D:\Hudson\workspace\buildersBK_patch15_b20.bk\games\work\bin\x64\pdb\DyingLightGame_x64_rwdi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c238cd7a0bce2b6b169263051f735d0eb505914762eafadabac9992388fee645.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c238cd7a0bce2b6b169263051f735d0eb505914762eafadabac9992388fee645.exe
Resource
win10v2004-20240226-en
General
-
Target
c238cd7a0bce2b6b169263051f735d0eb505914762eafadabac9992388fee645
-
Size
2.2MB
-
MD5
de4a7e43ad5a5074e5320259632d173a
-
SHA1
df90fbfb684d1654555d1f812ecb33eeba96fedd
-
SHA256
c238cd7a0bce2b6b169263051f735d0eb505914762eafadabac9992388fee645
-
SHA512
aff42275d078c5269d7ca9d6a243140e6526b4e1c78e384832acee5fb5e15dacf54b6693cd3330515e302602d46e02121c971da1970fdba2e3ab8359ebf346fd
-
SSDEEP
12288:InRrjwTaV+gaLWZ7T9YkdeVFBb+BDSkrDXWUf+VMrZjdB:InRb+hLW5T5CvbywojdB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c238cd7a0bce2b6b169263051f735d0eb505914762eafadabac9992388fee645
Files
-
c238cd7a0bce2b6b169263051f735d0eb505914762eafadabac9992388fee645.exe windows:6 windows x64 arch:x64
38bcf4f00ddf4730292b4a5c48a413f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
logger_x64_rwdi
?log_format@logger@core@@YAXW4LogOptions@12@AEBULogCategory@12@AEBULogLevel@12@V?$basic_string_view@DU?$char_traits@D@std@@@std@@V?$basic_format_args@V?$basic_format_context@Vappender@v9@fmt@@D@v9@fmt@@@v9@fmt@@@Z
?log_assert@logger@core@@YAXVsource_location@12@V?$basic_string_view@DU?$char_traits@D@std@@@std@@11@Z
?can_dispatch_log@logger@core@@YA_NAEBULogCategory@12@W4MessageVerbosity@12@@Z
memdump_x64_rwdi
mdFrameRealloc
mdFrameAlloc
filesystem_x64_rwdi
?CrashGetLogFileName@@YA?AV?$temp_string_base@D$0PA@@ttl@@XZ
?_CLogLevelFromId@@YA?AW4TYPE@ELevel@Log@@I@Z
?_CLogCategoryFromLabel@@YA?AV?$string_base@D@ttl@@I@Z
?GenerateDump@@YAHKPEAU_EXCEPTION_POINTERS@@@Z
?SetDumpFunction@@YAXP6A?AW4TYPE@EDumpResult@@KPEAU_EXCEPTION_POINTERS@@@Z@Z
?GetDumpFunction@@YAP6A?AW4TYPE@EDumpResult@@KPEAU_EXCEPTION_POINTERS@@@ZXZ
?WriteFullDump@@YAXKPEAU_EXCEPTION_POINTERS@@V?$string_const@D@ttl@@1_NPEAV?$string_base@D@3@@Z
?join@path@fs@@YA?AV?$temp_string_base@D$0PA@@ttl@@V?$string_const@D@4@0@Z
?normalize@path@fs@@YA?AV?$temp_string_base@D$0PA@@ttl@@V?$string_const@D@4@@Z
?wchar_to_utf8@path@fs@@YA?AV?$temp_string_base@D$0PA@@ttl@@V?$string_const@_W@4@@Z
?utf8_to_wchar@path@fs@@YA?AV?$temp_string_base@_W$0PI@@ttl@@V?$string_const@D@4@@Z
?init@fs@@YA_NV?$string_const@D@ttl@@W4game_type@1@@Z
?shutdown@fs@@YAXXZ
?is_initialized@fs@@YA_NXZ
?mount@fs@@YA_NAEBUmount_path@1@GPEAPEAVCFsMount@@@Z
?exists@fs@@YA_NV?$string_const@D@ttl@@@Z
?acquire_game_infos@fs@@YA_NAEAV?$vector@Ugames_info@fs@@V?$heap_allocator@Ugames_info@fs@@@vector_allocators@ttl@@$0A@@ttl@@@Z
?get_mount_setup@fs@@YAAEBVmount_setup@1@XZ
?mount_default_out@fs@@YAXP6A_NAEBUmount_path@1@GPEAX@Z1_N3@Z
?get_default_out_path@fs@@YAAEBV?$string_base@D@ttl@@XZ
?GetBuildInfo@fs@@YAAEBV?$string_base@D@ttl@@PEAI@Z
?IsBuildSealBroken@fs@@YA_NXZ
?g_StringAllocator@@3PEAVCStringAllocator@@EA
?_CLogV@@YAXW4TYPE@ELevel@Log@@PEBD1HW4ENUM@CLFilterAction@@W44CLLineMode@@1PEAD@Z
?obtain_full_path@mount_path@fs@@IEAAXXZ
?get_dir_name@mount_app_setup@fs@@QEBA?AV?$temp_string_base@D$0PA@@ttl@@XZ
?get_data_mount_paths@mount_app_setup@fs@@QEBAXAEAV?$vectorm@$0DH@Umount_path_ex@fs@@V?$heap_allocator@Umount_path_ex@fs@@@vector_allocators@ttl@@$0A@@ttl@@@Z
?Instance@Settings@Log@@SAAEAV12@XZ
?GetCategoryLevel@Settings@Log@@QEBA?AW4TYPE@ELevel@2@PEBD@Z
??0file@fs@@QEAA@XZ
??1file@fs@@UEAA@XZ
?open@file@fs@@UEAA_NV?$string_const@D@ttl@@W4TYPE@EFSMode@@W45FFSOpenFlags@@@Z
?length@file@fs@@UEAA_KXZ
?read@file@fs@@UEAA_KPEAX_K@Z
?g_StringPool@@3PEAVCStringPool@@EA
?sp_control_thread_id@@3IA
?split@path@fs@@YA?AU?$pair@V?$temp_string_base@D$0PA@@ttl@@V12@@ttl@@V?$string_const@D@4@@Z
?engine@mount_setup@fs@@QEBAAEBUmount_app_setup@2@XZ
?CrashSendAssertErrorToChute@@YAX_N@Z
?CrashShowMessageBox@@YAX_N@Z
?_CLog@@YAXW4TYPE@ELevel@Log@@PEBD1HW4ENUM@CLFilterAction@@W44CLLineMode@@1ZZ
?_CLFilter@@YA?AW4ENUM@CLFilterAction@@I@Z
?CrashClose@@YAXXZ
?game@mount_setup@fs@@QEBAAEBUmount_app_setup@2@XZ
engine_x64_rwdi
?SetBufferForModels@CGame@@QEAAXAEBV?$vector@V?$string_base@D@ttl@@V?$heap_allocator@V?$string_base@D@ttl@@@vector_allocators@2@$00@ttl@@@Z
?SetRootDirectory@IGame@@QEAA_NPEBD@Z
?SetForceBakePrefabDataOnStart@IGame@@SAX_N@Z
?OnPaint@IGame@@QEAAXAEAUtagMSG@@@Z
?Initialize@IGame@@QEAAHPEADHPEAUHICON__@@1AEBUInitializeOptions@Lobby@@KKPEAVIProgressIndicator@@@Z
?unset_module_resolver@engine@@YAXXZ
?DestroyMountHelper@Mount@@YAXPEAVIMountHelper@1@@Z
DestroyGame
CreateGame
UninitializeGameScript
InitializeGameScript
HideSplashscreen
ShowSplashscreen
Main
?CreateMountHelper@Mount@@YAPEAVIMountHelper@1@AEBVmount_setup@fs@@@Z
?Start@GameTimeMonitor@@YAXAEBV?$string_base@D@ttl@@@Z
?SetForceBake@CStorage@ps@cbs@@SAX_N@Z
?GameStartedFromDevTools_HACK@@YA_NXZ
?GetAssetManager@@YAPEAUAssetManager@@XZ
?set_module_resolver@engine@@YAXAEAVResolver@modules@core@@@Z
GetEngineDllVersion
kernel32
GetCurrentProcessId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualQuery
InitializeSListHead
GetSystemInfo
RaiseException
GetModuleFileNameW
GetCurrentThreadId
Sleep
CreateMutexA
lstrlenA
GetDiskFreeSpaceExA
CreateDirectoryW
GetCurrentDirectoryW
FindResourceA
SizeofResource
LockResource
LoadResource
VirtualProtect
LocalFree
InitializeSRWLock
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
CloseHandle
DuplicateHandle
QueryPerformanceCounter
GetLastError
FileTimeToLocalFileTime
GetModuleHandleW
TerminateProcess
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
GetProcAddress
FreeLibrary
SetThreadPriority
GetCurrentThread
GetCurrentProcess
WaitForSingleObjectEx
user32
GetSystemMetrics
LoadImageA
MessageBoxA
gdi32
DeleteObject
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
msvcp140
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
?_Xbad_alloc@std@@YAXXZ
vcruntime140
memmove
_purecall
strchr
memcpy
strstr
__RTDynamicCast
memchr
memcmp
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
memset
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
_aligned_free
calloc
free
_set_new_mode
realloc
malloc
api-ms-win-crt-convert-l1-1-0
atoi
strtoul
atof
api-ms-win-crt-string-l1-1-0
_stricmp
strncmp
strcpy_s
_strlwr_s
strncpy_s
_strupr_s
strnlen
api-ms-win-crt-stdio-l1-1-0
_set_fmode
getc
__p__commode
ferror
fread
_isatty
_fileno
fwrite
__stdio_common_vfprintf
__acrt_iob_func
clearerr
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
__stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0
_errno
_invoke_watson
terminate
_register_thread_local_exe_atexit_callback
_c_exit
exit
_exit
_initterm_e
_initterm
abort
_get_narrow_winmain_command_line
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dsign
_dclass
atan2f
cosf
expf
_fdclass
powf
fmodf
logf
_ldclass
sinf
tanf
api-ms-win-crt-time-l1-1-0
_strftime_l
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_free_locale
_create_locale
localeconv
Exports
Exports
AmdPowerXpressRequestHighPerformance
D3D12SDKPath
D3D12SDKVersion
NvOptimusEnablement
Sections
.text Size: 519KB - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ