noita[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

noita.exe
Size

14.6MB
MD5

f4e3bcf98a3f78552757fd63d76de6e8
SHA1

253e1c0f0059d2a509c23bbc2de11ad662d0fcb2
SHA256

946f510656cc32a84faa8305e2e5f48722c13b1a9b6022e27170327459bd1510
SHA512

976edddde60d936d80e3ff6a6f97b9a7ad65d5ac22720aadd8caf413d852ef9d5e290dece210ae66d0441b6ad57f10c95f6d00259c7134a54a653c3f560c35ef
SSDEEP

196608:0MiCBCvWthi0mU6GoUWIGexLM7MTaP98CI+HSkOOu7:0Mzk8higBoFwM7M2XI+Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
noita.exe

Files

noita.exe
.exe windows:6 windows x86 arch:x86

b3dc576a8603ea95588a30231257f0e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\NollaGames\FallingEverything\Build\VC12\ReleaseUnity\falling_everything.pdb

Imports

kernel32

OpenProcess
GetLastError
SetLastError
CloseHandle
ResumeThread
GetThreadContext
SetThreadContext
VirtualQuery
GetCurrentProcess
GetCurrentThread
VirtualFree
FlushInstructionCache
VirtualAlloc
VirtualProtect
GetCurrentThreadId
SuspendThread
FreeLibrary
GetProcAddress
CreateProcessW
HeapReAlloc
K32GetProcessMemoryInfo
FindFirstChangeNotificationW
HeapAlloc
QueryPerformanceCounter
HeapFree
IsProcessorFeaturePresent
MultiByteToWideChar
GetLocalTime
FindNextChangeNotification
GetSystemInfo
WaitForMultipleObjects
QueryPerformanceFrequency
GetVersionExA
GetCurrentProcessId
GetSystemTime
FindFirstFileW
SystemTimeToTzSpecificLocalTime
MoveFileExW
GetFileAttributesA
FileTimeToSystemTime
CreateDirectoryA
GetCurrentDirectoryW
CopyFileA
FindClose
LoadLibraryA
FindNextFileW
DeleteFileW
GetCommandLineW
GetSystemTimeAsFileTime
IsDebuggerPresent
DecodePointer
EncodePointer

user32

GetActiveWindow

lua51

luaopen_bit
setprogdir
pushnexttemplate
luaL_unref
luaL_loadstring
lj_cf_ffi_clib___newindex
lj_cf_debug_getupvalue
lj_cf_package_require
ffi_checkint
luaL_ref
lj_cf_ffi_offsetof
lj_cf_ffi_fill
io_stdfile
mksymname
lua_topointer
lua_rawseti
lua_pushlightuserdata
lj_cf_debug_sethook
luaopen_debug
lua_createtable
searchpath
lj_cf_debug_getinfo
lj_cf_ffi_meta___pairs
lj_cf_os_setlocale
lj_cf_debug_upvalueid
ll_load
lua_rawequal
lj_cf_os_time
luaL_checkstack
lj_cf_ffi_meta___call
lua_remove
lj_cf_package_searchpath
lj_cf_ffi_meta___unm
lj_cf_ffi_meta___eq
lj_cf_package_unloadlib
lj_cf_ffi_alignof
lj_cf_debug_setlocal
luaopen_jit
lj_cf_ffi_meta___len
lj_cf_ffi_meta___index
lj_cf_ffi_gc
ffi_pairs
lua_getfield
setpath
lj_cf_package_loader_c
lj_cf_ffi_string
lj_cf_ffi_meta___mod
io_file_new
io_file_close
lua_setfield
lua_pushcclosure
lj_cf_ffi_meta___concat
io_file_read
lj_cf_ffi_cast
lua_pcall
lj_cf_ffi_typeof
lj_cf_ffi_meta___pow
ffi_checkcdata
lj_cf_ffi_callback_free
luaopen_math
io_tofile
io_file_iter
lj_cf_ffi_meta___newindex
lua_getstack
io_file_readnum
findfile
lj_cf_os_difftime
lj_cf_ffi_load
lua_getinfo
lua_pushnil
lj_cf_ffi_clib___index
lj_cf_debug_setfenv
ffi_index_meta
lj_cf_ffi_meta___ipairs
lj_cf_os_exit
lj_cf_debug_debug
luaopen_table
lj_cf_ffi_meta___le
ll_sym
lj_cf_ffi_metatype
lj_cf_package_loader_croot
ffi_checkptr
lua_pushlstring
lj_cf_ffi_callback_set
luaopen_package
ffi_clib_index
luaopen_os
lua_insert
lua_replace
lua_concat
luaopen_io
lj_cf_os_remove
unmakemask
lua_pushfstring
ffi_finalizer
luaL_loadbufferx
io_file_open
ll_register
setfenv
io_file_readline
lj_cf_debug_getlocal
lj_cf_package_loader_preload
ll_loadfunc
lua_pushvalue
io_file_write
lj_cf_ffi_meta___div
ffi_register_module
lj_cf_ffi_cdef
lj_cf_ffi_sizeof
makemask
lj_cf_os_execute
lua_close
luaL_openlibs
lj_cf_os_clock
lj_cf_ffi_copy
lj_cf_ffi_meta___lt
lj_cf_os_rename
ffi_arith
debug_getupvalue
lj_cf_debug_getregistry
lj_cf_debug_traceback
lj_cf_os_tmpname
lj_cf_debug_upvaluejoin
lj_cf_os_getenv
luaopen_base
io_tofilep
lua_type
lua_tonumber
lua_pushinteger
lua_pushstring
lj_cf_ffi_new
lua_typename
lj_cf_debug_getmetatable
lj_cf_debug_setmetatable
lj_cf_package_loadlib
lj_cf_ffi_istype
lj_cf_ffi_meta___mul
dooptions
loaderror
io_file_readlen
pusherror
hookf
luaopen_ffi
lj_cf_package_module
lj_cf_ffi_meta___sub
lj_cf_package_loader_lua
lua_gettop
lua_settop
lua_tointeger
lua_isstring
lua_toboolean
lua_pushboolean
lj_cf_ffi_meta___add
lj_cf_ffi_errno
lj_cf_ffi_meta___tostring
modinit
luaL_newstate
lua_checkstack
lua_pushnumber
lua_tolstring
io_file_readall
lj_cf_ffi_abi
lj_cf_debug_getfenv
lj_cf_package_seeall
lua_call
lua_next
lj_cf_os_date
lua_rawgeti
luaopen_string
lj_cf_debug_gethook
lj_cf_debug_setupvalue

sdl2

SDL_GetColorKey
SDL_JoystickGetButton
SDL_JoystickNumButtons
SDL_Init
SDL_GL_SetSwapInterval
SDL_JoystickEventState
SDL_GetWindowPosition
SDL_GL_SwapWindow
SDL_SetWindowFullscreen
SDL_GetWindowDisplayIndex
SDL_GetCurrentDisplayMode
SDL_HapticRumbleInit
SDL_CreateWindow
SDL_GetDisplayMode
SDL_CreateColorCursor
SDL_PollEvent
SDL_JoystickNameForIndex
SDL_wcslen
SDL_iconv_string
SDL_malloc
SDL_free
SDL_SetMainReady
SDL_ShowSimpleMessageBox
SDL_isspace
SDL_GameControllerGetButton
SDL_JoystickClose
SDL_ShowCursor
SDL_HapticOpen
SDL_GameControllerGetJoystick
SDL_NumJoysticks
SDL_SetWindowIcon
SDL_GL_CreateContext
SDL_SetWindowSize
SDL_LoadBMP_RW
SDL_GetKeyName
SDL_SetCursor
SDL_GameControllerEventState
SDL_JoystickOpen
SDL_Delay
SDL_FreeCursor
SDL_IsGameController
SDL_GameControllerOpen
SDL_HapticRumblePlay
SDL_GetDesktopDisplayMode
SDL_GetError
SDL_SetWindowPosition
SDL_JoystickInstanceID
SDL_GameControllerClose
SDL_GL_SetAttribute
SDL_GetWindowSize
SDL_GameControllerGetAxis
SDL_SetWindowTitle
SDL_Quit
SDL_SetWindowGrab
SDL_JoystickNumAxes
SDL_GetNumDisplayModes
SDL_HapticClose
SDL_GetNumVideoDisplays
SDL_CreateRGBSurfaceFrom
SDL_RWFromFile
SDL_FreeSurface
SDL_CreateRGBSurface
SDL_UpperBlit
SDL_UnlockSurface
SDL_LockSurface
SDL_JoystickGetAxis

shell32

ShellExecuteA
SHGetKnownFolderPath
SHCreateDirectoryExW

comdlg32

GetOpenFileNameA

ole32

CoTaskMemFree

msvcp120

?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Swap_all@_Container_base12@std@@QAEXAAU12@@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?widen@?$ctype@D@std@@QBEDD@Z
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
_Thrd_yield
_Cnd_wait
_Cnd_broadcast
??_7_Facet_base@std@@6B@
_Cnd_unregister_at_thread_exit
_Cnd_register_at_thread_exit
_Thrd_detach
??_7facet@locale@std@@6B@
_Cnd_destroy
_Cnd_signal
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Future_error_map@std@@YAPBDH@Z
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
_Cnd_init
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
_Mtx_init
_Mtx_lock
xtime_get
_Mtx_unlock
_Xtime_diff_to_millis2
_Thrd_sleep
_Thrd_current
_Thrd_join
_Mtx_destroy
_Xtime_get_ticks
??0_Pad@std@@QAE@XZ
??1_Pad@std@@QAE@XZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?_Release@_Pad@std@@QAEXXZ
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_equal
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_BADOFF@std@@3_JB
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z

msvcr120

??1exception@std@@UAE@XZ
memset
memcpy
floor
ceil
_setjmp3
_libm_sse2_tan_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_libm_sse2_log10_precise
_libm_sse2_cos_precise
_libm_sse2_acos_precise
__RTDynamicCast
__CxxFrameHandler3
_CxxThrowException
_CIfmod
_CIatan2
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
_commode
_fmode
_acmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_findfirst64i32
strftime
srand
fprintf
strtol
__iob_func
ldexp
strncmp
toupper
lroundf
fminf
strtod
_dtest
vsprintf
?_Yield@_Context@details@Concurrency@@SAXXZ
?_GetConcurrency@details@Concurrency@@YAIXZ
exit
_time64
fclose
wcscpy_s
?__ExceptionPtrCreate@@YAXPAX@Z
fseek
_localtime64
strtoul
_aligned_malloc
round
strcspn
_getcwd
mbstowcs_s
fwrite
_aligned_free
memcpy_s
?__ExceptionPtrAssign@@YAXPAXPBX@Z
rand
__RTtypeid
_lock_file
roundf
setvbuf
fopen
printf
fsetpos
log2
tolower
localeconv
fgetc
_errno
_popen
atoi
fflush
_fseeki64
fgetpos
?__ExceptionPtrDestroy@@YAXPAX@Z
ungetc
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
_pclose
_unlock_file
_strtoui64
??9type_info@@QBE_NABV0@@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
fputc
?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ
?wait@Concurrency@@YAXI@Z
?terminate@@YAXXZ
memchr
??8type_info@@QBE_NABV0@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
sprintf_s
realloc
malloc
free
longjmp
_vsnprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
_except1

ws2_32

send
closesocket
socket
recv
WSACleanup
setsockopt
htons
WSAGetLastError
WSAStartup
connect
ioctlsocket
gethostbyname

fmod

?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?setDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@IH@Z
?setSoftwareChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?getMasterChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z

fmodstudio

?getEventList@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVEventDescription@23@HPAH@Z
?isValid@EventInstance@Studio@FMOD@@QBG_NXZ
?setVolume@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DAttributes@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_3D_ATTRIBUTES@@@Z
?setPaused@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?start@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?stop@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?getEventCount@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?release@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setParameterByName@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDM_N@Z
?setCallback@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@IPAUFMOD_STUDIO_EVENTINSTANCE@@PAX@ZI@Z
?getUserData@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAX@Z
?setUserData@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setVolume@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setPaused@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setCallback@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@PAUFMOD_STUDIO_SYSTEM@@IPAX1@ZI@Z
?loadBankFile@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAPAVBank@23@@Z
?setListenerAttributes@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_3D_ATTRIBUTES@@PBUFMOD_VECTOR@@@Z
?getBus@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAPAVBus@23@@Z
?getEvent@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAPAVEventDescription@23@@Z
?update@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getCoreSystem@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAV13@@Z
?isValid@System@Studio@FMOD@@QBG_NXZ
?release@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?initialize@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HIIPAX@Z
?create@System@Studio@FMOD@@SG?AW4FMOD_RESULT@@PAPAV123@I@Z
?loadSampleData@EventDescription@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createInstance@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVEventInstance@23@@Z
?isSnapshot@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?getMaximumDistance@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?getMinimumDistance@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?getLength@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getUserProperty@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAUFMOD_STUDIO_USER_PROPERTY@@@Z
?getTimelinePosition@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getPath@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PADHPAH@Z

steam_api

SteamAPI_UnregisterCallback
SteamAPI_RunCallbacks
SteamAPI_RestartAppIfNecessary
SteamAPI_Shutdown
SteamAPI_GetHSteamUser
SteamAPI_RegisterCallback
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_Init

wininet

InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetConnectA

shlwapi

PathAppendW

winmm

timeBeginPeriod

Exports

Exports

SDL_main

Sections

.text
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 712KB - Virtual size: 860KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 41B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 727KB - Virtual size: 727KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3dc576a8603ea95588a30231257f0e3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

lua51

sdl2

shell32

comdlg32

ole32

msvcp120

msvcr120

ws2_32

fmod

fmodstudio

steam_api

wininet

shlwapi

winmm

Exports

Exports

Sections

.text Size: 10.9MB - Virtual size: 10.9MB

.rdata Size: 2.3MB - Virtual size: 2.3MB

.data Size: 712KB - Virtual size: 860KB

.detourd Size: 512B - Virtual size: 36B

.detourc Size: 14KB - Virtual size: 13KB

.tls Size: 512B - Virtual size: 41B

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 727KB - Virtual size: 727KB

.text
Size: 10.9MB - Virtual size: 10.9MB

.rdata
Size: 2.3MB - Virtual size: 2.3MB

.data
Size: 712KB - Virtual size: 860KB

.detourd
Size: 512B - Virtual size: 36B

.detourc
Size: 14KB - Virtual size: 13KB

.tls
Size: 512B - Virtual size: 41B

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 727KB - Virtual size: 727KB