eu4[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eu4.exe
Size

37.9MB
MD5

5915686d90a8079d354c459d3c136405
SHA1

6be12bc98276773979bcb2b36a16f5bb45766056
SHA256

38845874d67c73a56437ba70911f2929ade1fb0f4cc6941f9044cf7da45e5f9c
SHA512

049a2c6d550ef7df1673b72994a16bb360c77e032c09d0d76f4e032d87fd7be8fa62c45ce6a1ad212b7345d43df1fe24c96d66210ce7ebba0303fc15de8ceb90
SSDEEP

393216:wO6Mw/ErHbkxIsT9jR/a0GnVHECKA3KB+7T3ma:wf6HgKsRjcnSCKA3KSma

Score

1^/10

Malware Config

Signatures

Files

eu4.exe
.exe windows:6 windows x64

1298c1f127446621a98e5cc40369d1b5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/11/2022, 00:00

Not After

15/12/2023, 23:59

Subject

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

78:b4:97:3d:0f:37:cb:d2:8a:d3:f8:c4:9c:3f:aa:34:68:d4:6d:41
Signer

Actual PE Digest

78:b4:97:3d:0f:37:cb:d2:8a:d3:f8:c4:9c:3f:aa:34:68:d4:6d:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winmm

waveOutGetDevCapsW
waveOutGetErrorTextW
waveOutOpen
waveOutClose
waveOutPrepareHeader
waveOutGetNumDevs
waveOutWrite
waveInGetNumDevs
waveInGetDevCapsW
waveInOpen
waveInClose
timeEndPeriod
timeBeginPeriod
waveOutUnprepareHeader
timeGetTime

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmNotifyIME
ImmSetCompositionWindow
ImmGetIMEFileNameA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

tbb

?init@task_group_context@tbb@@IEAAXXZ
?allocate_via_handler_v3@internal@tbb@@YAPEAX_K@Z
?deallocate_via_handler_v3@internal@tbb@@YAXPEAX@Z
?internal_grow_by@concurrent_vector_base_v3@internal@tbb@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z
?internal_clear@concurrent_vector_base_v3@internal@tbb@@IEAA_KP6AXPEAX_K@Z@Z
??1concurrent_vector_base_v3@internal@tbb@@IEAA@XZ
?NFS_Allocate@internal@tbb@@YAPEAX_K0PEAX@Z
?NFS_Free@internal@tbb@@YAXPEAX@Z
?thread_get_id_v3@internal@tbb@@YA?AVid@tbb_thread_v3@12@XZ
?allocate@allocate_root_with_context_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?free@allocate_root_with_context_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?note_affinity@task@tbb@@UEAAXG@Z
?get_initial_auto_partitioner_divisor@internal@tbb@@YA_KXZ
?allocate@allocate_child_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate@allocate_continuation_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?is_group_execution_cancelled@task_group_context@tbb@@QEBA_NXZ
?observe@task_scheduler_observer_v3@internal@tbb@@QEAAX_N@Z
?destroy@task_base@internal@interface5@tbb@@SAXAEAVtask@4@@Z
?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z
?internal_start@tbb_thread_v3@internal@tbb@@AEAAXP6AIPEAX@Z0@Z
?join@tbb_thread_v3@internal@tbb@@QEAAXXZ
?hardware_concurrency@tbb_thread_v3@internal@tbb@@SAIXZ
?detach@tbb_thread_v3@internal@tbb@@QEAAXXZ
?free_closure_v3@internal@tbb@@YAXPEAX@Z
?allocate_closure_v3@internal@tbb@@YAPEAX_K@Z
??1task_group_context@tbb@@QEAA@XZ

galaxy64

?ProcessData@api@galaxy@@YAXXZ
?Friends@api@galaxy@@YAPEAVIFriends@12@XZ
?Init@api@galaxy@@YAXAEBUInitOptions@12@@Z
?GetError@api@galaxy@@YAPEBVIError@12@XZ
?ListenerRegistrar@api@galaxy@@YAPEAVIListenerRegistrar@12@XZ
?User@api@galaxy@@YAPEAVIUser@12@XZ
?Stats@api@galaxy@@YAPEAVIStats@12@XZ

opengl32

glLoadIdentity
glBlendFunc
glStencilFunc
glTexParameteri
glReadPixels
glColorMask
glViewport
glStencilOp
glClear
wglGetProcAddress
wglGetCurrentDC
glGetIntegerv
glGetError
glOrtho
glGetString
glDepthFunc
glPixelStorei
glGetFloatv
glDisable
glColor4f
glDrawElements
glGetTexImage
glVertex2f
glTexImage2D
glTexParameterf
glDrawArrays
glGetBooleanv
glClearColor
glBegin
glAlphaFunc
glTexEnvf
glStencilMask
glPolygonMode
glBindTexture
glGenTextures
glEnable
glCullFace
glDepthMask
glEnd
glScissor
glCopyTexSubImage2D
glMatrixMode
glFrontFace
glLineWidth
glDeleteTextures

d3dx9_43

D3DXCreateTexture
D3DXCompileShader
D3DXCreateLine
D3DXLoadSurfaceFromMemory
D3DXLoadSurfaceFromSurface
D3DXSaveTextureToFileInMemory
D3DXSaveSurfaceToFileInMemory
D3DXCreateCubeTexture

d3d9

Direct3DCreate9
Direct3DCreate9Ex

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

pops_api

POPS_SocialConnect
POPS_SocialRemoveFriend
POPS_Initialize
POPS_SocialListenRichPresence
POPS_SocialListenFriendListUpdates
POPS_SetRootPath
POPS_AutoStandardTelemetryEnable
POPS_SocialListenMultiplayerAction
POPS_AccountGetCountries
POPS_FeedRequest
POPS_TelemetrySendMulti
POPS_SocialSetRichPresence
POPS_GenerateGUID
POPS_SocialSendMessageToAccountID
POPS_SocialProfileQuery
POPS_SocialProfileRetrieve
POPS_AccountGetDetails
POPS_SocialListenPresence
POPS_AccountConnections
POPS_SocialSetXMPPLogLevel
POPS_SocialRespondToFriendRequest
POPS_SocialListenStatus
POPS_SetFileIO
POPS_RunCallbacks
POPS_SocialListenMessages
POPS_AccountRetrieveRefreshToken
POPS_SocialProfileCreate
POPS_AccountLogInWithAuthToken
POPS_SocialDisconnect
POPS_TokenRetrieveCurrent
POPS_SocialJoinRoom
POPS_SocialGetOpenFriendRequests
POPS_SocialGetFriendsList
POPS_Shutdown
POPS_FileStorageDelete
POPS_SocialSendMultiplayerActionToAccountID
POPS_SocialSetPresence
POPS_SocialSendMessageToRoom
POPS_SocialSendPrivateMessageToRoom
POPS_AccountGetGuid
POPS_FileStorageList
POPS_FileStorageRead
POPS_FileStorageSave
POPS_AccountCreate
POPS_AccountLogIn
POPS_AccountIsOnline
POPS_SocialAddFriend
POPS_AccountLogInRefreshToken

kernel32

UnregisterWaitEx
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
CreateThread
ExitThread
SetEvent
InitializeCriticalSection
GetVolumeInformationA
RemoveDirectoryW
GetFileSize
GetFileAttributesExW
GetDriveTypeA
FlushFileBuffers
DeleteFileW
GetComputerNameA
GetNativeSystemInfo
VirtualProtect
VirtualFree
VirtualAlloc
GetFullPathNameW
ConvertThreadToFiber
ConvertFiberToThread
RegisterWaitForSingleObject
QueryDepthSList
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetConsoleCtrlHandler
FindFirstFileExW
GetDriveTypeW
GetFileInformationByHandle
MoveFileExW
HeapAlloc
HeapReAlloc
HeapFree
RtlLookupFunctionEntry
InitializeSListHead
ResetEvent
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
CreateEventW
DecodePointer
EncodePointer
GetStringTypeW
DuplicateHandle
RtlVirtualUnwind
GetSystemTimeAsFileTime
GetModuleHandleExW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
GetNumaHighestNodeNumber
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
HeapSize
GetProcessHeap
FindNextFileW
FindFirstFileW
FindClose
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
ReadConsoleW
ReadConsoleA
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CreateEventA
Sleep
GetStdHandle
CreateProcessA
OpenProcess
GetCurrentProcessId
TerminateProcess
LoadLibraryA
GetProcAddress
FreeLibrary
GetLastError
WinExec
OutputDebugStringW
lstrlenW
AttachConsole
WriteConsoleW
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetFilePointerEx
WriteFile
CloseHandle
SetErrorMode
GetTickCount
GetModuleHandleW
ExitProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
GetCurrentProcess
LoadLibraryW
lstrcatW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
TlsAlloc
TlsGetValue
TlsSetValue
VerSetConditionMask
FormatMessageW
VerifyVersionInfoW
GlobalAlloc
GlobalUnlock
GlobalLock
GetVersionExA
CompareStringA
WideCharToMultiByte
MulDiv
GetSystemPowerStatus
GetModuleFileNameA
FormatMessageA
GetProcessAffinityMask
SetThreadAffinityMask
GetCommandLineA
GetModuleHandleA
FatalExit
RtlCaptureStackBackTrace
K32GetProcessMemoryInfo
GetLocaleInfoA
GetSystemDefaultUILanguage
OutputDebugStringA
SwitchToThread
GetFileAttributesA
SetLastError
GetCurrentDirectoryA
GetThreadId
RtlCaptureContext
SuspendThread
GetThreadContext
ResumeThread
ReadProcessMemory
SetFileAttributesA
CreateDirectoryA
IsDebuggerPresent
MultiByteToWideChar
CreateProcessW
SetUnhandledExceptionFilter
LocalAlloc
GlobalFree
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetModuleFileNameW
GetTickCount64
InitializeCriticalSectionEx
SleepEx
WaitForSingleObjectEx
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerifyVersionInfoA
GetSystemTime
SystemTimeToFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
SetEndOfFile

user32

IsRectEmpty
GetWindowLongW
LoadImageW
GetRawInputData
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetKeyboardLayout
MapVirtualKeyW
TrackMouseEvent
SendMessageW
CreateWindowExW
DestroyWindow
ClientToScreen
SetWindowPos
GetFocus
GetDC
ReleaseDC
SetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
CreateIconFromResource
SetWindowRgn
GetDoubleClickTime
SetCursorPos
LoadCursorW
DestroyIcon
CreateIconIndirect
RegisterRawInputDevices
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
EnumDisplayMonitors
GetDesktopWindow
GetMessageW
RegisterDeviceNotificationW
ClipCursor
RegisterClassExW
DialogBoxIndirectParamW
EndDialog
DrawTextW
SystemParametersInfoA
SystemParametersInfoW
GetRawInputDeviceInfoA
GetRawInputDeviceList
UnregisterClassA
UpdateWindow
RegisterClassExA
FindWindowExA
GetSystemMetrics
GetActiveWindow
LoadCursorFromFileA
LoadCursorA
CreateWindowExA
DefWindowProcA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
MessageBoxA
PostMessageW
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetPropW
ValidateRect
GetUpdateRect
GetMenu
GetAsyncKeyState
GetKeyState
IsIconic
GetClassInfoW
UnregisterClassW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageExtraInfo
PeekMessageW
DispatchMessageW
TranslateMessage
WindowFromPoint
UnregisterDeviceNotification
ScreenToClient
ShowWindow

gdi32

SetPixel
GetObjectA
GetTextMetricsW
CreateFontIndirectW
BitBlt
SwapBuffers
GetPixelFormat
SetPixelFormat
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateDCW
GetDeviceGammaRamp
SetDeviceGammaRamp
CombineRgn
CreateRectRgn
CreateBitmap
CreateCompatibleBitmap
GetDeviceCaps
GetDIBits
ChoosePixelFormat
DescribePixelFormat

shell32

DragAcceptFiles
SHGetFolderPathW
DragFinish
DragQueryFileW
SHCreateDirectoryExW
ShellExecuteA

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString

advapi32

CryptSetHashParam
OpenProcessToken
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
GetUserNameA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetUserKey
CryptGetProvParam

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom

nakama-cpp

NStringMap_create
NSession_getUsername
NRtClient_setNotificationsCallback
NStringDoubleMap_getKeys
NClient_linkEmail
NStringMap_setValue
NRtClient_setStreamPresenceCallback
NRtClient_destroy
NRtClient_disconnect
NClient_rpc
NRtClient_removeChatMessage
NClient_unlinkSteam
NSession_getAuthToken
NClient_deleteNotifications
NClient_listTournaments
NRtClient_setStreamDataCallback
NClient_linkCustom
createDefaultNakamaClient
NClient_deleteFriends
NSession_isExpired
NClient_linkGoogle
NRtClient_joinMatch
NRtClient_leaveChat
NRtClient_setChannelMessageCallback
NStringDoubleMap_create
NClient_writeStorageObjects
NRtClient_setStatusPresenceCallback
NClient_unlinkGameCenter
NClient_deleteStorageObjects
NRtClient_writeChatMessage
NClient_createRtClientEx
NStringMap_getSize
NClient_listGroups
NRtClient_setUserData
NStringDoubleMap_getValue
NRtClient_joinMatchByToken
NRtClient_setConnectCallback
NClient_listLeaderboardRecords
NClient_listLeaderboardRecordsAroundOwner
NClient_unlinkApple
NClient_promoteGroupUsers
NSession_destroy
NRtClient_addMatchmaker
NClient_unlinkGoogle
NClient_setUserData
NRtClient_isConnected
NRtClient_setMatchPresenceCallback
NRtClient_setChannelPresenceCallback
NClient_unlinkEmail
NClient_joinGroup
NClient_importFacebookFriends
NRtClient_getUserData
destroyNakamaClient
NClient_getUserData
NRtClient_connect
NClient_authenticateApple
NClient_authenticateFacebook
NClient_kickGroupUsers
NClient_unlinkDevice
NRtClient_joinChat
NClient_getUsers
NClient_linkSteam
NSession_isExpiredByTime
NClient_getAccount
NClient_tick
NClient_listUsersStorageObjects
NClient_linkDevice
NRtClient_tick
NClient_listStorageObjects
NClient_disconnect
NRtClient_updateChatMessage
NClient_addFriends
NClient_writeLeaderboardRecord
NClient_listUserGroups
NClient_linkGameCenter
NRtClient_removeMatchmaker
NClient_joinTournament
NClient_listMatches
NClient_authenticateDevice
NSession_getCreateTime
NClient_writeTournamentRecord
NStringDoubleMap_setValue
NRtClient_followUsers
NClient_linkFacebook
NClient_updateAccount
NStringMap_getValue
NRtClient_setErrorCallback
NClient_listGroupUsers
NStringMap_getKeys
NRtClient_unfollowUsers
NRtClient_rpc
NSession_getExpireTime
NClient_createGroup
NClient_leaveGroup
NRtClient_sendMatchData
NClient_blockFriends
NClient_deleteLeaderboardRecord
NRtClient_leaveMatch
NClient_updateGroup
NRtClient_setMatchDataCallback
NClient_demoteGroupUsers
NClient_listTournamentRecordsAroundOwner
NRtClient_setDisconnectCallback
NClient_readStorageObjects
NClient_listNotifications
NSession_getVariables
NClient_listChannelMessages
NClient_unlinkFacebook
NClient_listFriends
NStringDoubleMap_getSize
NClient_deleteGroup
NClient_authenticateEmail
NSession_getUserId
NClient_authenticateGameCenter
NSession_isCreated
NClient_authenticateSteam
NStringMap_destroy
NRtClient_setMatchmakerMatchedCallback
NClient_authenticateCustom
NClient_unlinkCustom
NClient_listTournamentRecords
NClient_rpc_with_http_key
NClient_linkApple
NStringDoubleMap_destroy
NClient_addGroupUsers
NClient_setErrorCallback
NClient_authenticateGoogle
NRtClient_createMatch

ws2_32

socket
recv
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
WSAIoctl
setsockopt
shutdown
ioctlsocket
listen
accept
sendto
recvfrom
select
__WSAFDIsSet
send
inet_pton
WSAGetLastError
WSACleanup
gethostname
ntohl
getaddrinfo
WSAStartup
htonl
freeaddrinfo
getnameinfo
WSASetLastError

shlwapi

PathAppendW
PathFileExistsW

Exports

Exports

NvOptimusEnablement
PHYSFS_addToSearchPath
PHYSFS_caseFold
PHYSFS_close
PHYSFS_deinit
PHYSFS_delete
PHYSFS_deregisterArchiver
PHYSFS_enumerate
PHYSFS_enumerateFiles
PHYSFS_enumerateFilesCallback
PHYSFS_eof
PHYSFS_exists
PHYSFS_fileLength
PHYSFS_flush
PHYSFS_freeList
PHYSFS_getAllocator
PHYSFS_getBaseDir
PHYSFS_getCdRomDirs
PHYSFS_getCdRomDirsCallback
PHYSFS_getDirSeparator
PHYSFS_getErrorByCode
PHYSFS_getLastError
PHYSFS_getLastErrorCode
PHYSFS_getLastModTime
PHYSFS_getLinkedVersion
PHYSFS_getMountPoint
PHYSFS_getPrefDir
PHYSFS_getRealDir
PHYSFS_getSearchPath
PHYSFS_getSearchPathCallback
PHYSFS_getUserDir
PHYSFS_getWriteDir
PHYSFS_init
PHYSFS_isDirectory
PHYSFS_isInit
PHYSFS_isSymbolicLink
PHYSFS_mkdir
PHYSFS_mount
PHYSFS_mountHandle
PHYSFS_mountIo
PHYSFS_mountMemory
PHYSFS_openAppend
PHYSFS_openRead
PHYSFS_openWrite
PHYSFS_permitSymbolicLinks
PHYSFS_read
PHYSFS_readBytes
PHYSFS_readSBE16
PHYSFS_readSBE32
PHYSFS_readSBE64
PHYSFS_readSLE16
PHYSFS_readSLE32
PHYSFS_readSLE64
PHYSFS_readUBE16
PHYSFS_readUBE32
PHYSFS_readUBE64
PHYSFS_readULE16
PHYSFS_readULE32
PHYSFS_readULE64
PHYSFS_registerArchiver
PHYSFS_removeFromSearchPath
PHYSFS_seek
PHYSFS_setAllocator
PHYSFS_setBuffer
PHYSFS_setErrorCode
PHYSFS_setSaneConfig
PHYSFS_setWriteDir
PHYSFS_stat
PHYSFS_supportedArchiveTypes
PHYSFS_swapSBE16
PHYSFS_swapSBE32
PHYSFS_swapSBE64
PHYSFS_swapSLE16
PHYSFS_swapSLE32
PHYSFS_swapSLE64
PHYSFS_swapUBE16
PHYSFS_swapUBE32
PHYSFS_swapUBE64
PHYSFS_swapULE16
PHYSFS_swapULE32
PHYSFS_swapULE64
PHYSFS_symbolicLinksPermitted
PHYSFS_tell
PHYSFS_ucs4stricmp
PHYSFS_unmount
PHYSFS_utf16stricmp
PHYSFS_utf8FromLatin1
PHYSFS_utf8FromUcs2
PHYSFS_utf8FromUcs4
PHYSFS_utf8FromUtf16
PHYSFS_utf8ToUcs2
PHYSFS_utf8ToUcs4
PHYSFS_utf8ToUtf16
PHYSFS_utf8stricmp
PHYSFS_write
PHYSFS_writeBytes
PHYSFS_writeSBE16
PHYSFS_writeSBE32
PHYSFS_writeSBE64
PHYSFS_writeSLE16
PHYSFS_writeSLE32
PHYSFS_writeSLE64
PHYSFS_writeUBE16
PHYSFS_writeUBE32
PHYSFS_writeUBE64
PHYSFS_writeULE16
PHYSFS_writeULE32
PHYSFS_writeULE64
SDL_AddEventWatch
SDL_AddHintCallback
SDL_AddTimer
SDL_AllocFormat
SDL_AllocPalette
SDL_AllocRW
SDL_AtomicAdd
SDL_AtomicCAS
SDL_AtomicCASPtr
SDL_AtomicGet
SDL_AtomicGetPtr
SDL_AtomicLock
SDL_AtomicSet
SDL_AtomicSetPtr
SDL_AtomicTryLock
SDL_AtomicUnlock
SDL_AudioInit
SDL_AudioQuit
SDL_BuildAudioCVT
SDL_CalculateGammaRamp
SDL_CaptureMouse
SDL_ClearError
SDL_ClearHints
SDL_ClearQueuedAudio
SDL_CloseAudio
SDL_CloseAudioDevice
SDL_CondBroadcast
SDL_CondSignal
SDL_CondWait
SDL_CondWaitTimeout
SDL_ConvertAudio
SDL_ConvertPixels
SDL_ConvertSurface
SDL_ConvertSurfaceFormat
SDL_CreateColorCursor
SDL_CreateCond
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateRenderer
SDL_CreateSemaphore
SDL_CreateShapedWindow
SDL_CreateSoftwareRenderer
SDL_CreateSystemCursor
SDL_CreateTexture
SDL_CreateTextureFromSurface
SDL_CreateThread
SDL_CreateWindow
SDL_CreateWindowAndRenderer
SDL_CreateWindowFrom
SDL_DXGIGetOutputInfo
SDL_DYNAPI_entry
SDL_DelEventWatch
SDL_DelHintCallback
SDL_Delay
SDL_DestroyCond
SDL_DestroyMutex
SDL_DestroyRenderer
SDL_DestroySemaphore
SDL_DestroyTexture
SDL_DestroyWindow
SDL_DetachThread
SDL_Direct3D9GetAdapterIndex
SDL_DisableScreenSaver
SDL_EnableScreenSaver
SDL_EnclosePoints
SDL_Error
SDL_EventState
SDL_FillRect
SDL_FillRects
SDL_FilterEvents
SDL_FlushEvent
SDL_FlushEvents
SDL_FreeCursor
SDL_FreeFormat
SDL_FreePalette
SDL_FreeRW
SDL_FreeSurface
SDL_FreeWAV
SDL_GL_BindTexture
SDL_GL_CreateContext
SDL_GL_DeleteContext
SDL_GL_ExtensionSupported
SDL_GL_GetAttribute
SDL_GL_GetCurrentContext
SDL_GL_GetCurrentWindow
SDL_GL_GetDrawableSize
SDL_GL_GetProcAddress
SDL_GL_GetSwapInterval
SDL_GL_LoadLibrary
SDL_GL_MakeCurrent
SDL_GL_ResetAttributes
SDL_GL_SetAttribute
SDL_GL_SetSwapInterval
SDL_GL_SwapWindow
SDL_GL_UnbindTexture
SDL_GL_UnloadLibrary
SDL_GameControllerAddMapping
SDL_GameControllerAddMappingsFromRW
SDL_GameControllerClose
SDL_GameControllerEventState
SDL_GameControllerFromInstanceID
SDL_GameControllerGetAttached
SDL_GameControllerGetAxis
SDL_GameControllerGetAxisFromString
SDL_GameControllerGetBindForAxis
SDL_GameControllerGetBindForButton
SDL_GameControllerGetButton
SDL_GameControllerGetButtonFromString
SDL_GameControllerGetJoystick
SDL_GameControllerGetStringForAxis
SDL_GameControllerGetStringForButton
SDL_GameControllerMapping
SDL_GameControllerMappingForGUID
SDL_GameControllerName
SDL_GameControllerNameForIndex
SDL_GameControllerOpen
SDL_GameControllerUpdate
SDL_GetAssertionHandler
SDL_GetAssertionReport
SDL_GetAudioDeviceName
SDL_GetAudioDeviceStatus
SDL_GetAudioDriver
SDL_GetAudioStatus
SDL_GetBasePath
SDL_GetCPUCacheLineSize
SDL_GetCPUCount
SDL_GetClipRect
SDL_GetClipboardText
SDL_GetClosestDisplayMode
SDL_GetColorKey
SDL_GetCurrentAudioDriver
SDL_GetCurrentDisplayMode
SDL_GetCurrentVideoDriver
SDL_GetCursor
SDL_GetDefaultAssertionHandler
SDL_GetDefaultCursor
SDL_GetDesktopDisplayMode
SDL_GetDisplayBounds
SDL_GetDisplayDPI
SDL_GetDisplayMode
SDL_GetDisplayName
SDL_GetError
SDL_GetEventFilter
SDL_GetGlobalMouseState
SDL_GetGrabbedWindow
SDL_GetHint
SDL_GetKeyFromName
SDL_GetKeyFromScancode
SDL_GetKeyName
SDL_GetKeyboardFocus
SDL_GetKeyboardState
SDL_GetModState
SDL_GetMouseFocus
SDL_GetMouseState
SDL_GetNumAudioDevices
SDL_GetNumAudioDrivers
SDL_GetNumDisplayModes
SDL_GetNumRenderDrivers
SDL_GetNumTouchDevices
SDL_GetNumTouchFingers
SDL_GetNumVideoDisplays
SDL_GetNumVideoDrivers
SDL_GetPerformanceCounter
SDL_GetPerformanceFrequency
SDL_GetPixelFormatName
SDL_GetPlatform
SDL_GetPowerInfo
SDL_GetPrefPath
SDL_GetQueuedAudioSize
SDL_GetRGB
SDL_GetRGBA
SDL_GetRelativeMouseMode
SDL_GetRelativeMouseState
SDL_GetRenderDrawBlendMode
SDL_GetRenderDrawColor
SDL_GetRenderDriverInfo
SDL_GetRenderTarget
SDL_GetRenderer
SDL_GetRendererInfo
SDL_GetRendererOutputSize
SDL_GetRevision
SDL_GetRevisionNumber
SDL_GetScancodeFromKey
SDL_GetScancodeFromName
SDL_GetScancodeName
SDL_GetShapedWindowMode
SDL_GetSurfaceAlphaMod
SDL_GetSurfaceBlendMode
SDL_GetSurfaceColorMod
SDL_GetSystemRAM
SDL_GetTextureAlphaMod
SDL_GetTextureBlendMode
SDL_GetTextureColorMod
SDL_GetThreadID
SDL_GetThreadName
SDL_GetTicks
SDL_GetTouchDevice
SDL_GetTouchFinger
SDL_GetVersion
SDL_GetVideoDriver
SDL_GetWindowBrightness
SDL_GetWindowData
SDL_GetWindowDisplayIndex
SDL_GetWindowDisplayMode
SDL_GetWindowFlags
SDL_GetWindowFromID
SDL_GetWindowGammaRamp
SDL_GetWindowGrab
SDL_GetWindowID
SDL_GetWindowMaximumSize
SDL_GetWindowMinimumSize
SDL_GetWindowPixelFormat
SDL_GetWindowPosition
SDL_GetWindowSize
SDL_GetWindowSurface
SDL_GetWindowTitle
SDL_GetWindowWMInfo
SDL_HapticClose
SDL_HapticDestroyEffect
SDL_HapticEffectSupported
SDL_HapticGetEffectStatus
SDL_HapticIndex
SDL_HapticName
SDL_HapticNewEffect
SDL_HapticNumAxes
SDL_HapticNumEffects
SDL_HapticNumEffectsPlaying
SDL_HapticOpen
SDL_HapticOpenFromJoystick
SDL_HapticOpenFromMouse
SDL_HapticOpened
SDL_HapticPause
SDL_HapticQuery
SDL_HapticRumbleInit
SDL_HapticRumblePlay
SDL_HapticRumbleStop
SDL_HapticRumbleSupported
SDL_HapticRunEffect
SDL_HapticSetAutocenter
SDL_HapticSetGain
SDL_HapticStopAll
SDL_HapticStopEffect
SDL_HapticUnpause
SDL_HapticUpdateEffect
SDL_Has3DNow
SDL_HasAVX
SDL_HasAVX2
SDL_HasAltiVec
SDL_HasClipboardText
SDL_HasEvent
SDL_HasEvents
SDL_HasIntersection
SDL_HasMMX
SDL_HasRDTSC
SDL_HasSSE
SDL_HasSSE2
SDL_HasSSE3
SDL_HasSSE41
SDL_HasSSE42
SDL_HasScreenKeyboardSupport
SDL_HideWindow
SDL_Init
SDL_InitSubSystem
SDL_IntersectRect
SDL_IntersectRectAndLine
SDL_IsGameController
SDL_IsScreenKeyboardShown
SDL_IsScreenSaverEnabled
SDL_IsShapedWindow
SDL_IsTextInputActive
SDL_JoystickClose
SDL_JoystickCurrentPowerLevel
SDL_JoystickEventState
SDL_JoystickFromInstanceID
SDL_JoystickGetAttached
SDL_JoystickGetAxis
SDL_JoystickGetBall
SDL_JoystickGetButton
SDL_JoystickGetDeviceGUID
SDL_JoystickGetGUID
SDL_JoystickGetGUIDFromString
SDL_JoystickGetGUIDString
SDL_JoystickGetHat
SDL_JoystickInstanceID
SDL_JoystickIsHaptic
SDL_JoystickName
SDL_JoystickNameForIndex
SDL_JoystickNumAxes
SDL_JoystickNumBalls
SDL_JoystickNumButtons
SDL_JoystickNumHats
SDL_JoystickOpen
SDL_JoystickUpdate
SDL_LoadBMP_RW
SDL_LoadDollarTemplates
SDL_LoadFunction
SDL_LoadObject
SDL_LoadWAV_RW
SDL_LockAudio
SDL_LockAudioDevice
SDL_LockMutex
SDL_LockSurface
SDL_LockTexture
SDL_Log
SDL_LogCritical
SDL_LogDebug
SDL_LogError
SDL_LogGetOutputFunction
SDL_LogGetPriority
SDL_LogInfo
SDL_LogMessage
SDL_LogMessageV
SDL_LogResetPriorities
SDL_LogSetAllPriority
SDL_LogSetOutputFunction
SDL_LogSetPriority
SDL_LogVerbose
SDL_LogWarn
SDL_LowerBlit
SDL_LowerBlitScaled
SDL_MapRGB
SDL_MapRGBA
SDL_MasksToPixelFormatEnum
SDL_MaximizeWindow
SDL_MinimizeWindow
SDL_MixAudio
SDL_MixAudioFormat
SDL_MouseIsHaptic
SDL_NumHaptics
SDL_NumJoysticks
SDL_OpenAudio
SDL_OpenAudioDevice
SDL_PauseAudio
SDL_PauseAudioDevice
SDL_PeepEvents
SDL_PixelFormatEnumToMasks
SDL_PollEvent
SDL_PumpEvents
SDL_PushEvent
SDL_QueryTexture
SDL_QueueAudio
SDL_Quit
SDL_QuitSubSystem
SDL_RWFromConstMem
SDL_RWFromFP
SDL_RWFromFile
SDL_RWFromMem
SDL_RaiseWindow
SDL_ReadBE16
SDL_ReadBE32
SDL_ReadBE64
SDL_ReadLE16
SDL_ReadLE32
SDL_ReadLE64
SDL_ReadU8
SDL_RecordGesture
SDL_RegisterApp
SDL_RegisterEvents
SDL_RemoveTimer
SDL_RenderClear
SDL_RenderCopy
SDL_RenderCopyEx
SDL_RenderDrawLine
SDL_RenderDrawLines
SDL_RenderDrawPoint
SDL_RenderDrawPoints
SDL_RenderDrawRect
SDL_RenderDrawRects
SDL_RenderFillRect
SDL_RenderFillRects
SDL_RenderGetClipRect
SDL_RenderGetD3D9Device
SDL_RenderGetLogicalSize
SDL_RenderGetScale
SDL_RenderGetViewport
SDL_RenderIsClipEnabled
SDL_RenderPresent
SDL_RenderReadPixels
SDL_RenderSetClipRect
SDL_RenderSetLogicalSize
SDL_RenderSetScale
SDL_RenderSetViewport
SDL_RenderTargetSupported
SDL_ReportAssertion
SDL_ResetAssertionReport
SDL_RestoreWindow
SDL_SaveAllDollarTemplates
SDL_SaveBMP_RW
SDL_SaveDollarTemplate
SDL_SemPost

Sections

.text
Size: 26.1MB - Virtual size: 26.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.5MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 29B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 206KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1298c1f127446621a98e5cc40369d1b5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cdCertificate

Extended Key Usages

Key Usages

78:b4:97:3d:0f:37:cb:d2:8a:d3:f8:c4:9c:3f:aa:34:68:d4:6d:41Signer

Headers

DLL Characteristics

File Characteristics

Imports

winmm

imm32

version

tbb

galaxy64

opengl32

d3dx9_43

d3d9

crypt32

pops_api

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

bcrypt

nakama-cpp

ws2_32

shlwapi

Exports

Exports

Sections

.text Size: 26.1MB - Virtual size: 26.1MB

.rdata Size: 6.7MB - Virtual size: 6.7MB

.data Size: 3.5MB - Virtual size: 4.7MB

.pdata Size: 1.0MB - Virtual size: 1.0MB

.gfids Size: 5KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 29B

_RDATA Size: 6KB - Virtual size: 5KB

.gehcont Size: 512B - Virtual size: 36B

.rsrc Size: 363KB - Virtual size: 363KB

.reloc Size: 206KB - Virtual size: 206KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

78:b4:97:3d:0f:37:cb:d2:8a:d3:f8:c4:9c:3f:aa:34:68:d4:6d:41
Signer

.text
Size: 26.1MB - Virtual size: 26.1MB

.rdata
Size: 6.7MB - Virtual size: 6.7MB

.data
Size: 3.5MB - Virtual size: 4.7MB

.pdata
Size: 1.0MB - Virtual size: 1.0MB

.gfids
Size: 5KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 29B

_RDATA
Size: 6KB - Virtual size: 5KB

.gehcont
Size: 512B - Virtual size: 36B

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 206KB - Virtual size: 206KB