FactoryServer-InputDebugging.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1664912c19d409e4a38e6cabcdb41a001bd07051a35ac4cf9628b6963fc37341.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1664912c19d409e4a38e6cabcdb41a001bd07051a35ac4cf9628b6963fc37341.dll
Resource
win10v2004-20240412-en
General
-
Target
1664912c19d409e4a38e6cabcdb41a001bd07051a35ac4cf9628b6963fc37341
-
Size
166KB
-
MD5
f40aad0a2c99cbaa6aa103999b08c755
-
SHA1
2182d70b18cb56f6cfd543a4028c534fd1f15e7b
-
SHA256
1664912c19d409e4a38e6cabcdb41a001bd07051a35ac4cf9628b6963fc37341
-
SHA512
df59fd86deb16953bd8db345f2b40253f5eee9f14d5279547461672624b00f9c4f9d8da8b56f485c0350c2e1fa573be3b74c3216c573ab764d3fa633a553def6
-
SSDEEP
3072:VXqLCy90kxItn8MkYgkwXT2goeUcD2w7O9caMFHt1BWg9RkkBz:4L4kIkzXzRZUmR/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1664912c19d409e4a38e6cabcdb41a001bd07051a35ac4cf9628b6963fc37341
Files
-
1664912c19d409e4a38e6cabcdb41a001bd07051a35ac4cf9628b6963fc37341.dll windows:6 windows x64 arch:x64
24955f41337039b7acba3c5917e55a78
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
factoryserver-applicationcore
?Get@IPlatformInputDeviceMapper@@SAAEAV1@XZ
factoryserver-core
?HandleAtomicsFailure@FWindowsPlatformAtomics@@KAXPEB_WZZ
?Free@FMemory@@SAXPEAX@Z
??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FName@@QEAA@PEBDW4EFindName@@@Z
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??1FLogCategoryBase@@QEAA@XZ
?DoSetup@FThreadSafeStaticStatBase@@IEBAPEBUTStatIdData@@PEBDPEB_W001_N2W4Type@EStatDataType@@22W4EMemoryCounterRegion@FWindowsPlatformMemory@@@Z
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?CheckVerifyFailedImpl@FDebug@@SA_NPEBD0HPEAXPEB_WZZ
?CheckVerifyImpl@@YA_NAEA_N_NPEBDHPEAX2PEB_WZZ
?Malloc@FMemory@@SAPEAX_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?OnInvalidSetNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
??0FString@@QEAA@PEBD@Z
??0FString@@QEAA@PEB_W@Z
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?FromValidEName@FNameEntryId@@CA?AU1@W4EName@@@Z
?ToString@FName@@QEBA?AVFString@@XZ
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
?IsInGameThread@@YA_NXZ
?IsInSlateThread@@YA_NXZ
?GenerateNewID@FDelegateHandle@@CA_KXZ
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?SetupSingleton@IConsoleManager@@CAXXZ
?AccessGeneralShaderChangeCvars@FAutoConsoleObject@@SAAEAV?$TArray@PEBVFAutoConsoleObject@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?AccessMobileShaderChangeCvars@FAutoConsoleObject@@SAAEAV?$TArray@PEBVFAutoConsoleObject@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?AccessDesktopShaderChangeCvars@FAutoConsoleObject@@SAAEAV?$TArray@PEBVFAutoConsoleObject@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?Get@IModularFeatures@@SAAEAV1@XZ
?sRGBToLinearTable@FLinearColor@@2PAMA
?White@FLinearColor@@2U1@B
?White@FColor@@2U1@B
?Red@FColor@@2U1@B
?Green@FColor@@2U1@B
?Yellow@FColor@@2U1@B
?Orange@FColor@@2U1@B
?Silver@FColor@@2U1@B
?PRIVATE_GIsRunningCommandlet@@3_NA
?IsInAsyncLoadingThread@@3P6A_NXZEA
?Singleton@IConsoleManager@@0PEAU1@EA
factoryserver-coreuobject
?Get@FWeakObjectPtr@@QEBAPEAVUObject@@XZ
factoryserver-engine
?GetMediumFont@UEngine@@SAPEAVUFont@@XZ
?ToString@FInputDevicePropertyHandle@@QEBA?AVFString@@XZ
?Register@UDebugDrawService@@SA?AVFDelegateHandle@@PEB_WAEBV?$TDelegate@$$A6AXPEAVUCanvas@@PEAVAPlayerController@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?Unregister@UDebugDrawService@@SAXVFDelegateHandle@@@Z
?GetMaxCharHeight@UFont@@QEBAMXZ
?PushRelativeTransform@FCanvas@@QEAAXAEBU?$TMatrix@N@Math@UE@@@Z
?PopTransform@FCanvas@@QEAAXXZ
?DrawString@FDisplayDebugManager@@QEAAXAEBVFString@@AEBM@Z
?DrawItem@UCanvas@@QEAAXAEAVFCanvasItem@@@Z
?Get@UInputPlatformSettings@@SAPEAV1@XZ
?GetHardwareDevices@UInputPlatformSettings@@QEBAAEBV?$TArray@UFHardwareDeviceIdentifier@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?Get@UInputDeviceSubsystem@@SAPEAV1@XZ
?GetInputDeviceHardwareIdentifier@UInputDeviceSubsystem@@QEBA?AUFHardwareDeviceIdentifier@@UFInputDeviceId@@@Z
?GetDuration@UInputDeviceProperty@@QEBAMXZ
?Draw@FCanvasLineItem@@UEAAXPEAVFCanvas@@@Z
?LogInputDeviceProperties@@3UFLogCategoryLogInputDeviceProperties@@A
?OnShowDebugInfo@AHUD@@2V?$TMulticastDelegate@$$A6AXPEAVAHUD@@PEAVUCanvas@@AEBVFDebugDisplayInfo@@AEAM3@ZUFDefaultTSDelegateUserPolicy@@@@A
factoryserver-slate
?UnregisterInputPreProcessor@FSlateApplication@@QEAAXV?$TSharedPtr@VIInputProcessor@@$00@@@Z
?GetUserIndexForInputDevice@FSlateApplication@@QEBA?AU?$TOptional@H@@UFInputDeviceId@@@Z
?CurrentApplication@FSlateApplication@@0V?$TSharedPtr@VFSlateApplication@@$00@@A
?RegisterInputPreProcessor@FSlateApplication@@QEAA_NV?$TSharedPtr@VIInputProcessor@@$00@@H@Z
kernel32
InitializeCriticalSection
SetCriticalSectionSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
InitializeSListHead
ReleaseSRWLockExclusive
vcruntime140
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
__current_exception
memcpy
_purecall
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-math-l1-1-0
sinf
cosf
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_crt_atexit
terminate
_initterm_e
_initterm
_cexit
_crt_at_quick_exit
_seh_filter_dll
_register_onexit_function
Exports
Exports
InitializeModule
Sections
.text Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uedbg Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 684B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ