2024-01-01_2e101fa0869ae6d1ad97276acc0feaa4_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-01_2e101fa0869ae6d1ad97276acc0feaa4_ryuk
Size

30.6MB
MD5

2e101fa0869ae6d1ad97276acc0feaa4
SHA1

438b939df33fce2ae670451681ea14f480197efe
SHA256

f1da4fdca748899e9377d65b4f2e70061cfde4195fb3e65d933a98b6dc303716
SHA512

bc2ff1442d525b6c455832347308d5ee52d1a3e74402215ed945d7886745ea5ec007c64697ef18188f2cd5eee9864b0613843fc298ca369af119cd090c15a9c5
SSDEEP

393216:yLYgiPzsINtRuwkiXl8qclkTMnteGzHIY43:z83HH3I

Score

1^/10

Malware Config

Signatures

Files

2024-01-01_2e101fa0869ae6d1ad97276acc0feaa4_ryuk
.exe windows:6 windows x64 arch:x64

982ef8aa8e861cecf134976b4ea10551

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c4:01:7b:1b:bd:dc:18:b6:4e:19:fc:71:dc:12:db
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2019, 00:00

Not After

02/02/2022, 12:00

Subject

SERIALNUMBER=91330000788831167A,CN=NetEase(Hangzhou) Network Co. Ltd.,OU=Game Dept.,O=NetEase(Hangzhou) Network Co. Ltd.,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:7b:a8:b2:a1:09:d5:1c:dc:fb:bf:af:f8:45:38:2d:34:56:38:b3:45:13:07:ec:9a:7f:e7:f6:14:db:17:32
Signer

Actual PE Digest

a6:7b:a8:b2:a1:09:d5:1c:dc:fb:bf:af:f8:45:38:2d:34:56:38:b3:45:13:07:ec:9a:7f:e7:f6:14:db:17:32

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleBaseNameA
EnumProcessModules
GetProcessMemoryInfo

winmm

timeBeginPeriod
timeKillEvent
timeGetTime
timeSetEvent
timeEndPeriod

ws2_32

WSAEnumNetworkEvents
WSACreateEvent
WSASend
WSAWaitForMultipleEvents
WSAEventSelect
WSACloseEvent
freeaddrinfo
getaddrinfo
WSAIoctl
getprotobyname
getservbyname
getservbyport
gethostbyaddr
shutdown
getnameinfo
WSAGetLastError
WSACleanup
WSAStartup
WSARecv
gethostname
ntohs
recv
WSASetLastError
getsockname
inet_ntoa
getpeername
getsockopt
__WSAFDIsSet
accept
bind
closesocket
connect
ioctlsocket
htonl
htons
inet_addr
listen
ntohl
recvfrom
select
send
sendto
setsockopt
gethostbyname
socket

kernel32

DeleteCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
CreateSemaphoreA
SetThreadAffinityMask
GetSystemInfo
ResumeThread
SuspendThread
SetThreadPriority
GetCurrentThread
Sleep
CreateEventA
CreateMutexA
GetLocalTime
TerminateThread
SetDllDirectoryA
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
ResetEvent
SetEvent
RaiseException
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleHandleA
GetProcessHeap
VerSetConditionMask
VerifyVersionInfoW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WaitForMultipleObjects
SleepEx
lstrcpynA
lstrcmpA
GetModuleHandleExA
FindFirstFileExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
HeapQueryInformation
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
QueryPerformanceFrequency
SetErrorMode
OutputDebugStringA
WriteFile
SetEnvironmentVariableA
LoadLibraryA
GetProcAddress
FreeLibrary
WriteProcessMemory
GetVersionExA
GetCurrentThreadId
ExitProcess
GetCurrentProcessId
GetCurrentProcess
SetUnhandledExceptionFilter
CloseHandle
CreateFileA
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
HeapReAlloc
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
UnlockFileEx
GetTempPathW
GetConsoleMode
GetTimeZoneInformation
SetFilePointerEx
WriteConsoleW
SetStdHandle
GetModuleHandleExW
ExitThread
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
RtlUnwindEx
RtlPcToFileHeader
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
UnregisterWait
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
CreateTimerQueue
GetStartupInfoW
IsDebuggerPresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
IsProcessorFeaturePresent
TryEnterCriticalSection
GetExitCodeThread
WaitForSingleObjectEx
InitializeConditionVariable
IsThreadAFiber
SwitchToFiber
CreateFiberEx
ConvertThreadToFiberEx
DeleteFiber
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
SetThreadIdealProcessor
VirtualProtect
GetSystemDefaultLangID
UnlockFile
LockFileEx
LockFile
SignalObjectAndWait
MoveFileExA
FlushFileBuffers
GetTempPathA
PulseEvent
GetStdHandle
FlushViewOfFile
SetFilePointer
GetLocaleInfoA
GetACP
GenerateConsoleCtrlEvent
SystemTimeToFileTime
MoveFileW
MoveFileA
GetSystemTime
GetVersion
CreatePipe
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileType
GetFileAttributesExW
SetProcessAffinityMask
lstrcmpiA
GetCommandLineA
GetProcessTimes
CreateProcessA
OpenProcess
GetProcessIoCounters
MulDiv
FileTimeToSystemTime
CreateToolhelp32Snapshot
Process32First
Process32Next
LocalAlloc
LocalFree
MultiByteToWideChar
GlobalDeleteAtom
GlobalAddAtomA
K32GetModuleFileNameExA
VirtualProtectEx
ReadProcessMemory
WideCharToMultiByte
DuplicateHandle
SetLastError
GetVersionExW
Process32FirstW
Process32NextW
Module32First
Module32Next
ReadFile
DeviceIoControl
CopyFileA
GetExitCodeProcess
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
CreateFileMappingA
OpenFileMappingA
FormatMessageA
GetLogicalDriveStringsA
QueryDosDeviceA
GetFileSize
GetDiskFreeSpaceA
WinExec
VirtualQuery
GetPrivateProfileStringA
GetTickCount
TerminateProcess
RtlCaptureContext
GetEnvironmentVariableA
GetFileAttributesA
CreateThread
GetCurrentDirectoryA
GetProcessAffinityMask
GlobalMemoryStatusEx
SetPriorityClass
GetThreadPriority
GetLastError
SetFileAttributesA
RemoveDirectoryA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateDirectoryA
GetFileAttributesExA
FindNextFileW
FindFirstFileW
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetCurrentDirectoryA
SetEnvironmentVariableW
GlobalSize
SetConsoleCtrlHandler
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapFree
HeapAlloc
GetFullPathNameA
IsDBCSLeadByte
GetFileInformationByHandle
GetConsoleOutputCP
GetConsoleCP
OutputDebugStringW
SetEndOfFile
LoadLibraryW
lstrlenW
GetFileAttributesW
ExpandEnvironmentStringsW
SwitchToThread
SetThreadExecutionState
GetModuleHandleW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
GetCommandLineW
CreateEventW

user32

FlashWindowEx
SwitchToThisWindow
RegisterClassW
UnregisterClassW
CreateWindowExW
GetWindowPlacement
SetWindowPlacement
IsZoomed
GetMenu
DestroyMenu
GetWindowTextW
AdjustWindowRect
GetClassLongPtrA
EnumDisplayDevicesA
ChangeDisplaySettingsExW
EnumDisplaySettingsA
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoA
CharPrevA
GetMessageA
EnumClipboardFormats
GetClipboardFormatNameA
BeginPaint
EndPaint
InvalidateRect
GetWindowTextLengthA
SetClipboardData
FlashWindow
LoadCursorA
EnumWindows
FindWindowA
GetWindowLongA
FillRect
GetWindowRect
GetClientRect
SetWindowTextA
ReleaseDC
GetDC
GetForegroundWindow
UpdateWindow
GetSystemMetrics
KillTimer
SetTimer
ReleaseCapture
SetCapture
keybd_event
GetKeyboardState
SetFocus
IsClipboardFormatAvailable
GetClipboardData
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
OpenClipboard
IsIconic
GetFocus
SetRect
GetWindow
FindWindowExA
GetWindowThreadProcessId
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
WaitMessage
PeekMessageA
DispatchMessageA
TranslateMessage
MessageBoxA
IsWindow
SendMessageA
EnumChildWindows
GetRawInputData
LoadIconA
ShowCursor
SetCursorPos
GetCursorPos
ClientToScreen
ScreenToClient
wsprintfW
PostMessageA
SetLayeredWindowAttributes
GetKeyState
SetActiveWindow
SetForegroundWindow
SetWindowLongA
GetWindowLongPtrA
SetWindowLongPtrA
SystemParametersInfoA
RegisterRawInputDevices
SetCursor
ClipCursor
PtInRect
CreateIconIndirect
ActivateKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayout
DestroyIcon
GetIconInfo
BringWindowToTop
ToAscii
MapVirtualKeyA
SetWindowsHookExA
GetDesktopWindow
UnhookWindowsHookEx
CallNextHookEx
GetParent
RegisterHotKey
UnregisterHotKey
GetClassNameA
IsWindowVisible
GetWindowTextA
EmptyClipboard

gdi32

RealizePalette
GetStockObject
GetDIBits
GetDeviceCaps
DeleteDC
CreateDCA
CreateCompatibleDC
EnumFontFamiliesExA
CreateBitmap
DeleteObject
SelectObject
SelectPalette
CreateCompatibleBitmap
DeleteEnhMetaFile
PlayEnhMetaFile
SetEnhMetaFileBits
SetWinMetaFileBits
CreateDIBSection
GdiFlush
CreatePalette
GetSystemPaletteEntries
StretchBlt
StretchDIBits
SetDIBColorTable
GetTextMetricsW
GetKerningPairsW
GetObjectA
GetGlyphOutlineW
EnumFontFamiliesExW
CreateFontW
BitBlt

advapi32

RegCloseKey
OpenProcessToken
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
LookupAccountSidA
GetUserNameA
RegEnumValueA
RegOpenKeyA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegConnectRegistryA
RegCreateKeyA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueA
RegSaveKeyA
RegQueryValueA
RegQueryInfoKeyA
RegLoadKeyA
RegFlushKey
RegEnumKeyExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA

shell32

CommandLineToArgvW
ExtractIconW
SHGetSpecialFolderPathA
SHGetFileInfoA
ShellExecuteW
ShellExecuteExA
ShellExecuteA
ExtractIconA

ole32

OleDraw
OleSetContainedObject
OleCreate
CoCreateGuid
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitialize

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo

pdh

PdhAddCounterA
PdhCollectQueryData
PdhCloseQuery
PdhGetFormattedCounterValue
PdhOpenQueryA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

iphlpapi

IcmpSendEcho2
IcmpCreateFile
GetAdaptersInfo

d3dcompiler_46

D3DCompileFromFile
D3DGetBlobPart
D3DReflect
D3DCompile

avifil32

AVIStreamSetFormat
AVIStreamRelease
AVIFileCreateStreamA
AVIFileOpenA
AVIFileRelease
AVIFileExit
AVIFileInit
AVIStreamWrite

fmodex64

?addDSP@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@PEAPEAVDSPConnection@2@@Z
?getBypass@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getNumDrivers@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?setDriver@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setHardwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
?createDSPByType@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PEAPEAVDSP@2@@Z
?setAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?getAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?setSpeakerMode@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?setCallback@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_SYSTEM@@W4FMOD_SYSTEM_CALLBACKTYPE@@PEAX2@Z@Z
?getVersion@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getUserData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?setBypass@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?remove@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unlock@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX0II@Z
?lock@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEAPEAX0PEAI1@Z
?recordStop@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?recordStart@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAVSound@2@_N@Z
?getRecordPosition@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAI@Z
?setParameter@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?getRecordNumDrivers@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?addDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@PEAPEAVDSPConnection@2@@Z
?createDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_DSP_DESCRIPTION@@PEAPEAVDSP@2@@Z
?getSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAW4FMOD_SOUND_FORMAT@@00PEAW4FMOD_DSP_RESAMPLER@@0@Z
?getUserData@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?setUserData@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setMode@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?isPlaying@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?set3DAttributes@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@0@Z
?setCallback@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_CHANNEL@@W4FMOD_CHANNEL_CALLBACKTYPE@@PEAX2@Z@Z
?getPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?setPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?setMute@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getVolume@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?setVolume@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getPaused@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?setPaused@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?stop@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getOpenState@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_OPENSTATE@@PEAIPEA_N2@Z
?getLength@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?playSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PEAVSound@2@_NPEAPEAVChannel@2@@Z
?createStream@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
FMOD_Channel_GetUserData
?setFileSystem@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEBDHPEAIPEAPEAX2@ZP6A?AW43@PEAX4@ZP6A?AW43@44I14@ZP6A?AW43@4I4@ZP6A?AW43@PEAUFMOD_ASYNCREADINFO@@4@Z5H@Z

fmod_event64

?getInfo@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAPEADPEAUFMOD_EVENT_INFO@@@Z
?getRange@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM0@Z
?getUserData@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?setUserData@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?getCategory@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVEventCategory@2@@Z
?setCallback@Event@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_EVENT@@W4FMOD_EVENT_CALLBACKTYPE@@PEAX22@Z2@Z
?getProject@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventProject@2@@Z
?load@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_EVENT_LOADINFO@@PEAPEAVEventProject@2@@Z
?getMusicSystem@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVMusicSystem@2@@Z
?getSystemObject@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?getVersion@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?update@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?init@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HIPEAXI@Z
FMOD_EventSystem_Create
?getProperty@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAX_N@Z
?setValue@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getVolume@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?setVolume@Event@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getParameter@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventParameter@2@@Z
?get3DListenerAttributes@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_VECTOR@@000@Z
?keyOff@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getParameterByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVEventParameter@2@@Z
?setReverbAmbientProperties@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_REVERB_PROPERTIES@@@Z
?createReverb@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVEventReverb@2@@Z
?getNumReverbPresets@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getReverbPresetByIndex@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_REVERB_PROPERTIES@@PEAPEAD@Z
?getReverbPreset@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_REVERB_PROPERTIES@@PEAH@Z
?getCategory@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventCategory@2@@Z
?release@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getParentGroup@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVEventGroup@2@@Z
?release@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N0@Z
?set3DListenerAttributes@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_VECTOR@@000@Z
?getEventBySystemID@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEAPEAVEvent@2@@Z
?setPropertyByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAX_N@Z
?getPropertyByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAX_N@Z
?stop@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?start@Event@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?set3DAttributes@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@00@Z
?getState@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getGroup@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD_NPEAPEAVEventGroup@2@@Z

libeay32

ord1653
ord785
ord2253
ord2254
ord2201
ord229
ord222
ord3205
ord1959
ord1178
ord2870
ord1214
ord648
ord649
ord566
ord567
ord578
ord576
ord657
ord653
ord656
ord585
ord857
ord641
ord3212
ord1870
ord3050
ord1161
ord2442
ord7
ord815
ord2075
ord2023
ord52
ord93
ord181
ord4346
ord4334
ord197
ord1804
ord1
ord2
ord909
ord2144
ord1654
ord223
ord227
ord1961
ord2081
ord400
ord95
ord88
ord76
ord66
ord78
ord464
ord42
ord46
ord484
ord497
ord486
ord117
ord161
ord150
ord493
ord811

ssleay32

ord108
ord45
ord6
ord58
ord117
ord111
ord170
ord78
ord96
ord86
ord82
ord183
ord155
ord141
ord15
ord48
ord75
ord21
ord11
ord61
ord74
ord222
ord24
ord88
ord63
ord87
ord77
ord130
ord129
ord128
ord127
ord8
ord125
ord72
ord12

imm32

ImmSimulateHotKey
ImmIsIME
ImmGetIMEFileNameA
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringA
ImmGetCandidateListA
ImmGetConversionStatus
ImmGetCompositionWindow
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetDescriptionA
ImmGetContext

shlwapi

SHGetValueA
PathMatchSpecA
PathFileExistsA
PathCanonicalizeA

d3dx9_43

D3DXMatrixRotationAxis
D3DXQuaternionToAxisAngle
D3DXQuaternionMultiply
D3DXQuaternionInverse
D3DXPlaneTransform
D3DXGetShaderSize
D3DXCreateBuffer
D3DXGetShaderConstantTableEx
D3DXCreateEffectFromFileA
D3DXCreateEffect
D3DXCreateEffectCompilerFromFileA
D3DXVec4Normalize
D3DXMatrixRotationYawPitchRoll
D3DXMatrixRotationX
D3DXMatrixOrthoOffCenterLH
D3DXMatrixRotationY
D3DXMatrixScaling
D3DXQuaternionSlerp
D3DXQuaternionRotationMatrix
D3DXMatrixRotationQuaternion
D3DXMatrixTranslation
D3DXVec3Normalize
D3DXMatrixInverse
D3DXVec3TransformNormal
D3DXVec3Transform
D3DXMatrixOrthoLH
D3DXMatrixMultiply
D3DXVec3TransformCoord
D3DXQuaternionRotationAxis
D3DXMatrixTranspose
D3DXMatrixLookAtLH
D3DXVec3CatmullRom
D3DXMatrixRotationZ
D3DXCreateTextureFromFileExA
D3DXVec4Transform
D3DXMatrixPerspectiveFovLH
D3DXSaveTextureToFileA
D3DXQuaternionNormalize
D3DXMatrixDeterminant
D3DXQuaternionSquadSetup
D3DXQuaternionSquad
D3DXVec2CatmullRom
D3DXSHEvalDirection
D3DXMatrixDecompose
D3DXFloat16To32Array

d3d9

D3DPERF_SetRegion

d3dx11_43

D3DX11SaveTextureToFileW
D3DX11GetImageInfoFromMemory
D3DX11CreateTextureFromFileA
D3DX11CreateTextureFromMemory
D3DX11LoadTextureFromTexture
D3DX11SaveTextureToFileA
D3DX11SaveTextureToMemory
D3DX11GetImageInfoFromFileA

powrprof

CallNtPowerInformation

dinput8

DirectInput8Create

wldap32

ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord301

gdiplus

GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipCloneBrush
GdipBitmapLockBits
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipBitmapUnlockBits
GdipDrawImagePointRectI
GdipGraphicsClear
GdipSetPageUnit
GdipSetTextRenderingHint
GdipSetCompositingMode
GdipDeleteGraphics
GdipBitmapGetPixel
GdipDeleteBrush

vmprotectsdk64

VMProtectIsValidImageCRC
VMProtectEnd
VMProtectBeginVirtualization
VMProtectIsVirtualMachinePresent
VMProtectIsDebuggerPresent
VMProtectIsProtected

comdlg32

GetOpenFileNameA

oleaut32

SysAllocString
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysFreeString
GetErrorInfo

binkw64

BinkGetFrameBuffersInfo
BinkDoFrame
BinkNextFrame
BinkWait
BinkAllocateFrameBuffers
BinkUtilFree
BinkUtilMalloc
BinkRegisterFrameBuffers
BinkOpen
BinkOpenDirectSound
BinkSetSoundSystem
BinkSetOSFileCallbacks
BinkShouldSkip
BinkClose

Exports

Exports

??0System@Scaleform@@QEAA@AEBUHeapDesc@MemoryHeap@1@PEAVSysAllocBase@1@@Z
??0System@Scaleform@@QEAA@PEAVSysAllocBase@1@@Z
??1AcquireInterface@Scaleform@@UEAA@XZ
??1DefaultAcquireInterface@Scaleform@@UEAA@XZ
??1System@Scaleform@@QEAA@XZ
??_FEvent@Scaleform@@QEAAXXZ
??_FMutex@Scaleform@@QEAAXXZ
??_FSemaphore@Scaleform@@QEAAXXZ
??_FSysAllocPagedMalloc@Scaleform@@QEAAXXZ
??_FSysAllocStatic@Scaleform@@QEAAXXZ
??_FSysAllocWinAPI@Scaleform@@QEAAXXZ
??_FSystem@Scaleform@@QEAAXXZ
??_FThread@Scaleform@@QEAAXXZ
?GetXScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetYScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?Init@System@GFx@Scaleform@@SAXPEAVSysAllocBase@3@@Z
?Init@System@Scaleform@@SAXPEAVSysAllocBase@2@@Z
?Prepend@?$Matrix2x4@M@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?SetIdentity@?$Matrix2x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix3x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix4x4@M@Render@Scaleform@@QEAAXXZ
?SetInverse@?$Matrix2x4@M@Render@Scaleform@@QEAAXAEBV123@@Z
?Transform@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
?TransformByInverse@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
NvOptimusEnablement
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 18.9MB - Virtual size: 18.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 556KB - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

982ef8aa8e861cecf134976b4ea10551

Code Sign

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

09:c4:01:7b:1b:bd:dc:18:b6:4e:19:fc:71:dc:12:dbCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

a6:7b:a8:b2:a1:09:d5:1c:dc:fb:bf:af:f8:45:38:2d:34:56:38:b3:45:13:07:ec:9a:7f:e7:f6:14:db:17:32Signer

Headers

DLL Characteristics

File Characteristics

Imports

psapi

winmm

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

setupapi

pdh

version

iphlpapi

d3dcompiler_46

avifil32

fmodex64

fmod_event64

libeay32

ssleay32

imm32

shlwapi

d3dx9_43

d3d9

d3dx11_43

powrprof

dinput8

wldap32

gdiplus

vmprotectsdk64

comdlg32

oleaut32

binkw64

Exports

Exports

Sections

.text Size: 18.9MB - Virtual size: 18.9MB

.rodata Size: 12KB - Virtual size: 12KB

.rotext Size: 116KB - Virtual size: 115KB

.rdata Size: 8.2MB - Virtual size: 8.2MB

.data Size: 1.6MB - Virtual size: 3.1MB

.pdata Size: 1.1MB - Virtual size: 1.1MB

.tls Size: 16KB - Virtual size: 16KB

.gfids Size: 3KB - Virtual size: 2KB

_RDATA Size: 12KB - Virtual size: 11KB

.rsrc Size: 556KB - Virtual size: 556KB

.reloc Size: 211KB - Virtual size: 211KB

61:20:4d:b4:00:00:00:00:00:27
Certificate

09:c4:01:7b:1b:bd:dc:18:b6:4e:19:fc:71:dc:12:db
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

a6:7b:a8:b2:a1:09:d5:1c:dc:fb:bf:af:f8:45:38:2d:34:56:38:b3:45:13:07:ec:9a:7f:e7:f6:14:db:17:32
Signer

.text
Size: 18.9MB - Virtual size: 18.9MB

.rodata
Size: 12KB - Virtual size: 12KB

.rotext
Size: 116KB - Virtual size: 115KB

.rdata
Size: 8.2MB - Virtual size: 8.2MB

.data
Size: 1.6MB - Virtual size: 3.1MB

.pdata
Size: 1.1MB - Virtual size: 1.1MB

.tls
Size: 16KB - Virtual size: 16KB

.gfids
Size: 3KB - Virtual size: 2KB

_RDATA
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 556KB - Virtual size: 556KB

.reloc
Size: 211KB - Virtual size: 211KB