FactoryGameEGS-Messaging.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e78445360927f797dba1ea95fbed6e53ebe319b9680da581486081674b659d23.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
e78445360927f797dba1ea95fbed6e53ebe319b9680da581486081674b659d23.dll
Resource
win10v2004-20240508-en
General
-
Target
e78445360927f797dba1ea95fbed6e53ebe319b9680da581486081674b659d23
-
Size
298KB
-
MD5
b1fb03b10972d0e8a5f0a7cf0445b67c
-
SHA1
e28338ec02701ede9e49f417ed101a2874072833
-
SHA256
e78445360927f797dba1ea95fbed6e53ebe319b9680da581486081674b659d23
-
SHA512
2c0e5693b53c98f0f9c689183c303649750377b5a453ee5c35c913e7cfc3be26db76a4892303a00017c32b17b2df2103f44a354f6fce847b4449b1cdaaa8b049
-
SSDEEP
6144:gEGwvNVa9qlSwB83RI5FHAGQ+QShRZUmR/:gEGIVa9qlSwB83RIT9Jl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e78445360927f797dba1ea95fbed6e53ebe319b9680da581486081674b659d23
Files
-
e78445360927f797dba1ea95fbed6e53ebe319b9680da581486081674b659d23.dll windows:6 windows x64 arch:x64
b12f03e9be4ef2352426daf5594d594a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
factorygameegs-core
??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??1FLogCategoryBase@@QEAA@XZ
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?HandleAtomicsFailure@FWindowsPlatformAtomics@@KAXPEB_WZZ
?BeginNamedEvent@FWindowsPlatformMisc@@SAXAEBUFColor@@PEBD@Z
?EndNamedEvent@FWindowsPlatformMisc@@SAXXZ
?OutputBeginDynamicEventWithId@FCpuProfilerTrace@@SAXVFName@@PEB_WPEBDI@Z
?OutputEndEvent@FCpuProfilerTrace@@SAXXZ
?CheckVerifyFailedImpl@FDebug@@SA_NPEBD0HPEAXPEB_WZZ
?CheckVerifyImpl@@YA_NAEA_N_NPEBDHPEAX2PEB_WZZ
?Log@FOutputDevice@@QEAAXPEB_W@Z
?Malloc@FMemory@@SAPEAX_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Free@FMemory@@SAXPEAX@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
?MemCrc_DEPRECATED@FCrc@@SAIPEBXHI@Z
??0FString@@QEAA@PEBD@Z
??0FString@@QEAA@PEB_W@Z
?AppendChars@FString@@QEAAXPEB_WH@Z
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?FromValidEName@FNameEntryId@@CA?AU1@W4EName@@@Z
?GetTypeHash@@YAIUFNameEntryId@@@Z
?ToString@FName@@QEBA?AVFString@@XZ
??0FName@@QEAA@PEBDW4EFindName@@@Z
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?Command@FParse@@SA_NPEAPEB_WPEB_W_N@Z
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
?GenerateNewID@FDelegateHandle@@CA_KXZ
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetSynchEventFromPool@FGenericPlatformProcess@@SAPEAVFEvent@@_N@Z
?ReturnSynchEventToPool@FGenericPlatformProcess@@SAXPEAVFEvent@@@Z
?SupportsMultithreading@FGenericPlatformProcess@@SA_NXZ
?Sleep@FWindowsPlatformProcess@@SAXM@Z
?DoTestCriticalStall@@YAXXZ
?LockFreeTagCounterHasOverflowed@@YAXXZ
?AllocLockFreeLink@FLockFreeLinkPolicy@@SAIXZ
?FreeLockFreeLink@FLockFreeLinkPolicy@@SAXI@Z
?MemoryTrace_GetActiveTag@@YAHXZ
??0FMemScope@@QEAA@W4ELLMTag@@_N@Z
??0FMemScope@@QEAA@AEBVFName@@_N@Z
??1FMemScope@@QEAA@XZ
?Construct@FLowLevelMemTracker@@SAAEAV1@XZ
?OnLowLevelAlloc@FLowLevelMemTracker@@QEAAXW4ELLMTracker@@PEBX_KW4ELLMTag@@W4ELLMAllocType@@_N@Z
?OnLowLevelFree@FLowLevelMemTracker@@QEAAXW4ELLMTracker@@PEBXW4ELLMAllocType@@_N@Z
?GetActiveTagData@FLowLevelMemTracker@@QEAAPEBVFTagData@LLMPrivate@UE@@W4ELLMTracker@@W4ELLMTagSet@@@Z
?Init@FLLMScope@@IEAAXVFName@@_NW4ELLMTagSet@@W4ELLMTracker@@1@Z
?Init@FLLMScope@@IEAAXW4ELLMTag@@_NW4ELLMTagSet@@W4ELLMTracker@@1@Z
?Destruct@FLLMScope@@IEAAXXZ
?Get@FThreadStatsPool@@SAAEAU1@XZ
?GetFromPool@FThreadStatsPool@@QEAAPEAVFThreadStats@@XZ
?Flush@FThreadStats@@QEAAX_N0@Z
?FlushRawStats@FThreadStats@@QEAAX_N0@Z
?DoSetup@FThreadSafeStaticStatBase@@IEBAPEBUTStatIdData@@PEBDPEB_W001_N2W4Type@EStatDataType@@22W4EMemoryCounterRegion@FWindowsPlatformMemory@@@Z
?SaveStack@FMetadataTrace@@SAIXZ
?AnsiMalloc@@YAPEAX_KI@Z
?AnsiFree@@YAXPEAX@Z
?MemoryTrace_MarkAllocAsHeap@@YAX_KIW4EMemoryTraceHeapAllocationFlags@@@Z
?MemoryTrace_UnmarkAllocAsHeap@@YAX_KI@Z
?MemoryTrace_Alloc@@YAX_K0II@Z
?MemoryTrace_Free@@YAX_KI@Z
?CityHash64@@YA_KPEBDI@Z
?AppendString@FGuid@@QEBAXAEAVFString@@W4EGuidFormats@@@Z
?NewGuid@FGuid@@SA?AU1@XZ
?UtcNow@FDateTime@@SA?AU1@XZ
?GenerateTaskId@TaskTrace@@YA_KXZ
?Launched@TaskTrace@@YAX_KPEB_W_NW4Type@ENamedThreads@@0@Z
?Scheduled@TaskTrace@@YAX_K@Z
?SubsequentAdded@TaskTrace@@YAX_K0@Z
??0FTaskTimingEventScope@TaskTrace@@QEAA@_K@Z
??1FTaskTimingEventScope@TaskTrace@@QEAA@XZ
?Get@FTaskGraphInterface@@SAAEAV1@XZ
?CreateGraphEvent@FGraphEvent@@SA?AV?$TRefCountPtr@VFGraphEvent@@@@XZ
?DispatchSubsequents@FGraphEvent@@QEAAXAEAV?$TArray@PEAVFBaseGraphTask@@V?$TSizedDefaultAllocator@$0CA@@@@@W4Type@ENamedThreads@@_N@Z
?Recycle@FGraphEvent@@CAXPEAV1@@Z
??0FSelfRegisteringExec@@QEAA@XZ
??1FSelfRegisteringExec@@UEAA@XZ
?GetCoreTicker@FTSTicker@@SAAEAV1@XZ
?AddTicker@FTSTicker@@QEAA?AV?$TWeakPtr@UFElement@FTSTicker@@$00@@AEBV?$TDelegate@$$A6A_NM@ZUFDefaultDelegateUserPolicy@@@@M@Z
?RemoveTicker@FTSTicker@@SAXV?$TWeakPtr@UFElement@FTSTicker@@$00@@@Z
?Create@FRunnableThread@@SAPEAV1@PEAVFRunnable@@PEB_WIW4EThreadPriority@@_KW4EThreadCreateFlags@@@Z
?GetBool@FConfigCacheIni@@QEAA_NPEB_W0AEA_NAEBVFString@@@Z
?Exec@FExec@@UEAA_NPEAVUWorld@@PEB_WAEAVFOutputDevice@@@Z
?CpuChannel@@3AEAVFChannel@Trace@UE@@EA
?GConfig@@3PEAVFConfigCacheIni@@EA
?GEngineIni@@3VFString@@A
?GCycleStatsShouldEmitNamedEvents@@3HA
?GShouldEmitVerboseNamedEvents@@3_NA
?SecondsPerCycle@FGenericPlatformTime@@1NA
?GTestCriticalStalls@@3HA
?LinkAllocator@FLockFreeLinkPolicy@@2V?$TLockFreeAllocOnceIndexedAllocator@UFIndexedLockFreeLink@@$0EAAAAAA@$0EAAA@@@A
?TrackerInstance@FLowLevelMemTracker@@0PEAV1@EA
?bIsDisabled@FLowLevelMemTracker@@2_NA
?TlsSlot@FThreadStats@@0IA
?bPrimaryEnable@FThreadStats@@0_NA
?bPrimaryDisableForever@FThreadStats@@0_NA
?bIsRawStatsActive@FThreadStats@@0_NA
?OnPreExit@FCoreDelegates@@2V?$TMulticastDelegate@$$A6AXXZUFDefaultDelegateUserPolicy@@@@A
factorygameegs-coreuobject
?TrySetPath@FTopLevelAssetPath@@QEAA_NVFName@@0@Z
?ToString@FTopLevelAssetPath@@QEBA?AVFString@@XZ
??4FWeakObjectPtr@@QEAAXPEBVUObject@@@Z
?Get@FWeakObjectPtr@@QEBAPEAVUObject@@XZ
?IsValid@FWeakObjectPtr@@QEBA_N_N0@Z
?GetPrivateStaticClass@UStruct@@CAPEAVUClass@@XZ
?GetStructPathName@UStruct@@QEBA?AUFTopLevelAssetPath@@XZ
?TryConvertShortTypeNameToPathName@UClass@@SA?AUFTopLevelAssetPath@@PEAV1@AEBVFString@@W4Type@ELogVerbosity@@PEB_W@Z
kernel32
InitializeCriticalSection
SetCriticalSectionSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentThreadId
TlsGetValue
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
vcruntime140
memset
__C_specific_handler
__current_exception
__current_exception_context
__std_type_info_destroy_list
memmove
_purecall
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
_initterm
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initialize_onexit_table
_crt_at_quick_exit
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
free
malloc
Exports
Exports
?Intercept@IMessageBus@@UEAAXAEBV?$TSharedRef@VIMessageInterceptor@@$00@@AEBVFName@@@Z
?ModularFeatureName@INetworkMessagingExtension@@2VFName@@A
?PATHNAME_All@IMessageBus@@2UFTopLevelAssetPath@@B
?Subscribe@IMessageBus@@UEAA?AV?$TSharedPtr@VIMessageSubscription@@$00@@AEBV?$TSharedRef@VIMessageReceiver@@$00@@AEBVFName@@AEBV?$TRange@W4EMessageScope@@@@@Z
?Unintercept@IMessageBus@@UEAAXAEBV?$TSharedRef@VIMessageInterceptor@@$00@@AEBVFName@@@Z
?Unsubscribe@IMessageBus@@UEAAXAEBV?$TSharedRef@VIMessageReceiver@@$00@@AEBVFName@@@Z
InitializeModule
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uedbg Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ