The Jackbox Party Pack 5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

The Jackbox Party Pack 5.exe
Size

10.9MB
MD5

f0eb76aa0a70502460140bec5fb78c6f
SHA1

01793fc536fb78b29af0f7f0f8f8b4a5aae12dd0
SHA256

41bcd113fbc4f148f939fed8fbe3cfc1c0d4bb782ad88dff243362b342028e21
SHA512

846acb96207c9d7a0cc03578886554bce7605fa4bd96aeba64881e444a01e596923a884201b5ff62b99620ff7db7162a4a7ccc4580cdaeb150eb103088637833
SSDEEP

98304:rCDZreenyDcDGTberTVtPwjVAxq6zKSV2nUk:W9eenzGAwjc2n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
The Jackbox Party Pack 5.exe

Files

The Jackbox Party Pack 5.exe
.exe windows:6 windows x64 arch:x64

89b5572adc59cb3f81b346c54b81233c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

steam_api64

SteamAPI_RunCallbacks
SteamInternal_ContextInit
SteamInternal_CreateInterface
SteamAPI_Init
SteamAPI_RestartAppIfNecessary
SteamAPI_GetHSteamUser
SteamAPI_GetHSteamPipe
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback

fmod64

?getPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?setVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?setMute@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setMode@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?setCallback@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_CHANNELCONTROL@@W4FMOD_CHANNELCONTROL_TYPE@@W4FMOD_CHANNELCONTROL_CALLBACK_TYPE@@PEAX3@Z@Z
?isPlaying@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?setPan@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setParameterFloat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?addDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAVDSP@2@@Z
?setSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@HW4FMOD_SPEAKERMODE@@H@Z
?stop@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getSyncPoint@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAUFMOD_SYNCPOINT@@@Z
?seekData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?readData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAXIPEAI@Z
?getFormat@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_SOUND_TYPE@@PEAW4FMOD_SOUND_FORMAT@@PEAH2@Z
?getLength@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?getDefaults@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMPEAH@Z
?unlock@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX0II@Z
?lock@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEAPEAX0PEAI1@Z
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?playSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVSound@2@PEAVChannelGroup@2@_NPEAPEAVChannel@2@@Z
?createStream@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createDSPByType@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PEAPEAVDSP@2@@Z
?addSyncPoint@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEBDPEAPEAUFMOD_SYNCPOINT@@@Z
?setLoopPoints@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@IIII@Z
?getSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAW4FMOD_SPEAKERMODE@@0@Z
?getPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?getMasterChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?getDelay@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_K0PEA_N@Z
?setDelay@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_K0_N@Z
?getDSPClock@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_K0@Z
?setPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getChannel@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVChannel@2@@Z
?getNumChannels@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getMixMatrix@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMPEAH1H@Z
?setUserData@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?update@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setLoopCount@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?getUserData@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z

fmodstudio64

?getLowLevelSystem@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAV13@@Z
?update@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?initialize@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HIIPEAX@Z
?create@System@Studio@FMOD@@SA?AW4FMOD_RESULT@@PEAPEAV123@I@Z
?getVCA@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVVCA@23@@Z
?setVolume@VCA@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getVolume@VCA@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?setUserData@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?getUserData@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?setCallback@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@IPEAUFMOD_STUDIO_EVENTINSTANCE@@PEAX@ZI@Z
?setParameterValue@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDM@Z
?loadBankFile@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAPEAVBank@23@@Z
?unload@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getParameterValue@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAM1@Z
?release@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getPlaybackState@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAW4FMOD_STUDIO_PLAYBACK_STATE@@@Z
?setTimelinePosition@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getTimelinePosition@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?stop@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?start@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setPaused@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getPaused@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?setVolume@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getVolume@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?getDescription@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventDescription@23@@Z
?getEvent@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVEventDescription@23@@Z
?getPath@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?createInstance@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventInstance@23@@Z

dbghelp

MiniDumpWriteDump

imm32

ImmIsUIMessageA

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

shell32

DragQueryFileW
DragQueryFileA
ShellExecuteA
DragFinish
SHCreateDirectoryExW
SHGetKnownFolderPath
SHCreateDirectoryExA

kernel32

VerifyVersionInfoA
GetSystemDirectoryA
ExpandEnvironmentStringsA
FreeLibrary
GetSystemTimeAsFileTime
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
FormatMessageA
SetLastError
SleepEx
GetTickCount64
OutputDebugStringW
InitializeSListHead
WaitForMultipleObjects
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSection
GetExitCodeThread
GetThreadPriority
GetModuleFileNameA
FindFirstFileA
GetCurrentProcess
FindNextFileA
SetErrorMode
FindClose
GetCurrentThreadId
GetCurrentDirectoryA
GetModuleHandleA
CreateFileA
CloseHandle
FreeConsole
GlobalLock
GetCurrentProcessId
GlobalUnlock
SetUnhandledExceptionFilter
FindFirstFileW
FindNextFileW
OutputDebugStringA
RemoveDirectoryW
GetUserDefaultLocaleName
InitializeCriticalSectionEx
GetLastError
DeleteFileW
DeleteCriticalSection
VerSetConditionMask
GlobalMemoryStatusEx
VerifyVersionInfoW
QueryPerformanceCounter
QueryPerformanceFrequency
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
LoadLibraryA
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
Sleep
GetCurrentThread
SetThreadPriority
SuspendThread
GetSystemInfo
SetThreadAffinityMask
CreateSemaphoreA
GetCurrentDirectoryW
GetProcessAffinityMask

user32

GetWindowRect
LoadCursorA
SetWindowPos
SetClipboardViewer
GetSystemMetrics
MsgWaitForMultipleObjects
ShowWindow
OpenClipboard
ChangeClipboardChain
SetWindowLongA
ClientToScreen
CloseClipboard
PeekMessageW
GetWindowLongA
SetWindowTextA
MessageBoxA
DefWindowProcA
CreateWindowExA
DispatchMessageA
TranslateMessage
GetClipboardData
SendMessageA
SetCapture
SetCursor
GetClientRect
IsClipboardFormatAvailable
GetWindowLongPtrA
PostQuitMessage
GetDesktopWindow
SetWindowLongPtrA
RegisterClassExA
ReleaseCapture
SetForegroundWindow
ShowCursor
BeginPaint
EndPaint
LoadImageA
GetKeyState
AdjustWindowRectEx
GetMonitorInfoA
MonitorFromWindow
SetFocus

msvcp140

?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Thrd_join
_Xtime_get_ticks
_Thrd_id
_Thrd_sleep
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Thrd_hardware_concurrency
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Cnd_signal
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Cnd_wait
_Mtx_init
_Thrd_start
_Thrd_detach
_Mtx_destroy
_Cnd_init
_Mtx_unlock
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ

vcruntime140

__std_terminate
memset
strchr
__std_exception_destroy
__std_exception_copy
memchr
memcmp
longjmp
strrchr
strstr
__C_specific_handler
__vcrt_InitializeCriticalSectionEx
__intrinsic_setjmp
__CxxFrameHandler3
_CxxThrowException
memmove
_purecall
memcpy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_set_invalid_parameter_handler
terminate
_getpid
_invalid_parameter_noinfo
_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_beginthreadex
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
_exit
_endthreadex
__p___argc
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
__sys_nerr
strerror
exit
abort

api-ms-win-crt-heap-l1-1-0

_aligned_free
_set_new_mode
calloc
realloc
_callnewh
_aligned_malloc
malloc
free

api-ms-win-crt-stdio-l1-1-0

fputc
rewind
ftell
__stdio_common_vsnprintf_s
fseek
_get_stream_buffer_pointers
_fseeki64
fputs
fgets
fopen
__stdio_common_vsscanf
fread
_write
_wfopen_s
__p__commode
_close
_open
fsetpos
ungetc
_set_fmode
_lseeki64
setvbuf
fgetpos
__stdio_common_vsprintf
fwrite
fgetwc
fgetc
fopen_s
ungetwc
fputwc
fclose
fflush
__acrt_iob_func
__stdio_common_vfprintf
_read
__stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

isupper
isprint
strtok_s
strcpy_s
strcat_s
isdigit
strlen
strncat_s
strncmp
strncpy_s
memcpy_s
isgraph
isspace
_stricmp
wcscoll
_wcsicoll
isalpha
isalnum
tolower
strncpy
_strdup
strcmp
strspn
strcspn
isxdigit
strpbrk
islower

api-ms-win-crt-convert-l1-1-0

strtoul
strtod
wcstombs
atof
strtol
_itoa_s
strtof
strtoll
atoi
_strtoui64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_wstat64
_access
_stat64
_lock_file
_fstat64

api-ms-win-crt-math-l1-1-0

cos
exp
log
sin
modf
asin
logf
atan2f
floorf
ceil
cosf
sinf
ceilf
sqrtf
atan
atan2
floor
fmod
powf
acosf
fmodf
tanf
sqrt
pow
tan
asinf
__setusermatherr
acos

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-environment-l1-1-0

getenv
getenv_s

api-ms-win-crt-time-l1-1-0

_ftime64
_time64
_gmtime64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

abs
qsort
rand
srand

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory

crypt32

CertCloseStore
CertOpenSystemStoreA
CertEnumCertificatesInStore

libssl-1_1-x64

SSL_get_verify_result
SSL_get1_session
SSL_CTX_load_verify_locations
SSL_version
SSL_get_privatekey
SSL_get_certificate
SSL_set_connect_state
SSL_CTX_add_client_CA
SSL_shutdown
TLS_client_method
SSL_get_error
SSL_CTX_ctrl
SSL_ctrl
SSL_write
OPENSSL_init_ssl
SSL_read
SSL_connect
SSL_free
SSL_new
SSL_CTX_check_private_key
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_passwd_cb
SSL_CTX_use_certificate
SSL_CTX_use_PrivateKey
SSL_CTX_set_verify
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_set_session
SSL_SESSION_free
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_CTX_get_cert_store
SSL_set_bio
SSL_set_fd
SSL_pending
SSL_CIPHER_get_name
SSL_get_current_cipher
SSL_CTX_free
SSL_CTX_new
SSL_CTX_set_cipher_list
BIO_f_ssl
SSL_get0_alpn_selected
SSL_CTX_set_alpn_protos
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_msg_callback
SSL_CTX_set_options
SSL_CTX_use_certificate_chain_file

libcrypto-1_1-x64

MD5_Update
MD5_Final
PKCS12_free
PKCS12_PBE_add
PKCS12_parse
d2i_PKCS12_fp
OCSP_response_status
OCSP_response_get1_basic
OCSP_resp_count
OCSP_resp_get0
OCSP_single_get0_status
OCSP_check_validity
MD5_Init
OCSP_RESPONSE_free
d2i_OCSP_RESPONSE
OCSP_response_status_str
OCSP_cert_status_str
OCSP_crl_reason_str
OCSP_basic_verify
SHA256_Init
DSA_get0_key
DSA_get0_pqg
DH_get0_key
DH_get0_pqg
RSA_flags
RSA_free
RSA_get0_key
EVP_PKEY_copy_parameters
EVP_PKEY_free
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get1_RSA
EVP_PKEY_get0_RSA
EVP_PKEY_id
ASN1_STRING_print
ASN1_TIME_print
ASN1_STRING_to_UTF8
i2t_ASN1_OBJECT
i2a_ASN1_OBJECT
ASN1_STRING_get0_data
ASN1_STRING_type
ASN1_STRING_length
ASN1_STRING_free
ASN1_STRING_new
DES_ecb_encrypt
DES_set_odd_parity
DES_set_key
MD4_Init
MD4_Update
MD4_Final
BN_print
BIO_printf
BIO_s_mem
ERR_error_string_n
ERR_clear_error
ERR_peek_error
ERR_get_error
X509_check_issued
X509V3_EXT_print
GENERAL_NAMES_free
OPENSSL_load_builtin_modules
CONF_modules_load_file
RAND_status
RAND_file_name
RAND_load_file
RAND_add
RAND_bytes
BIO_ctrl
BIO_puts
BIO_free
BIO_new
CRYPTO_free
CRYPTO_malloc
OpenSSL_version_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_value
OPENSSL_sk_num
ERR_print_errors_fp
ERR_get_error_line
SHA256_Update
d2i_X509
X509_STORE_add_cert
PEM_write_bio_X509
PEM_read_X509
X509_EXTENSION_get_data
X509_EXTENSION_get_object
X509_get_ext_d2i
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_print_ex
X509_get_pubkey
X509_get0_extensions
X509_get_X509_PUBKEY
X509_get0_notAfter
X509_get0_notBefore
X509_get_subject_name
X509_get_issuer_name
X509_get_serialNumber
X509_get_version
X509_get0_signature
X509_free
i2d_X509_PUBKEY
X509_signature_print
X509_verify_cert_error_string
X509_load_crl_file
X509_LOOKUP_file
X509_STORE_add_lookup
X509_STORE_set_flags
OCSP_BASICRESP_free
SHA256_Final

ws2_32

select
WSASetLastError
ioctlsocket
gethostname
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
htonl
ntohl
getnameinfo
recv
inet_pton
sendto
send
recvfrom
listen
bind
accept
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket

wldap32

ord79
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord301
ord200
ord30
ord143
ord35

xinput9_1_0

XInputGetState

Sections

.text
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 308KB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bind
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89b5572adc59cb3f81b346c54b81233c

Headers

DLL Characteristics

File Characteristics

Imports

steam_api64

fmod64

fmodstudio64

dbghelp

imm32

winmm

shell32

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

d3d11

dxgi

crypt32

libssl-1_1-x64

libcrypto-1_1-x64

ws2_32

wldap32

xinput9_1_0

Sections

.text Size: 6.8MB - Virtual size: 6.8MB

.rdata Size: 3.2MB - Virtual size: 3.2MB

.data Size: 308KB - Virtual size: 6.6MB

.pdata Size: 293KB - Virtual size: 292KB

.gfids Size: 512B - Virtual size: 76B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 133KB - Virtual size: 133KB

.bind Size: 175KB - Virtual size: 175KB

.text
Size: 6.8MB - Virtual size: 6.8MB

.rdata
Size: 3.2MB - Virtual size: 3.2MB

.data
Size: 308KB - Virtual size: 6.6MB

.pdata
Size: 293KB - Virtual size: 292KB

.gfids
Size: 512B - Virtual size: 76B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 133KB - Virtual size: 133KB

.bind
Size: 175KB - Virtual size: 175KB