GameInputSvc.pdb
Static task
static1
General
-
Target
bff632e886a453665930ea68bdd598c2b77083b5c2dfa74affa0fa86b65609e6
-
Size
1.2MB
-
MD5
54f8324c8c53d0a55d1f87c636d063e7
-
SHA1
f9d4ae7ce1638b2f90ea945a87045601917fa9b1
-
SHA256
bff632e886a453665930ea68bdd598c2b77083b5c2dfa74affa0fa86b65609e6
-
SHA512
84cccd08a48e34b7b835fbd97bad4bab535692fd2647d7551ff3fc77b08ce787014a5bf0de29ceb66d06162973b54d534d404fbc8784bc3b6a123e4cd2e75d75
-
SSDEEP
12288:TG16FWBGJXONobVmaeZ0d/5PLdHgpchM/wW9hAmkvnGiZs1dMIaGxGU7:O6FWBM6T0dhBHgOq/PkvnGws1uIa5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource bff632e886a453665930ea68bdd598c2b77083b5c2dfa74affa0fa86b65609e6
Files
-
bff632e886a453665930ea68bdd598c2b77083b5c2dfa74affa0fa86b65609e6.exe windows:10 windows x64 arch:x64
c7d6cc9d1794e4439de4ced4462e1bc6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntdll
RtlQueryFeatureConfiguration
LdrResSearchResource
RtlNotifyFeatureUsage
EtwEventRegister
EtwEventUnregister
NtQueryLicenseValue
towlower
RtlAllocateHeap
swprintf_s
RtlFreeHeap
EtwEventWriteTransfer
RtlInitUnicodeString
RtlUnhandledExceptionFilter
RtlGetVersion
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtTerminateProcess
_wcsicmp
RtlAdjustPrivilege
_wcsnicmp
wcscpy_s
VerSetConditionMask
ZwQueryWnfStateData
memset
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
SetEvent
CreateEventW
InitializeCriticalSection
LeaveCriticalSection
OpenEventW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-file-l1-1-0
GetTempFileNameW
GetFileAttributesW
GetVolumePathNameW
GetFullPathNameW
SetFileAttributesW
DeleteFileW
CreateFileW
api-ms-win-core-file-l2-1-0
CopyFileExW
MoveFileExW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetTickCount64
api-ms-win-core-wow64-l1-1-1
GetSystemWow64DirectoryW
api-ms-win-service-core-l1-1-0
SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
api-ms-win-core-processthreads-l1-1-0
CreateThread
OpenProcessToken
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
CreateProcessAsUserW
GetStartupInfoW
api-ms-win-security-base-l1-1-0
SetTokenInformation
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
DuplicateTokenEx
AdjustTokenPrivileges
GetSecurityDescriptorSacl
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
WTSGetActiveConsoleSessionId
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ext-ms-win-session-wtsapi32-l1-1-0
WTSEnumerateSessionsW
WTSFreeMemory
crypt32
CertVerifyCertificateChainPolicy
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 756B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sinit Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE