FactoryGameEGS-VirtualFileCache.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6a9c4074fca56bf9d35fa89b7f5e109eefc75b34e2459f8aa3783961fa748e0f.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a9c4074fca56bf9d35fa89b7f5e109eefc75b34e2459f8aa3783961fa748e0f.dll
Resource
win10v2004-20240419-en
General
-
Target
6a9c4074fca56bf9d35fa89b7f5e109eefc75b34e2459f8aa3783961fa748e0f
-
Size
187KB
-
MD5
27a132023d2b492a31121369c2ca55b4
-
SHA1
ed4861ee288a559abc3de0989ad754421b44f36d
-
SHA256
6a9c4074fca56bf9d35fa89b7f5e109eefc75b34e2459f8aa3783961fa748e0f
-
SHA512
498f9ce7cb35cc252403ef35d021d3e9ee8fc3bcd2d6db0e92ac2559fac009f023ceeb04986ff4621f3b4a99f168595b4e373242c5153c8bf9cf7cb42f146ac5
-
SSDEEP
3072:kwDTdXZx/yNDWcAxbpdcJjCrkQXTZkmWzNrac96eafWURwO9caMFHt1BWg9RkkBz:kkdiDWcMbXDfWUORZUmR/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a9c4074fca56bf9d35fa89b7f5e109eefc75b34e2459f8aa3783961fa748e0f
Files
-
6a9c4074fca56bf9d35fa89b7f5e109eefc75b34e2459f8aa3783961fa748e0f.dll windows:6 windows x64 arch:x64
b8a9ae01d9f9994fc383d057504d651e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
factorygameegs-core
??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??1FLogCategoryBase@@QEAA@XZ
?Stricmp@FGenericPlatformStricmp@@SAHPEB_W0@Z
?HandleAtomicsFailure@FWindowsPlatformAtomics@@KAXPEB_WZZ
?CheckVerifyFailedImpl@FDebug@@SA_NPEBD0HPEAXPEB_WZZ
?CheckVerifyImpl@@YA_NAEA_N_NPEBDHPEAX2PEB_WZZ
?Free@FMemory@@SAXPEAX@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
?SetError@FArchiveState@@QEAAXXZ
?SerializeByteOrderSwapped@FArchive@@AEAAAEAV1@AEAI@Z
?SerializeByteOrderSwapped@FArchive@@AEAAAEAV1@AEA_K@Z
??0FString@@QEAA@PEBD@Z
??0FString@@QEAA@PEB_W@Z
?PathAppend@FString@@QEAAXPEB_WH@Z
?ConcatCF@FString@@CA?AV1@PEB_W$$QEAV1@@Z
?Find@FString@@QEBAHPEB_WHW4Type@ESearchCase@@W42ESearchDir@@H@Z
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?BytesToHex@@YAXPEBEHAEAVFString@@@Z
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetSynchEventFromPool@FGenericPlatformProcess@@SAPEAVFEvent@@_N@Z
?ReturnSynchEventToPool@FGenericPlatformProcess@@SAXPEAVFEvent@@@Z
??0FMemScope@@QEAA@W4ELLMTag@@_N@Z
??1FMemScope@@QEAA@XZ
?Init@FLLMScope@@IEAAXW4ELLMTag@@_NW4ELLMTagSet@@W4ELLMTracker@@1@Z
?Destruct@FLLMScope@@IEAAXXZ
?Increment@FStatsTrace@@SAXAEBVFName@@@Z
?Add@FStatsTrace@@SAXAEBVFName@@_J@Z
?Get@FThreadStatsPool@@SAAEAU1@XZ
?GetFromPool@FThreadStatsPool@@QEAAPEAVFThreadStats@@XZ
?Flush@FThreadStats@@QEAAX_N0@Z
?FlushRawStats@FThreadStats@@QEAAX_N0@Z
?DoSetup@FThreadSafeStaticStatBase@@IEBAPEBUTStatIdData@@PEBDPEB_W001_N2W4Type@EStatDataType@@22W4EMemoryCounterRegion@FWindowsPlatformMemory@@@Z
??0FDateTime@@QEAA@HHHHHHH@Z
?UtcNow@FDateTime@@SA?AU1@XZ
??6@YAAEAVFArchive@@AEAV0@AEAVFSHAHash@@@Z
?GetPlatformPhysical@IPlatformFile@@SAAEAV1@XZ
?Get@IFileManager@@SAAEAV1@XZ
?Create@FRunnableThread@@SAPEAV1@PEAVFRunnable@@PEB_WIW4EThreadPriority@@_KW4EThreadCreateFlags@@@Z
?ProjectPersistentDownloadDir@FPaths@@SA?AVFString@@XZ
?GetExtension@FPaths@@SA?AVFString@@AEBV2@_N@Z
?GetCleanFilename@FPaths@@SA?AVFString@@AEBV2@@Z
?SetExtension@FPaths@@SA?AVFString@@AEBV2@0@Z
??0FIoStatus@@QEAA@XZ
??1FIoStatus@@QEAA@XZ
??0FIoStatus@@QEAA@W4EIoErrorCode@@@Z
??4FIoStatus@@QEAAAEAV0@AEBV0@@Z
??4FIoStatus@@QEAAAEAV0@W4EIoErrorCode@@@Z
??8FIoStatus@@QEBA_NAEBV0@@Z
?StatusOrCrash@@YAXAEBVFIoStatus@@@Z
?CRCTable_DEPRECATED@FCrc@@2PAIA
?bIsDisabled@FLowLevelMemTracker@@2_NA
?TlsSlot@FThreadStats@@0IA
?bPrimaryEnable@FThreadStats@@0_NA
?bPrimaryDisableForever@FThreadStats@@0_NA
?bIsRawStatsActive@FThreadStats@@0_NA
?Ok@FIoStatus@@2V1@B
?Unknown@FIoStatus@@2V1@B
kernel32
InitializeCriticalSection
SetCriticalSectionSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
TlsGetValue
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeSListHead
vcruntime140
_purecall
memcmp
memcpy
memmove
memset
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__current_exception
__current_exception_context
__std_type_info_destroy_list
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-math-l1-1-0
logf
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
terminate
_initterm_e
_initterm
_cexit
_crt_at_quick_exit
_seh_filter_dll
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
Exports
Exports
?CreateVirtualFileCache@IVirtualFileCache@@SA?AV?$TSharedRef@UIVirtualFileCache@@$00@@XZ
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uedbg Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ