2b69e67e14ce0c8ebf82ff5cc71af3599ddcd23f086ce68b48509eb180aaf035

Sharing

Copy URL Twitter E-mail

General

Target

2b69e67e14ce0c8ebf82ff5cc71af3599ddcd23f086ce68b48509eb180aaf035
Size

78KB
MD5

157d86b2c3f7648392d3e527ae36c76d
SHA1

82ab2423194472af62d9aa00e0ceb008fb9e00ef
SHA256

2b69e67e14ce0c8ebf82ff5cc71af3599ddcd23f086ce68b48509eb180aaf035
SHA512

05cc6e077946da4aa63376715e769e6607ff05548e27ead963db2fbd14ed784a476bfb33b3aa4d677f05ebc51b32c7034f47841cff2e2992ea7a8f731cc9e3b7
SSDEEP

1536:GH+3jS45O9esIXq9eFHUAf9HeIMTWmg9Ppki6EPAyVF:GcjS45O9caMFHt1BWg9RkkBz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b69e67e14ce0c8ebf82ff5cc71af3599ddcd23f086ce68b48509eb180aaf035

Files

2b69e67e14ce0c8ebf82ff5cc71af3599ddcd23f086ce68b48509eb180aaf035
.dll windows:6 windows x64 arch:x64

b8d892ba0c3471060746c1f2baabf715

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

FactoryServer-WwiseEngineUtils.pdb

Imports

factoryserver-core

?HandleAtomicsFailure@FWindowsPlatformAtomics@@KAXPEB_WZZ
?Free@FMemory@@SAXPEAX@Z
??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FName@@QEAA@PEBDW4EFindName@@@Z
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??1FLogCategoryBase@@QEAA@XZ
?DoSetup@FThreadSafeStaticStatBase@@IEBAPEBUTStatIdData@@PEBDPEB_W001_N2W4Type@EStatDataType@@22W4EMemoryCounterRegion@FWindowsPlatformMemory@@@Z

factoryserver-engine

?FetchActor@FActorInstanceHandle@@QEBAPEAVAActor@@XZ

vcruntime140

__current_exception_context
__current_exception
memset
__C_specific_handler
memcpy
__std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm
_cexit
_crt_atexit
_initterm_e
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_execute_onexit_table
_crt_at_quick_exit

api-ms-win-crt-heap-l1-1-0

free

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
IsProcessorFeaturePresent
RtlCaptureContext

Exports

Exports

?GetActorFromHitResult@WwiseUnrealHelper@@YAPEAVAActor@@AEBUFHitResult@@@Z

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8d892ba0c3471060746c1f2baabf715

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

factoryserver-core

factoryserver-engine

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 816B

.pdata Size: 1024B - Virtual size: 864B

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 512B - Virtual size: 116B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 816B

.pdata
Size: 1024B - Virtual size: 864B

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 512B - Virtual size: 116B