sekiro[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sekiro.exe
Size

64.7MB
MD5

213b49ac03eee554393785f9ab3a63d7
SHA1

81a1f08c32888130e62a9c019ac8f73621f7cc92
SHA256

f036262a7a27904b800ccea94514b178768eee3f0b77b0356a445a5a74755a1d
SHA512

185dbe905329399aa4d7292262ea909476b93ed78cfa7cf0050de34794a30e6e649cbca591c7bd9367ac29af9d202ef96fcfba0b796d9959d0784cf3a4c7c01a
SSDEEP

393216:ExWz+pwsOJVX0fGT8QCGGUMrgCAsRKQ6zfvAnQY1XKZ8II+B9perW1XgAH7voq5Y:ExEcvnLXdwe8ESkJvkyWzhO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sekiro.exe

Files

sekiro.exe
.exe windows:6 windows x64 arch:x64

88aa0caf941cb2c726be6010d8d3eed1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

steam_api64

SteamNetworking
SteamAPI_RegisterCallResult
SteamMatchmaking
SteamAPI_UnregisterCallResult
SteamAPI_RunCallbacks
SteamAPI_Init
SteamClient
SteamAPI_RestartAppIfNecessary
SteamAPI_Shutdown
SteamUserStats
SteamUser
SteamUtils
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamApps
SteamFriends

dxgi

CreateDXGIFactory

ws2_32

gethostname
WSASocketW
getaddrinfo
freeaddrinfo
inet_pton
inet_ntop
gethostbyname
bind
recvfrom
ntohs
WSAEnumNetworkEvents
inet_ntoa
getservbyport
gethostbyaddr
getsockname
connect
WSAGetLastError
accept
__WSAFDIsSet
getsockopt
WSACleanup
getnameinfo
WSASetLastError
inet_addr
WSACloseEvent
WSACreateEvent
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
WSAEventSelect
getpeername
WSAStartup
socket
shutdown
setsockopt
send
select
recv
ntohl
listen
htons
htonl
ioctlsocket
getservbyname
closesocket
sendto

amd_ags_x64

agsSetDisplayMode
agsDeInit
agsInit

fmodex64

?setLevels@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@PEAMH@Z
?getNumGroups@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?FS_convertMultiChannelLevelToSpeakerLevel@System@FMOD@@QEAA?AW4FMOD_RESULT@@QEAY07MQEAY07$$CBMH@Z
?setSpeakerLevels@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@PEAMH@Z
?createDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_DSP_DESCRIPTION@@PEAPEAVDSP@2@@Z
?setMix@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?playDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PEAVDSP@2@_NPEAPEAVChannel@2@@Z
?setVolume@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setFrequency@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?release@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?addGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@@Z
?setVolume@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?release@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getOpenState@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_OPENSTATE@@PEAIPEA_N2@Z
?getSubSound@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@@Z
?FS_GetEmulatedChannelsUsed@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?FS_GetSoftwareChannelsUsed@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?FS_GetHardwareChannelsUsed@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getMasterChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?createChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVChannelGroup@2@@Z
?getHardwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getOutputHandle@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?setStreamBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?setCallback@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_SYSTEM@@W4FMOD_SYSTEM_CALLBACKTYPE@@PEAX2@Z@Z
?getSpeakerMode@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_SPEAKERMODE@@@Z
?setSpeakerMode@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?setAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?setFileSystem@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEBDHPEAIPEAPEAX2@ZP6A?AW43@PEAX4@ZP6A?AW43@44I14@ZP6A?AW43@4I4@ZP6A?AW43@PEAUFMOD_ASYNCREADINFO@@4@Z5H@Z
?setDSPBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@IH@Z
?getSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAW4FMOD_SOUND_FORMAT@@00PEAW4FMOD_DSP_RESAMPLER@@0@Z
?setSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
?getSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?setSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getDriverCaps@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAIPEAHPEAW4FMOD_SPEAKERMODE@@@Z
?getNumDrivers@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?setOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
FMOD_Debug_SetLevel
FMOD_Memory_Initialize
?getUserData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getOutput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@PEAPEAVDSPConnection@2@@Z
?getInput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@PEAPEAVDSPConnection@2@@Z
?getNumInputs@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?disconnectAll@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N0@Z
?disconnectFrom@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@@Z
?addInput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@PEAPEAVDSPConnection@2@@Z
?getDSPHead@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVDSP@2@@Z
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?createStream@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?setDriver@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEADPEAIPEAH22@Z
?getChannel@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVChannel@2@@Z
?setPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?getCurrentSound@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSound@2@@Z
?getNumChannels@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z

fmod_event64

?getInfo@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAPEAD@Z
?set3DListenerAttributes@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_VECTOR@@000@Z
?set3DNumListeners@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getValue@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getGroup@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD_NPEAPEAVEventGroup@2@@Z
?preloadFSB@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDHPEAVSound@2@_N@Z
?unloadFSB@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDH@Z
?setValue@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?set3DAttributes@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@00@Z
?setMute@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getPaused@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getProperty@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAX_N@Z
?setReverbProperties@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_REVERB_PROPERTIES@@@Z
?getEvent@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAPEAVEvent@2@@Z
?getCategoryByIndex@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVEventCategory@2@@Z
?getCategory@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventCategory@2@@Z
?getNumProjects@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getProjectByIndex@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVEventProject@2@@Z
?getProject@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventProject@2@@Z
?getEventBySystemID@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEAPEAVEvent@2@@Z
?getParameterByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVEventParameter@2@@Z
?setPaused@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setPitch@Event@FMOD@@QEAA?AW4FMOD_RESULT@@MW4FMOD_EVENT_PITCHUNITS@@@Z
?setVolume@Event@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getReverbPreset@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_REVERB_PROPERTIES@@PEAH@Z
?getNumParameters@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getCategory@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVEventCategory@2@@Z
?setPropertyByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAX_N@Z
?getParameter@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventParameter@2@@Z
?setCallback@Event@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_EVENT@@W4FMOD_EVENT_CALLBACKTYPE@@PEAX22@Z2@Z
FMOD_EventSystem_Create
?get3DListenerAttributes@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_VECTOR@@000@Z
?start@Event@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setLanguage@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?getSystemObject@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?init@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HIPEAXI@Z
?release@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?update@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setMediaPath@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?getChannelGroup@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?getState@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getPropertyByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAX_N@Z
?getInfo@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAPEADPEAUFMOD_EVENT_INFO@@@Z
?load@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_EVENT_LOADINFO@@PEAPEAVEventProject@2@@Z
?getParentGroup@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVEventGroup@2@@Z
?unload@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getReverbPresetByIndex@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_REVERB_PROPERTIES@@PEAPEAD@Z
?stop@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z

oo2core_6_win64

OodleLZ_Decompress
OodleLZ_Compress
OodleLZ_CompressOptions_GetDefault
OodleLZ_GetCompressedBufferSizeNeeded
OodleLZ_GetCompressedStepForRawStep
OodleLZDecoder_MemorySizeNeeded

wldap32

ord27
ord26
ord22
ord41
ord50
ord60
ord32
ord46
ord143
ord200
ord301
ord79
ord33
ord35
ord211
ord30

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

advapi32

CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW
GetUserNameA
SystemFunction036

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

bink2w64

BinkNextFrame
BinkWait
BinkClose
BinkOpen
BinkGoto
BinkShouldSkip
BinkControlBackgroundIO
BinkStartAsyncThread
BinkDoFrameAsyncMulti
BinkPause
BinkRequestStopAsyncThread
BinkWaitStopAsyncThread
BinkGetRealtime
BinkSetSoundTrack
BinkSetIOSize
BinkSetMemory
BinkSetVolume
BinkSetSpeakerVolumes
BinkSetSoundSystem
BinkOpenDirectSound
BinkOpenXAudio2
BinkGetFrameBuffersInfo
BinkRegisterFrameBuffers
BinkAllocateFrameBuffers
BinkDoFrameAsyncWait

kernel32

GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
RegisterWaitForSingleObject
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
DuplicateHandle
GetStringTypeW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
InterlockedPopEntrySList
TerminateProcess
UnregisterWait
GetTimeFormatW
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RtlUnwindEx
ExitProcess
GetACP
VirtualProtect
GetSystemDirectoryA
CreateSemaphoreA
CreateEventA
CreateMutexA
GetTimeZoneInformation
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
SetUnhandledExceptionFilter
IsValidLocale
GlobalLock
GlobalAlloc
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
GetEnvironmentVariableW
GlobalMemoryStatus
GetTickCount
RtlVirtualUnwind
ExitThread
ConvertFiberToThread
WideCharToMultiByte
DeleteFiber
MultiByteToWideChar
GetFileType
GetStdHandle
GetModuleHandleExW
GetDiskFreeSpaceExW
CreateProcessA
LoadLibraryExW
GetSystemDirectoryW
LocalAlloc
GetDiskFreeSpaceW
CreateFileA
MoveFileW
FormatMessageW
GetOverlappedResult
SetErrorMode
SetEndOfFile
ReadFile
GetFileInformationByHandle
GetModuleFileNameW
GetDriveTypeW
OutputDebugStringW
GetUserDefaultLangID
GetTempPathW
GetTempFileNameW
ResumeThread
SuspendThread
TerminateThread
RaiseException
CreateEventW
ResetEvent
SetEvent
OpenThread
GetModuleHandleW
SetLastError
SetProcessAffinityMask
GetProcessAffinityMask
SystemTimeToFileTime
FileTimeToSystemTime
GetLocalTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
ReleaseMutex
GetSystemDefaultLCID
GetSystemDefaultLangID
WriteFile
SetFilePointer
FlushFileBuffers
VerifyVersionInfoW
SetHandleInformation
VerSetConditionMask
ReadDirectoryChangesW
CopyFileW
GetSystemTimeAsFileTime
QueueUserAPC
WaitForSingleObjectEx
SleepEx
CancelIo
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
SetConsoleCtrlHandler
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
HeapReAlloc
GetConsoleCP
HeapSize
HeapQueryInformation
GetUserDefaultLCID
EnumSystemLocalesW
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
MoveFileExW
IsValidCodePage
GetOEMCP
SetStdHandle
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
PulseEvent
GetDateFormatW
GlobalUnlock
InitializeCriticalSection
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetExitCodeThread
CreateThread
LoadLibraryW
GetModuleFileNameA
GetCurrentProcess
VirtualQuery
VirtualFree
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
SetThreadIdealProcessor
SetThreadAffinityMask
FreeLibrary
TlsFree
TlsSetValue
TlsAlloc
LoadLibraryA
GetProcAddress
GetSystemInfo
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceFrequency
QueryPerformanceCounter
TlsGetValue
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
Sleep
VirtualAlloc
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetSystemDefaultLocaleName
CloseHandle
GetLastError
GetCommandLineW
CreateMutexW
GetCurrentThread
SetThreadPriority
LocalFree

user32

LoadCursorW
SetCursor
GetWindowRect
GetClientRect
SetWindowTextW
SetForegroundWindow
UpdateWindow
KillTimer
SetTimer
SendInput
IsZoomed
ShowWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
SendMessageW
GetMessageExtraInfo
SetWindowLongW
GetWindowLongW
AdjustWindowRect
SetActiveWindow
GetSystemMetrics
SetFocus
LoadIconW
GetDC
GetKeyboardState
GetKeyState
GetKeyboardLayout
ScreenToClient
FindWindowW
GetActiveWindow
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetForegroundWindow
PostQuitMessage
GetClipboardData
GetAsyncKeyState
ShowCursor
GetCursorPos
SetCursorPos
ClipCursor
SetWindowPos
GetDesktopWindow
ClientToScreen

gdi32

GetGlyphOutlineW
CreateFontW
GetTextMetricsW
GetKerningPairsW
SelectObject
EnumFontFamiliesExW
DeleteObject
CreateBitmap

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateGuid
CoInitialize

oleaut32

SysAllocString
SysFreeString

imm32

ImmDisableIME

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11SaveTextureToFileW

d3d9

D3DPERF_GetStatus

xinput1_3

ord3
ord2

dinput8

DirectInput8Create

d3dcompiler_43

D3DGetBlobPart

Exports

Exports

??0BufferedFile@Scaleform@@IEAA@XZ
??0BufferedFile@Scaleform@@QEAA@PEAVFile@1@@Z
??0Event@Scaleform@@QEAA@_N0@Z
??0Mutex@Scaleform@@QEAA@_N0@Z
??0Semaphore@Scaleform@@QEAA@H_N@Z
??0SysAllocPagedMalloc@Scaleform@@QEAA@_K@Z
??0SysAllocStatic@Scaleform@@QEAA@PEAX_K010101@Z
??0SysAllocStatic@Scaleform@@QEAA@_K@Z
??0SysAllocWinAPI@Scaleform@@QEAA@_K0@Z
??0SysFile@Scaleform@@QEAA@AEBVString@1@HH@Z
??0SysFile@Scaleform@@QEAA@XZ
??0System@Scaleform@@QEAA@AEBUHeapDesc@MemoryHeap@1@PEAVSysAllocBase@1@@Z
??0System@Scaleform@@QEAA@PEAVSysAllocBase@1@@Z
??0Thread@Scaleform@@QEAA@AEBUCreateParams@01@@Z
??0Thread@Scaleform@@QEAA@P6AHPEAV01@PEAX@Z1_KHW4ThreadState@01@@Z
??0Thread@Scaleform@@QEAA@_KH@Z
??0WaitCondition@Scaleform@@QEAA@XZ
??1AcquireInterface@Scaleform@@UEAA@XZ
??1BufferedFile@Scaleform@@UEAA@XZ
??1DefaultAcquireInterface@Scaleform@@UEAA@XZ
??1Event@Scaleform@@UEAA@XZ
??1Loader@GFx@Scaleform@@UEAA@XZ
??1Mutex@Scaleform@@UEAA@XZ
??1RefCountImplCore@Scaleform@@UEAA@XZ
??1RefCountNTSImplCore@Scaleform@@UEAA@XZ
??1RefCountWeakSupportImpl@Scaleform@@UEAA@XZ
??1Semaphore@Scaleform@@UEAA@XZ
??1System@Scaleform@@QEAA@XZ
??1Thread@Scaleform@@UEAA@XZ
??1WaitCondition@Scaleform@@QEAA@XZ
??ESemaphore@Scaleform@@QEAAHH@Z
??FSemaphore@Scaleform@@QEAAHH@Z
??YSemaphore@Scaleform@@QEAAHH@Z
??ZSemaphore@Scaleform@@QEAAHH@Z
??_FEvent@Scaleform@@QEAAXXZ
??_FMutex@Scaleform@@QEAAXXZ
??_FSemaphore@Scaleform@@QEAAXXZ
??_FSysAllocPagedMalloc@Scaleform@@QEAAXXZ
??_FSysAllocStatic@Scaleform@@QEAAXXZ
??_FSysAllocWinAPI@Scaleform@@QEAAXXZ
??_FSystem@Scaleform@@QEAAXXZ
??_FThread@Scaleform@@QEAAXXZ
?Acquire@Waitable@Scaleform@@QEAA_NI@Z
?AcquireMultipleObjects@AcquireInterface@Scaleform@@SA_NPEAPEAVWaitable@2@II@Z
?AcquireOneOfMultipleObjects@AcquireInterface@Scaleform@@SAHPEAPEAVWaitable@2@II@Z
?AddMemSegment@SysAllocStatic@Scaleform@@QEAAXPEAX_K@Z
?AddRef@RefCountImpl@Scaleform@@QEAAXXZ
?AddWaitHandler@Waitable@Scaleform@@QEAA_NP6AXPEAX@Z0@Z
?Append@?$Matrix2x4@M@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?Append@?$Matrix2x4@N@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?Append_NonOpt@?$Matrix2x4@N@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?Blend@Color@Render@Scaleform@@SA?AV123@V123@0M@Z
?BytesAvailable@BufferedFile@Scaleform@@UEAAHXZ
?CallWaitHandlers@HandlerArray@Waitable@Scaleform@@QEAAXXZ
?CallWaitHandlers@Waitable@Scaleform@@QEAAXXZ
?CanAcquire@AcquireInterface@Scaleform@@UEAA_NXZ
?CanAcquire@Event@Scaleform@@UEAA_NXZ
?CanAcquire@Mutex@Scaleform@@UEAA_NXZ
?CanAcquire@Semaphore@Scaleform@@UEAA_NXZ
?ChangeSize@BufferedFile@Scaleform@@UEAA_NH@Z
?Close@BufferedFile@Scaleform@@UEAA_NXZ
?Close@SysFile@Scaleform@@UEAA_NXZ
?ConvertHSIToRGB@Color@Render@Scaleform@@SAXNNNPEAN00@Z
?ConvertRGBToHSI@Color@Render@Scaleform@@SAXNNNPEAN00@Z
?CopyFromStream@BufferedFile@Scaleform@@UEAAHPEAVFile@2@H@Z
?CreateWaitableIncrement@Semaphore@Scaleform@@QEAAPEAVWaitable@2@H@Z
?Destroy@System@GFx@Scaleform@@SAXXZ
?Destroy@System@Scaleform@@SAXXZ
?DoLock@Mutex@Scaleform@@QEAAXXZ
?EncloseTransform@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Rect@M@23@AEBV423@@Z
?EncloseTransform@?$Matrix3x4@M@Render@Scaleform@@QEBA?AV?$Rect@M@23@AEBV423@@Z
?EncloseTransform@?$Matrix3x4@M@Render@Scaleform@@QEBAXPEAV?$Rect@M@23@AEBV423@@Z
?EncloseTransformHomogeneous@?$Matrix4x4@M@Render@Scaleform@@QEBAXPEAV?$Rect@M@23@AEBV423@@Z
?Exit@Thread@Scaleform@@UEAAXH@Z
?FinishAllThreads@Thread@Scaleform@@SAXXZ
?Flush@BufferedFile@Scaleform@@UEAA_NXZ
?FlushBuffer@BufferedFile@Scaleform@@IEAAXXZ
?GetAcquireInterface@Event@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetAcquireInterface@Mutex@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetAcquireInterface@Semaphore@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetAcquireInterface@Waitable@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetBitSet@SysAllocWinAPI@Scaleform@@QEBAPEBK_K@Z
?GetCPUCount@Thread@Scaleform@@SAHXZ
?GetDefaultAcquireInterface@DefaultAcquireInterface@Scaleform@@SAPEAV12@XZ
?GetDeterminant@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetErrorCode@SysFile@Scaleform@@UEAAHXZ
?GetExitFlag@Thread@Scaleform@@QEBA_NXZ
?GetFileStat@SysFile@Scaleform@@SA_NPEAUFileStat@2@AEBVString@2@@Z
?GetHSI@Color@Render@Scaleform@@QEBAXPEAH00@Z
?GetHSI@Color@Render@Scaleform@@QEBAXPEAM00@Z
?GetHSV@Color@Render@Scaleform@@QEBAXPEAH00@Z
?GetHSV@Color@Render@Scaleform@@QEBAXPEAM00@Z
?GetLength@BufferedFile@Scaleform@@UEAAHXZ
?GetMaxScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetRotation@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetRotationDouble@?$Matrix2x4@M@Render@Scaleform@@QEBANXZ
?GetScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetThreadState@Thread@Scaleform@@QEBA?AW4ThreadState@12@XZ
?GetXScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetXScaleDouble@?$Matrix2x4@M@Render@Scaleform@@QEBANXZ
?GetYScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetYScaleDouble@?$Matrix2x4@M@Render@Scaleform@@QEBANXZ
?HasMemoryLeaks@System@Scaleform@@2_NA
?Init@System@GFx@Scaleform@@SAXAEBUHeapDesc@MemoryHeap@3@PEAVSysAllocBase@3@@Z
?Init@System@GFx@Scaleform@@SAXPEAVSysAllocBase@3@@Z
?Init@System@Scaleform@@SAXAEBUHeapDesc@MemoryHeap@2@PEAVSysAllocBase@2@@Z
?Init@System@Scaleform@@SAXPEAVSysAllocBase@2@@Z
?IsFinished@Thread@Scaleform@@QEBA_NXZ
?IsLockedByAnotherThread@Mutex@Scaleform@@QEAA_NXZ
?IsSignaled@Event@Scaleform@@UEBA_NXZ
?IsSignaled@Mutex@Scaleform@@UEBA_NXZ
?IsSignaled@Semaphore@Scaleform@@UEBA_NXZ
?IsSignaled@Waitable@Scaleform@@UEBA_NXZ
?IsSuspended@Thread@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix2x4@M@Render@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix3x4@M@Render@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix3x4@N@Render@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix4x4@N@Render@Scaleform@@QEBA_NXZ
?IsValid@SysFile@Scaleform@@UEBA_NXZ
?LGetLength@BufferedFile@Scaleform@@UEAA_JXZ
?LSeek@BufferedFile@Scaleform@@UEAA_J_JH@Z
?LTell@BufferedFile@Scaleform@@UEAA_JXZ
?LoadBuffer@BufferedFile@Scaleform@@IEAAXXZ
?MSleep@Thread@Scaleform@@SA_NI@Z
?MultiplyMatrix@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV123@AEBV?$Matrix2x4@M@23@@Z
?MultiplyMatrix@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Matrix2x4@M@23@AEBV123@@Z
?MultiplyMatrix@?$Matrix3x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV123@AEBV?$Matrix2x4@M@23@@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV123@AEBV?$Matrix3x4@M@23@@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV?$Matrix2x4@M@23@AEBV123@@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV?$Matrix3x4@M@23@AEBV123@@Z
?MultiplyMatrix@?$Matrix4x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix_NonOpt@?$Matrix3x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix_NonOpt@?$Matrix4x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?Notify@WaitCondition@Scaleform@@QEAAXXZ
?NotifyAll@WaitCondition@Scaleform@@QEAAXXZ
?ObtainSemaphore@Semaphore@Scaleform@@QEAA_NHI@Z
?OnExit@Thread@Scaleform@@UEAAXXZ
?Open@SysFile@Scaleform@@QEAA_NAEBVString@2@HH@Z
?OrthoOffCenterLH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMM@Z
?OrthoOffCenterRH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMM@Z
?PerspectiveOffCenterLH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMMM@Z
?PerspectiveOffCenterRH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMMM@Z
?Prepend@?$Matrix2x4@M@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?PulseEvent@Event@Scaleform@@QEAAXXZ
?Read@BufferedFile@Scaleform@@UEAAHPEAEH@Z
?Release@HandlerArray@Waitable@Scaleform@@QEAAXXZ
?Release@RefCountImpl@Scaleform@@QEAAXXZ
?Release@RefCountNTSImpl@Scaleform@@QEBAXXZ
?ReleaseSemaphore@Semaphore@Scaleform@@QEAA_NH@Z
?RemoveWaitHandler@Waitable@Scaleform@@QEAA_NP6AXPEAX@Z0@Z
?ResetEvent@Event@Scaleform@@QEAAXXZ
?Resume@Thread@Scaleform@@QEAA_NXZ
?Run@Thread@Scaleform@@UEAAHXZ
?Seek@BufferedFile@Scaleform@@UEAAHHH@Z
?SetBufferMode@BufferedFile@Scaleform@@IEAA_NW4BufferModeType@12@@Z
?SetEvent@Event@Scaleform@@QEAAXXZ
?SetExitFlag@Thread@Scaleform@@QEAAX_N@Z
?SetHSI@Color@Render@Scaleform@@QEAAXHHH@Z
?SetHSI@Color@Render@Scaleform@@QEAAXMMM@Z
?SetHSV@Color@Render@Scaleform@@QEAAXHHH@Z
?SetHSV@Color@Render@Scaleform@@QEAAXMMM@Z
?SetIdentity@?$Matrix2x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix2x4@N@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix3x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix3x4@N@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix4x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix4x4@N@Render@Scaleform@@QEAAXXZ
?SetInverse@?$Matrix2x4@M@Render@Scaleform@@QEAAXAEBV123@@Z
?SetInverse@?$Matrix2x4@N@Render@Scaleform@@QEAAXAEBV123@@Z
?SetLerp@?$Matrix2x4@M@Render@Scaleform@@QEAAXAEBV123@0M@Z
?SetXScale@?$Matrix2x4@M@Render@Scaleform@@QEAAXM@Z
?SetYScale@?$Matrix2x4@M@Render@Scaleform@@QEAAXM@Z
?SetZero@?$Matrix2x4@M@Render@Scaleform@@QEAAXXZ
?SkipBytes@BufferedFile@Scaleform@@UEAAHH@Z
?Sleep@Thread@Scaleform@@SA_NI@Z
?Start@Thread@Scaleform@@UEAA_NW4ThreadState@12@@Z
?Suspend@Thread@Scaleform@@QEAA_NXZ
?Tell@BufferedFile@Scaleform@@UEAAHXZ
?Transform@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
?Transform@?$Matrix3x4@M@Render@Scaleform@@QEBA?AV?$Point@M@23@AEBV423@@Z
?Transform@?$Matrix3x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
?TransformByInverse@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
?Transpose@?$Matrix3x4@N@Render@Scaleform@@QEAAXXZ
?Transpose@?$Matrix4x4@M@Render@Scaleform@@QEAAXXZ
?Transpose@?$Matrix4x4@N@Render@Scaleform@@QEAAXXZ
?TryAcquire@AcquireInterface@Scaleform@@UEAA_NXZ
?TryAcquire@Event@Scaleform@@UEAA_NXZ
?TryAcquire@Mutex@Scaleform@@UEAA_NXZ
?TryAcquire@Semaphore@Scaleform@@UEAA_NXZ
?TryAcquireCancel@AcquireInterface@Scaleform@@UEAA_NXZ
?TryAcquireCancel@Event@Scaleform@@UEAA_NXZ
?TryAcquireCancel@Mutex@Scaleform@@UEAA_NXZ
?TryAcquireCancel@Semaphore@Scaleform@@UEAA_NXZ
?TryAcquireCommit@AcquireInterface@Scaleform@@UEAA_NXZ
?TryAcquireCommit@Event@Scaleform@@UEAA_NXZ
?TryAcquireCommit@Mutex@Scaleform@@UEAA_NXZ
?TryAcquireCommit@Semaphore@Scaleform@@UEAA_NXZ
?TryLock@Mutex@Scaleform@@QEAA_NXZ
?Unlock@Mutex@Scaleform@@QEAAXXZ
?View@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Point3@M@23@00@Z
?ViewLH@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Point3@M@23@00@Z
?ViewRH@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Point3@M@23@00@Z
?Wait@Event@Scaleform@@QEAA_NI@Z
?Wait@WaitCondition@Scaleform@@QEAA_NPEAVMutex@2@I@Z
?Wait@Waitable@Scaleform@@QEAA_NI@Z
?Write@BufferedFile@Scaleform@@UEAAHPEBEH@Z

Sections

.text
Size: 41.1MB - Virtual size: 41.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.interpr
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17.8MB - Virtual size: 17.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.4MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 707KB - Virtual size: 708KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88aa0caf941cb2c726be6010d8d3eed1

Headers

DLL Characteristics

File Characteristics

Imports

steam_api64

dxgi

ws2_32

amd_ags_x64

fmodex64

fmod_event64

oo2core_6_win64

wldap32

crypt32

advapi32

winmm

bink2w64

kernel32

user32

gdi32

shell32

ole32

oleaut32

imm32

d3d11

d3dx11_43

d3d9

xinput1_3

dinput8

d3dcompiler_43

Exports

Exports

Sections

.text Size: 41.1MB - Virtual size: 41.1MB

.interpr Size: 48KB - Virtual size: 48KB

.rdata Size: 17.8MB - Virtual size: 17.8MB

.data Size: 2.4MB - Virtual size: 4.3MB

.pdata Size: 2.6MB - Virtual size: 2.6MB

.gfids Size: 4KB - Virtual size: 8KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 23KB - Virtual size: 24KB

.reloc Size: 707KB - Virtual size: 708KB

.text
Size: 41.1MB - Virtual size: 41.1MB

.interpr
Size: 48KB - Virtual size: 48KB

.rdata
Size: 17.8MB - Virtual size: 17.8MB

.data
Size: 2.4MB - Virtual size: 4.3MB

.pdata
Size: 2.6MB - Virtual size: 2.6MB

.gfids
Size: 4KB - Virtual size: 8KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 23KB - Virtual size: 24KB

.reloc
Size: 707KB - Virtual size: 708KB