MetroExodus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MetroExodus.exe
Size

25.3MB
MD5

f273b6d45490d8014963f3f7066d648a
SHA1

3b8861ed4602253591b9fee60c93c2d02c68da4e
SHA256

e6831914a2d544451c9ea54d6064580bda4b3de3829331b20deca3016d97d1e7
SHA512

d3cb4e47f45d89a526e62427fd0c3191264bcae315890cfe6bc172efb29c78069cce94f45072fa3c12f646976cd0384f4efb346f3ad18656a90315bdc913ce7b
SSDEEP

393216:6UyzyY6CIK8mBqTbVhPP/sfGfDcH6/GhCYN8S:JEG6IYN9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MetroExodus.exe

Files

MetroExodus.exe
.exe windows:6 windows x64 arch:x64

3ba6f89ddb72fe34def529e5a05d9b2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\SVN\bin_x64\MetroExodus.pdb

Imports

kernel32

TlsAlloc
LoadLibraryExA
TlsFree
TlsGetValue
FileTimeToSystemTime
GetStdHandle
OutputDebugStringA
AllocConsole
WriteConsoleA
SetConsoleTitleA
GetConsoleWindow
Sleep
TlsSetValue
CreateFileA
WriteFile
LoadLibraryW
SetFilePointer
GetThreadId
ProcessIdToSessionId
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
OutputDebugStringW
GetCommandLineA
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
CompareFileTime
GetSystemTimeAsFileTime
GetCurrentProcessId
InitializeSListHead
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CreateEventA
RaiseException
GetVersion
InitializeCriticalSectionEx
GetCurrentThread
SetThreadPriority
LocalAlloc
CreateDirectoryW
SetThreadExecutionState
LoadLibraryA
GlobalUnlock
GlobalLock
GetLocaleInfoEx
FreeLibrary
WaitForMultipleObjects
RtlCaptureContext
GetModuleFileNameA
CreateDirectoryA
GetCurrentDirectoryW
VirtualQuery
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetComputerNameA
ReadFile
GetExitCodeProcess
GetCurrentDirectoryA
SetHandleInformation
CreatePipe
HeapFree
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
SetLastError
TerminateProcess
CreateProcessA
GetCurrentThreadId
GlobalMemoryStatus
GetProcAddress
GetModuleHandleA
HeapAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
SetPriorityClass
GetSystemInfo
SwitchToThread
WaitForSingleObject
ReleaseSemaphore
CloseHandle
CreateSemaphoreA
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
SetProcessWorkingSetSize
GetProcessHeap
HeapCompact
VirtualProtect
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
GetModuleFileNameW
LoadLibraryExW
lstrcmpA
RtlLookupFunctionEntry
ReleaseMutex
GetLastError
IsProcessorFeaturePresent
CreateMutexW

user32

SetDlgItemTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
SetCursorPos
PeekMessageA
TranslateMessage
DispatchMessageA
EndPaint
EnumDisplayDevicesA
BeginPaint
GetClientRect
CreateDialogParamA
LoadBitmapA
EndDialog
EnumDisplayMonitors
SetWindowPos
ClientToScreen
GetWindowThreadProcessId
EnumDisplaySettingsA
MoveWindow
DestroyWindow
ActivateKeyboardLayout
LoadKeyboardLayoutA
GetKeyboardLayout
DefWindowProcA
GetWindowRect
GetAsyncKeyState
PostQuitMessage
ShowWindow
GetRawInputDeviceInfoA
SystemParametersInfoA
GetDoubleClickTime
OpenClipboard
GetWindowLongA
GetClipboardData
CloseClipboard
ShowCursor
SetWindowLongPtrA
GetRawInputDeviceList
SetRect
AdjustWindowRect
LoadIconA
GetMonitorInfoA
CreateWindowExA
MessageBoxA
RegisterClassA
GetCursorPos

advapi32

GetUserNameW
RegSetValueExA
GetUserNameA
RegFlushKey
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA

mmdevapi

ord17

msvcp140

??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Xruntime_error@std@@YAXPEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z

pxfoundation_x64

?snprintf@shdfnd@physx@@YAHPEAD_KPEBDZZ
?getInstance@Foundation@shdfnd@physx@@SAAEAV123@XZ
?stricmp@shdfnd@physx@@YAHPEBD0@Z
?error@Foundation@shdfnd@physx@@QEAAXW4Enum@PxErrorCode@3@PEBDH1ZZ
?decRefCount@Foundation@shdfnd@physx@@SAXXZ
?incRefCount@Foundation@shdfnd@physx@@SAXXZ
?PxDiagonalize@physx@@YA?AVPxVec3@1@AEBVPxMat33@1@AEAVPxQuat@1@@Z
?getAllocator@shdfnd@physx@@YAAEAVPxAllocatorCallback@2@XZ
PxGetFoundation
PxCreateFoundation

physx3_x64

PxRegisterArticulations
PxRegisterHeightFields
PxGetPhysics
PxGetSuggestedCudaDeviceOrdinal
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxBoxGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxSphereGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxCapsuleGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxPlaneGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxConvexMeshGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxTriangleMeshGeometry@2@@Z
?getGeometry@PxShapeGeometryPropertyHelper@physx@@QEBA_NPEBVPxShape@2@AEAVPxHeightFieldGeometry@2@@Z
??0PxMaterialGeneratedInfo@physx@@QEAA@XZ
PxRegisterParticles
??0PxRigidStaticGeneratedInfo@physx@@QEAA@XZ
PxCreateBasePhysics
??0PxArticulationJointGeneratedInfo@physx@@QEAA@XZ
??0PxArticulationGeneratedInfo@physx@@QEAA@XZ
??0PxAggregateGeneratedInfo@physx@@QEAA@XZ
??0PxShapeGeneratedInfo@physx@@QEAA@XZ
??0PxClothFabricGeneratedInfo@physx@@QEAA@XZ
??0PxClothGeneratedInfo@physx@@QEAA@XZ
??0PxParticleFluidGeneratedInfo@physx@@QEAA@XZ
??0PxParticleSystemGeneratedInfo@physx@@QEAA@XZ
??0PxHeightFieldGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxTriangleMeshGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxBoxGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxCapsuleGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxMeshScaleGeneratedInfo@physx@@QEAA@XZ
??0PxConvexMeshGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxSphereGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxArticulationLinkGeneratedInfo@physx@@QEAA@XZ
PxRegisterCloth
PxCreateCudaContextManager
??0PxClothTetherConfigGeneratedInfo@physx@@QEAA@XZ
??0PxHeightFieldDescGeneratedInfo@physx@@QEAA@XZ
??0PxRigidDynamicGeneratedInfo@physx@@QEAA@XZ
??0PxPlaneGeometryGeneratedInfo@physx@@QEAA@XZ
??0PxClothMotionConstraintConfigGeneratedInfo@physx@@QEAA@XZ
??0PxClothStretchConfigGeneratedInfo@physx@@QEAA@XZ

physx3common_x64

?raycast@PxGeometryQuery@physx@@SAIAEBVPxVec3@2@0AEBVPxGeometry@2@AEBVPxTransform@2@MV?$PxFlags@W4Enum@PxHitFlag@physx@@G@2@IPEIAUPxRaycastHit@2@@Z
?findOverlapTriangleMesh@PxMeshQuery@physx@@SAIAEBVPxGeometry@2@AEBVPxTransform@2@AEBVPxTriangleMeshGeometry@2@1PEAIIIAEA_N@Z
?getTriangle@PxMeshQuery@physx@@SAXAEBVPxHeightFieldGeometry@2@AEBVPxTransform@2@IAEAVPxTriangle@2@PEAI3@Z
?findOverlapHeightField@PxMeshQuery@physx@@SAIAEBVPxGeometry@2@AEBVPxTransform@2@AEBVPxHeightFieldGeometry@2@1PEAIIIAEA_N@Z
?sweep@PxGeometryQuery@physx@@SA_NAEBVPxVec3@2@MAEBVPxGeometry@2@AEBVPxTransform@2@12AEAUPxSweepHit@2@V?$PxFlags@W4Enum@PxHitFlag@physx@@G@2@M@Z
?overlap@PxGeometryQuery@physx@@SA_NAEBVPxGeometry@2@AEBVPxTransform@2@01@Z

rpcrt4

UuidCreate

galaxy64

?Utils@api@galaxy@@YAPEAVIUtils@12@XZ
?Shutdown@api@galaxy@@YAXXZ
?User@api@galaxy@@YAPEAVIUser@12@XZ
?Stats@api@galaxy@@YAPEAVIStats@12@XZ
?ProcessData@api@galaxy@@YAXXZ
?Apps@api@galaxy@@YAPEAVIApps@12@XZ
?ListenerRegistrar@api@galaxy@@YAPEAVIListenerRegistrar@12@XZ
?GetError@api@galaxy@@YAPEBVIError@12@XZ
?Init@api@galaxy@@YAXAEBUInitOptions@12@@Z

vcruntime140

memcmp
memset
memcpy
__std_type_info_name
_purecall
strstr
__C_specific_handler
strchr
__std_terminate
strrchr
wcsstr
__CxxFrameHandler3
_CxxThrowException
memmove
__intrinsic_setjmp
longjmp
memchr
wcsrchr

api-ms-win-crt-string-l1-1-0

strcmp
_wcsicmp
tolower
isprint
strncat_s
isspace
strtok
isalpha
wcsncpy
strncpy
_strnicmp
wcsncpy_s
_stricmp
strcat_s
strcpy_s
strncpy_s
wcscat_s
wcscpy_s
wcsncmp
strncmp

api-ms-win-crt-filesystem-l1-1-0

_chdir
_chdrive
_unlink
_findfirst64i32
_findnext64i32
_wunlink
_mkdir
_findclose
_fstat64i32

api-ms-win-crt-heap-l1-1-0

_aligned_free
malloc
_aligned_malloc
free
_heapmin
_set_new_mode
realloc

api-ms-win-crt-stdio-l1-1-0

_wfsopen
__stdio_common_vsscanf
fputs
__p__commode
_set_fmode
__stdio_common_vsnprintf_s
_open_osfhandle
fgets
feof
ferror
__acrt_iob_func
__stdio_common_vfprintf
_read
_close
_write
_lseek
_tell
_open
_filelength
fseek
fwrite
__stdio_common_vswprintf
fopen_s
__stdio_common_vswscanf
__stdio_common_vsprintf
_fseeki64
fread
ftell
__stdio_common_vsprintf_s
fopen
fflush
fclose
__stdio_common_vfprintf_s
_wsopen_dispatch

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_beginthreadex
_crt_atexit
abort
_errno
terminate
_invalid_parameter_noinfo_noreturn
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_cexit
_set_invalid_parameter_handler
_register_onexit_function
_initialize_onexit_table
_c_exit
_control87
_controlfp
_beginthread
_seh_filter_exe
_register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

strtod
_strtoui64
atoi
_ltoa
_itow
strtol
wctob
atof
_itoa
_itoa_s
strtoul
btowc

api-ms-win-crt-math-l1-1-0

pow
round
acosf
asinf
_fdopen
atanf
cosf
acos
tanf
sinh
tan
atan2
expf
logf
log2
modf
__setusermatherr
powf
atan2f
exp
_fpclass
sinf
modff
exp2f
fmodf
atan
cos
fmod
log
log10
log10f
sin
roundf
log2f
ldexp
_dtest

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_time64
_localtime64
_gmtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

select
WSASendTo
getaddrinfo
WSAStartup
getsockname
socket
__WSAFDIsSet
inet_ntoa
WSARecvFrom
ioctlsocket
setsockopt
ntohl
ntohs
WSASetLastError
htonl
htons
WSAGetLastError
WSACleanup
bind
closesocket

winmm

timeGetTime
timeBeginPeriod

anselsdk64

?rotationMatrixVectorsToQuaternion@ansel@@YAXAEBUVec3@nv@@00AEAUQuat@3@@Z
?quaternionToRotationMatrixVectors@ansel@@YAXAEBUQuat@nv@@AEAUVec3@3@11@Z
?setConfiguration@ansel@@YA?AW4SetConfigurationStatus@1@AEBUConfiguration@1@@Z
?updateCamera@ansel@@YAXAEAUCamera@1@@Z

gfesdk

NVGSDK_Highlights_SetScreenshotHighlightAsync
NVGSDK_Highlights_GetNumberOfHighlightsAsync
NVGSDK_Poll
NVGSDK_Highlights_SetVideoHighlightAsync
NVGSDK_Highlights_ConfigureAsync
NVGSDK_Highlights_CloseGroupAsync
NVGSDK_Release
NVGSDK_Highlights_OpenSummaryAsync
NVGSDK_Create
NVGSDK_Highlights_OpenGroupAsync
NVGSDK_RequestPermissionsAsync

gdi32

GetStockObject
SelectObject
DeleteObject
DeleteDC
BitBlt
GetObjectA
CreateCompatibleDC

shell32

SHGetKnownFolderPath
ShellExecuteA

ole32

CoInitializeEx
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoCreateInstance

physx3cooking_x64

PxCreateCooking

dinput8

DirectInput8Create

api-ms-win-crt-utility-l1-1-0

qsort

hid

HidD_GetAttributes
HidP_GetCaps

xinput9_1_0

XInputGetState
XInputSetState

cgsdk.x64_2015

CgSdkSetState
CgSdkSetEventWithKey
CgSdkSetEvent
CgSdkClearStateWithKey
CgSdkClearAllStates
CgSdkClearState
CgSdkClearAllEvents
CgSdkSetStateWithKey
CgSdkSetGame
CgSdkRequestControl
CgSdkGetLastError
CgSdkPerformProtocolHandshake

cuesdk.x64_2015

CorsairSetLedsColorsAsync
CorsairPerformProtocolHandshake
CorsairGetLastError
CorsairGetDeviceCount
CorsairGetDeviceInfo
CorsairGetLedPositions

Exports

Exports

?physx_fps@@YAMXZ
AmdPowerXpressRequestHighPerformance
NVSDK_NGX_D3D12_CreateFeature
NVSDK_NGX_D3D12_EvaluateFeature
NVSDK_NGX_D3D12_GetParameters
NVSDK_NGX_D3D12_GetScratchBufferSize
NVSDK_NGX_D3D12_Init
NVSDK_NGX_D3D12_ReleaseFeature
NVSDK_NGX_D3D12_Shutdown
NvOptimusEnablement

Sections

.text
Size: 16.2MB - Virtual size: 16.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 11.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 954KB - Virtual size: 954KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ba6f89ddb72fe34def529e5a05d9b2e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

mmdevapi

msvcp140

pxfoundation_x64

physx3_x64

physx3common_x64

rpcrt4

galaxy64

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

winmm

anselsdk64

gfesdk

gdi32

shell32

ole32

physx3cooking_x64

dinput8

api-ms-win-crt-utility-l1-1-0

hid

xinput9_1_0

cgsdk.x64_2015

cuesdk.x64_2015

Exports

Exports

Sections

.text Size: 16.2MB - Virtual size: 16.2MB

.rdata Size: 5.8MB - Virtual size: 5.8MB

.data Size: 1.1MB - Virtual size: 11.2MB

.pdata Size: 915KB - Virtual size: 915KB

_RDATA Size: 10KB - Virtual size: 9KB

.rodata Size: 1024B - Virtual size: 816B

.rsrc Size: 336KB - Virtual size: 335KB

.reloc Size: 954KB - Virtual size: 954KB

.text
Size: 16.2MB - Virtual size: 16.2MB

.rdata
Size: 5.8MB - Virtual size: 5.8MB

.data
Size: 1.1MB - Virtual size: 11.2MB

.pdata
Size: 915KB - Virtual size: 915KB

_RDATA
Size: 10KB - Virtual size: 9KB

.rodata
Size: 1024B - Virtual size: 816B

.rsrc
Size: 336KB - Virtual size: 335KB

.reloc
Size: 954KB - Virtual size: 954KB