NClient_authenticateGoogle
NClient_authenticateGameCenter
NClient_authenticateApple
NClient_authenticateCustom
NClient_authenticateSteam
NClient_linkFacebook
NClient_linkEmail
NClient_linkDevice
NClient_linkGoogle
NClient_linkGameCenter
NClient_linkApple
NClient_linkSteam
NClient_linkCustom
NClient_unlinkFacebook
NClient_unlinkEmail
NClient_unlinkGoogle
NClient_unlinkGameCenter
NRtClient_isConnected
NClient_unlinkSteam
NClient_unlinkDevice
NClient_unlinkCustom
NClient_importFacebookFriends
NClient_getAccount
NClient_updateAccount
NClient_getUsers
NClient_addFriends
NClient_deleteFriends
NClient_blockFriends
NClient_listFriends
NClient_createGroup
NClient_deleteGroup
NClient_addGroupUsers
NClient_listGroupUsers
NClient_kickGroupUsers
NClient_joinGroup
NClient_leaveGroup
NClient_listGroups
NClient_listUserGroups
NClient_promoteGroupUsers
NClient_demoteGroupUsers
NClient_updateGroup
NClient_listLeaderboardRecords
NClient_listLeaderboardRecordsAroundOwner
NClient_writeLeaderboardRecord
NClient_writeTournamentRecord
NClient_deleteLeaderboardRecord
NClient_listMatches
NClient_listNotifications
NClient_deleteNotifications
NClient_listChannelMessages
NClient_listTournaments
NClient_listTournamentRecords
NClient_listTournamentRecordsAroundOwner
NClient_joinTournament
NClient_listStorageObjects
NClient_listUsersStorageObjects
NClient_writeStorageObjects
NClient_readStorageObjects
NClient_deleteStorageObjects
NClient_rpc
NClient_rpc_with_http_key
createDefaultNakamaClient
destroyNakamaClient
NStringMap_getValue
NStringMap_setValue
NStringMap_create
NRtClient_connect
NRtClient_getUserData
NRtClient_setUserData
NRtClient_tick
NStringDoubleMap_destroy
NStringDoubleMap_getSize
NStringDoubleMap_getKeys
NStringDoubleMap_getValue
NStringDoubleMap_setValue
NStringDoubleMap_create
NSession_destroy
NSession_getVariables
NSession_isExpiredByTime
NSession_isExpired
NSession_getExpireTime
NSession_getCreateTime
NSession_getUserId
NSession_getUsername
NSession_isCreated
NSession_getAuthToken
NStringMap_destroy
NClient_unlinkApple
NStringMap_getSize
NClient_setErrorCallback

pdxbrowser_ipc

GetPDXModule

Exports

Exports

?PHYSFS_addToSearchPath@@YAHPEBDH@Z
?PHYSFS_caseFold@@YAHIPEAI@Z
?PHYSFS_close@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_deinit@@YAHXZ
?PHYSFS_delete@@YAHPEBD@Z
?PHYSFS_deregisterArchiver@@YAHPEBD@Z
?PHYSFS_enumerate@@YAHPEBDP6A?AW4PHYSFS_EnumerateCallbackResult@@PEAX00W4PHYSFS_FileType@@@Z1@Z
?PHYSFS_enumerateFiles@@YAPEAPEADPEBD@Z
?PHYSFS_enumerateFilesCallback@@YAXPEBDP6AXPEAX00@Z1@Z
?PHYSFS_eof@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_exists@@YAHPEBD@Z
?PHYSFS_fileLength@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_flush@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_freeList@@YAXPEAX@Z
?PHYSFS_freezeConfig@@YAX_N@Z
?PHYSFS_getAllocator@@YAPEBUPHYSFS_Allocator@@XZ
?PHYSFS_getBaseDir@@YAPEBDXZ
?PHYSFS_getCdRomDirs@@YAPEAPEADXZ
?PHYSFS_getCdRomDirsCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getDirSeparator@@YAPEBDXZ
?PHYSFS_getErrorByCode@@YAPEBDW4PHYSFS_ErrorCode@@@Z
?PHYSFS_getLastError@@YAPEBDXZ
?PHYSFS_getLastErrorCode@@YA?AW4PHYSFS_ErrorCode@@XZ
?PHYSFS_getLastModTime@@YA_JPEBD@Z
?PHYSFS_getLinkedVersion@@YAXPEAUPHYSFS_Version@@@Z
?PHYSFS_getMountPoint@@YAPEBDPEBD@Z
?PHYSFS_getPrefDir@@YAPEBDPEBD0@Z
?PHYSFS_getRealDir@@YAPEBDPEBD@Z
?PHYSFS_getSearchPath@@YAPEAPEADXZ
?PHYSFS_getSearchPathCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getUserDir@@YAPEBDXZ
?PHYSFS_getWriteDir@@YAPEBDXZ
?PHYSFS_init@@YAHPEBD@Z
?PHYSFS_isDirectory@@YAHPEBD@Z
?PHYSFS_isInit@@YAHXZ
?PHYSFS_isSymbolicLink@@YAHPEBD@Z
?PHYSFS_mkdir@@YAHPEBD@Z
?PHYSFS_mount@@YAHPEBD0H@Z
?PHYSFS_mountHandle@@YAHPEAUPHYSFS_File@@PEBD1H@Z
?PHYSFS_mountIo@@YAHPEAUPHYSFS_Io@@PEBD1H@Z
?PHYSFS_mountMemory@@YAHPEBX_KP6AXPEAX@ZPEBD4H@Z
?PHYSFS_openAppend@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openRead@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openWrite@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_permitSymbolicLinks@@YAXH@Z
?PHYSFS_read@@YA_JPEAUPHYSFS_File@@PEAXII@Z
?PHYSFS_readBytes@@YA_JPEAUPHYSFS_File@@PEAX_K@Z
?PHYSFS_readSBE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSBE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSBE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readSLE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSLE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSLE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readUBE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readUBE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readUBE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_readULE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readULE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readULE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_registerArchiver@@YAHPEBUPHYSFS_Archiver@@@Z
?PHYSFS_removeFromSearchPath@@YAHPEBD@Z
?PHYSFS_seek@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setAllocator@@YAHPEBUPHYSFS_Allocator@@@Z
?PHYSFS_setBuffer@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setRoot@@YAHPEBD0@Z
?PHYSFS_setSaneConfig@@YAHPEBD00HH@Z
?PHYSFS_setWriteDir@@YAHPEBD@Z
?PHYSFS_stat@@YAHPEBDPEAUPHYSFS_Stat@@@Z
?PHYSFS_supportedArchiveTypes@@YAPEAPEBUPHYSFS_ArchiveInfo@@XZ
?PHYSFS_swapSBE16@@YAFF@Z
?PHYSFS_swapSBE32@@YAHH@Z
?PHYSFS_swapSBE64@@YA_J_J@Z
?PHYSFS_swapSLE16@@YAFF@Z
?PHYSFS_swapSLE32@@YAHH@Z
?PHYSFS_swapSLE64@@YA_J_J@Z
?PHYSFS_swapUBE16@@YAGG@Z
?PHYSFS_swapUBE32@@YAII@Z
?PHYSFS_swapUBE64@@YA_K_K@Z
?PHYSFS_swapULE16@@YAGG@Z
?PHYSFS_swapULE32@@YAII@Z
?PHYSFS_swapULE64@@YA_K_K@Z
?PHYSFS_symbolicLinksPermitted@@YAHXZ
?PHYSFS_tell@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_ucs4stricmp@@YAHPEBI0@Z
?PHYSFS_unmount@@YAHPEBD@Z
?PHYSFS_utf16stricmp@@YAHPEBG0@Z
?PHYSFS_utf8FromLatin1@@YAXPEBDPEAD_K@Z
?PHYSFS_utf8FromUcs2@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8FromUcs4@@YAXPEBIPEAD_K@Z
?PHYSFS_utf8FromUtf16@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8ToUcs2@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8ToUcs4@@YAXPEBDPEAI_K@Z
?PHYSFS_utf8ToUtf16@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8stricmp@@YAHPEBD0@Z
?PHYSFS_write@@YA_JPEAUPHYSFS_File@@PEBXII@Z
?PHYSFS_writeBytes@@YA_JPEAUPHYSFS_File@@PEBX_K@Z
?PHYSFS_writeSBE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSBE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSBE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeSLE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSLE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSLE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeUBE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeUBE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeUBE64@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_writeULE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeULE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeULE64@@YAHPEAUPHYSFS_File@@_K@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 29.6MB - Virtual size: 29.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72b47a36b622b088823dc27eff824ba2

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cdCertificate

Extended Key Usages

Key Usages

cd:ad:21:e6:d4:23:6d:a7:95:18:71:0a:a1:34:07:32:a0:71:77:57Signer

Headers

DLL Characteristics

File Characteristics

Imports

steam_api64

pops_api

setupapi

imm32

version

winmm

tbb

ws2_32

opengl32

d3dx9_43

d3d9

xinput1_3

d3dcompiler_47

d3d11

dxgi

shlwapi

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

bcrypt

nakama-cpp

pdxbrowser_ipc

Exports

Exports

Sections

.text Size: 29.6MB - Virtual size: 29.6MB

.rdata Size: 7.0MB - Virtual size: 7.0MB

.data Size: 1.3MB - Virtual size: 6.1MB

.pdata Size: 1.3MB - Virtual size: 1.3MB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 263KB - Virtual size: 262KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

cd:ad:21:e6:d4:23:6d:a7:95:18:71:0a:a1:34:07:32:a0:71:77:57
Signer

.text
Size: 29.6MB - Virtual size: 29.6MB

.rdata
Size: 7.0MB - Virtual size: 7.0MB

.data
Size: 1.3MB - Virtual size: 6.1MB

.pdata
Size: 1.3MB - Virtual size: 1.3MB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 263KB - Virtual size: 262KB