Streamlabs_OBS[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Streamlabs_OBS.exe
Size

3.5MB
MD5

7e9ca60b02871bf42295b72e33c23839
SHA1

5163913c7a431ff9bb611f37e0418e6177cdd411
SHA256

f8b414454208a3d08a0e14cdd7f65c1aadd44cedb2b00f8b738404d20dd396bd
SHA512

2a7a4e88d22dd6623f4973c0652ed569c79ed7118cd44813262235b75de695866e85afb185ec59aea921cc4deb26712daa5739f237a5f6295ba15987d64f8027
SSDEEP

49152:D2Gn7Tdse8o3zN+RLn36PSAwdxgn1GDaeRbTj2bAuSfSPyIEsLmdiIr:fTdn8ojURji/8+2bj20pfuyamw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Streamlabs_OBS.exe

Files

Streamlabs_OBS.exe
.exe windows:6 windows x64 arch:x64

22a3760bd3ce8e691e81c461fa460fb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Kuba\Desktop\Rive Project\Streamlabs OBS.pdb

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GlobalFree
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
CreateToolhelp32Snapshot
Process32Next
CreateFileA
FlushFileBuffers
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcessId
TerminateProcess
CreateThread
OpenProcess
GlobalUnlock
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
Process32FirstW
Process32NextW
GlobalAlloc
GetCurrentThreadId
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GlobalLock
GetSystemTimeAsFileTime
VirtualAlloc
InitializeSListHead

user32

LoadCursorA
GetWindowThreadProcessId
GetClassNameA
EnumWindows
FindWindowA
GetDesktopWindow
SetWindowLongPtrA
GetWindowLongPtrA
SetWindowLongA
GetWindowLongA
ScreenToClient
ClientToScreen
SetCursor
SetCursorPos
MessageBoxA
GetWindowRect
GetClientRect
GetWindowTextA
GetForegroundWindow
UpdateWindow
SetMenu
GetSystemMetrics
GetCursorPos
SendInput
GetAsyncKeyState
GetKeyState
SetFocus
SetWindowDisplayAffinity
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
ShowWindow
TranslateMessage
DispatchMessageA
PeekMessageA
DestroyWindow
SetWindowPos

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_join
_Thrd_sleep
_Thrd_id
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

imm32

ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlLookupFunctionEntry
ZwOpenKey
ZwClose
ZwQueryValueKey
ZwCreateKey
ZwSetValueKey
RtlCaptureContext
RtlVirtualUnwind

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140

memcmp
__current_exception_context
__std_terminate
strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception
memchr
memcpy
memmove
memset
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm
_get_initial_narrow_environment
_initterm_e
_exit
_set_app_type
_seh_filter_exe
exit
system
_invalid_parameter_noinfo_noreturn
_cexit
_register_thread_local_exe_atexit_callback
_beginthreadex
__p___argc
__p___argv
_c_exit
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
_wfopen
__stdio_common_vsprintf_s
fread
fseek
fclose
__stdio_common_vsscanf
_set_fmode
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
ftell
__stdio_common_vsnprintf_s
fflush

api-ms-win-crt-string-l1-1-0

strncmp
strncpy
wcscpy_s
strcmp

api-ms-win-crt-math-l1-1-0

tanf
atan2
asin
pow
logf
cosf
fmodf
sinf
sqrtf
log
acosf
ceilf
powf
__setusermatherr

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 384KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.0MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22a3760bd3ce8e691e81c461fa460fb1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d11

d3dcompiler_43

kernel32

user32

msvcp140

imm32

dwmapi

ntdll

d3dx11_43

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 384KB - Virtual size: 383KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 3.0MB - Virtual size: 3.1MB

.pdata Size: 15KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 384KB - Virtual size: 383KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 3.0MB - Virtual size: 3.1MB

.pdata
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB