oneshot[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

oneshot.exe
Size

4.6MB
MD5

f40ee5ae3483d8cef8d2730d77960009
SHA1

5b7e8b080386ddce13a1801137ba14d0b823b330
SHA256

20fb75156666d3c8df91d949c271d080367abbb7b20f9687c47985b70a9bb616
SHA512

4f1bbfa3ec5bd52c23bb0a0eccde17fb2fde0cfd79f3eb0b63ee009c6051ee29ea5a7015337e6767f0413dc05863381615c2567794d3277397d70521100d4dec
SSDEEP

49152:al4RKhzdk9kN02Jw1n6cIvxx7ZFMWtxHqWIOU16LYunFd48rik94bYvQ9chqTxqU:GzSpkcIb72GrFdykB302B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
oneshot.exe

Files

oneshot.exe
.exe windows:6 windows x64 arch:x64

7220a76b3ef64b5f316db6bacae32945

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

GetUserNameExW

shlwapi

PathRemoveFileSpecW

openal32

alcGetProcAddress
alGetBufferi
alcCloseDevice
alcOpenDevice
alcDestroyContext
alcMakeContextCurrent
alcCreateContext
alSourceUnqueueBuffers
alcGetString
alDeleteSources
alSourcef
alSourcei
alGetSourcei
alSourcePlay
alSourceStop
alGenBuffers
alDeleteBuffers
alGenSources
alSourceQueueBuffers
alBufferData
alGetSourcef
alSourcePause

x64-vcruntime140-ruby250

rb_enc_set_default_external
rb_num2long
rb_utf8_encoding
rb_float_value
rb_define_class
rb_enc_from_encoding
rb_enc_str_new
ruby_cleanup
rb_const_get
ruby_setup
rb_cObject
rb_eStandardError
ruby_sysinit
ruby_snprintf
rb_eFatal
rb_eArgError
rb_eIOError
rb_eTypeError
rb_class_path
rb_str_cat_cstr
rb_str_buf_append
rb_str_buf_new
rb_str_new_cstr
rb_str_new
rb_int2big
rb_str_catf
rb_sprintf
rb_data_typed_object_wrap
rb_define_method
rb_obj_class
rb_obj_is_kind_of
rb_protect
rb_block_proc
rb_exc_raise
rb_singleton_class
rb_ary_entry
rb_ary_shift
rb_ary_pop
rb_ary_push
rb_ary_store
rb_rescue2
rb_raise
rb_gv_get
rb_define_singleton_method
rb_error_arity
rb_define_alloc_func
rb_obj_alloc
rb_obj_init_copy
rb_float_new
rb_gv_set
rb_funcallv
rb_typeddata_is_kind_of
rb_eval_string
fclose
getenv
rb_mKernel
rb_check_typeddata
rb_eException
rb_iv_get
rb_iv_set
rb_obj_call_init
rb_obj_as_string
rb_ary_new_capa
rb_eSystemExit
rb_intern
rb_id2sym
rb_hash_new
rb_hash_lookup2
rb_hash_aset
rb_string_value_cstr
rb_const_set
rb_errinfo
rb_define_module
rb_define_global_const
rb_ary_new
rb_proc_new
rb_define_module_function
rb_define_alias
rb_gc_start
rb_io_close
rb_file_open_str
rb_enc_associate_index
rb_utf8_encindex
rb_cIO
rb_uint2big
rb_define_module_under
rb_str_to_str
rb_sym2id
rb_eval_string_protect

user32

GetDesktopWindow
GetSysColor
SetSysColors
SystemParametersInfoW
wsprintfW
IsClipboardFormatAvailable
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
TrackMouseEvent
SendMessageW
RegisterClassW
CreateWindowExW
ShowWindow
SetLayeredWindowAttributes
SetWindowPos
GetFocus
SetForegroundWindow
GetDC
ReleaseDC
SetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
CreateIconFromResource
SetWindowRgn
SetCursorPos
LoadCursorW
CreateIconIndirect
RegisterRawInputDevices
GetSystemMetrics
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
EmptyClipboard
RegisterDeviceNotificationW
UnregisterDeviceNotification
PostThreadMessageW
SetTimer
KillTimer
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetFocus
DrawTextW
SystemParametersInfoA
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetClipboardData
SetClipboardData
GetClipboardSequenceNumber
CloseClipboard
OpenClipboard
GetDoubleClickTime
GetRawInputData
DestroyIcon
LoadIconW
GetWindowLongW
IsRectEmpty
ClipCursor
WindowFromPoint
ScreenToClient
GetClipCursor
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetPropW
ValidateRect
InvalidateRect
GetUpdateRect
GetMenu
GetAsyncKeyState
GetKeyState
IsIconic
IsWindowVisible
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
GetMessageExtraInfo
PeekMessageW
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
ClientToScreen

gdi32

CreateDIBSection
CreateDCW
GetDeviceGammaRamp
SetDeviceGammaRamp
CombineRgn
CreateRectRgn
CreateBitmap
CreateCompatibleBitmap
GetDIBits
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
SwapBuffers
BitBlt
CreateFontIndirectW
GetTextExtentPoint32A
GetTextMetricsW
SelectObject
DeleteObject
DeleteDC
GetDeviceCaps
CreateCompatibleDC

winmm

timeGetTime
PlaySoundW
waveOutUnprepareHeader
waveOutGetNumDevs
waveOutGetDevCapsW
waveOutGetErrorTextW
timeBeginPeriod
waveOutOpen
waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveOutReset
waveOutWrite
waveOutClose
waveOutPrepareHeader
timeEndPeriod

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmNotifyIME
ImmSetCompositionWindow
ImmGetIMEFileNameA

ole32

CoUninitialize
CoTaskMemFree
CoInitializeEx
PropVariantClear
CoCreateInstance

oleaut32

SysFreeString

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

advapi32

RegQueryValueExW
RegOpenKeyExW
GetUserNameW
RegSetValueExW
RegOpenKeyW
RegCreateKeyExW
RegCloseKey
OpenProcessToken

shell32

DragFinish
DragQueryFileW
DragAcceptFiles
ExtractIconExW
SHGetFolderPathW

sigc-vc120-2_0

??0slot_rep@internal@sigc@@QEAA@P6APEAXPEAX@Z11@Z
??1signal_base@sigc@@QEAA@XZ
??0signal_base@sigc@@QEAA@XZ
??1signal_exec@internal@sigc@@QEAA@XZ
??0signal_exec@internal@sigc@@QEAA@PEBUsignal_impl@12@@Z
?blocked@slot_base@sigc@@QEBA_NXZ
?empty@slot_base@sigc@@QEBA_NXZ
??1slot_base@sigc@@QEAA@XZ
??0slot_base@sigc@@QEAA@$$QEAV01@@Z
?set_slot@connection@sigc@@AEAAXPEAVslot_base@2@@Z
?disconnect@connection@sigc@@QEAAXXZ
??1connection@sigc@@QEAA@XZ
??0connection@sigc@@QEAA@XZ
?connect@signal_base@sigc@@IEAA?AV?$_List_iterator@V?$_List_val@U?$_List_simple_types@Vslot_base@sigc@@@std@@@std@@@std@@$$QEAVslot_base@2@@Z
??0slot_base@sigc@@QEAA@PEAUslot_rep@internal@1@@Z
??0slot_do_unbind@internal@sigc@@QEAA@PEAUslot_rep@12@@Z
??2slot_rep@internal@sigc@@SAPEAX_K@Z
??0slot_do_bind@internal@sigc@@QEAA@PEAUslot_rep@12@@Z
??0slot_base@sigc@@QEAA@XZ

kernel32

GetConsoleMode
AttachConsole
lstrlenW
lstrlenA
OutputDebugStringW
GetStdHandle
ExitProcess
SetThreadPriority
WaitForSingleObjectEx
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionEx
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LoadLibraryA
GetModuleHandleW
GetCurrentThreadId
CreateThread
GetCurrentProcess
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetErrorMode
GetVolumeInformationA
SetFilePointer
Process32Next
GetFileSize
GetFileAttributesExW
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindClose
DeleteFileW
CreateDirectoryW
GetModuleFileNameW
CreateProcessW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
FlushFileBuffers
CreateFileW
MultiByteToWideChar
GetFullPathNameW
PeekNamedPipe
CloseHandle
WriteFile
GetEnvironmentVariableA
CreateNamedPipeA
CancelIo
ReadFile
CreateFileA
GetLocaleInfoW
WideCharToMultiByte
GetVersionExW
GetLastError
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
ReleaseSemaphore
CreateSemaphoreW
Sleep
VirtualAlloc
VirtualFree
VirtualQuery
SetEnvironmentVariableA
WriteConsoleW
SetFilePointerEx
GetTickCount
SetThreadExecutionState
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
lstrcatW
CreateToolhelp32Snapshot
GetCommandLineW
Process32First
IsDebuggerPresent
RaiseException
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
TlsAlloc
TlsGetValue
TlsSetValue
VerSetConditionMask
FormatMessageW
VerifyVersionInfoW
GlobalAlloc
GlobalUnlock
GlobalLock
CompareStringA
MulDiv
CreateEventW
GetSystemPowerStatus
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ResetEvent
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RemoveDirectoryW
FindFirstFileW

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?exceptions@ios_base@std@@QEAAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?classic@locale@std@@SAAEBV12@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
??Bid@locale@std@@QEAA_KXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
_purecall
memset
strstr
memcmp
memchr
__std_type_info_compare
strchr
strrchr
longjmp
__C_specific_handler
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_set_app_type
_invalid_parameter_noinfo_noreturn
_wassert
_get_narrow_winmain_command_line
_initterm
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_errno
strerror
abort
_initialize_narrow_environment
exit
_seh_filter_exe
_cexit
_endthreadex
_beginthreadex
terminate

api-ms-win-crt-stdio-l1-1-0

fgets
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
_lseek
fwrite
__stdio_common_vsprintf
_read
_open
fflush
_close
ftell
fseek
__p__commode
_set_fmode
fopen
fread

api-ms-win-crt-math-l1-1-0

exp
ldexp
log
atan2
sqrt
__setusermatherr
cos
atan
fmod
sin
pow
sqrtf
tan
sinf
floor
ceil

api-ms-win-crt-string-l1-1-0

tolower
strncmp
strncpy
_strnicmp
_strdup
strcmp
strtok
toupper
_stricmp

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_callnewh
realloc
_set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-convert-l1-1-0

atoi
strtol
strtoull
atof

api-ms-win-crt-utility-l1-1-0

qsort
srand
bsearch
rand

api-ms-win-crt-time-l1-1-0

_mktime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_chdir

Exports

Exports

FT_Activate_Size
FT_Add_Default_Modules
FT_Add_Module
FT_Angle_Diff
FT_Atan2
FT_Attach_File
FT_Attach_Stream
FT_Bitmap_Convert
FT_Bitmap_Copy
FT_Bitmap_Done
FT_Bitmap_Embolden
FT_Bitmap_Init
FT_Bitmap_New
FT_CeilFix
FT_Cos
FT_DivFix
FT_Done_Face
FT_Done_FreeType
FT_Done_Glyph
FT_Done_Library
FT_Done_Size
FT_Face_GetCharVariantIndex
FT_Face_GetCharVariantIsDefault
FT_Face_GetCharsOfVariant
FT_Face_GetVariantSelectors
FT_Face_GetVariantsOfChar
FT_Face_Properties
FT_FloorFix
FT_Get_Advance
FT_Get_Advances
FT_Get_CMap_Format
FT_Get_CMap_Language_ID
FT_Get_Char_Index
FT_Get_Charmap_Index
FT_Get_First_Char
FT_Get_Font_Format
FT_Get_Glyph
FT_Get_Glyph_Name
FT_Get_Kerning
FT_Get_Module
FT_Get_Name_Index
FT_Get_Next_Char
FT_Get_Postscript_Name
FT_Get_Renderer
FT_Get_Sfnt_LangTag
FT_Get_Sfnt_Name
FT_Get_Sfnt_Name_Count
FT_Get_Sfnt_Table
FT_Get_SubGlyph_Info
FT_Get_Track_Kerning
FT_Get_TrueType_Engine_Type
FT_Get_X11_Font_Format
FT_GlyphSlot_Own_Bitmap
FT_Glyph_Copy
FT_Glyph_Get_CBox
FT_Glyph_Stroke
FT_Glyph_StrokeBorder
FT_Glyph_To_Bitmap
FT_Glyph_Transform
FT_Gzip_Uncompress
FT_Init_FreeType
FT_Library_SetLcdFilter
FT_Library_SetLcdFilterWeights
FT_Library_Version
FT_List_Add
FT_List_Finalize
FT_List_Find
FT_List_Insert
FT_List_Iterate
FT_List_Remove
FT_List_Up
FT_Load_Char
FT_Load_Glyph
FT_Load_Sfnt_Table
FT_Matrix_Invert
FT_Matrix_Multiply
FT_MulDiv
FT_MulFix
FT_New_Face
FT_New_Library
FT_New_Memory_Face
FT_New_Size
FT_Open_Face
FT_Outline_Check
FT_Outline_Copy
FT_Outline_Decompose
FT_Outline_Done
FT_Outline_Done_Internal
FT_Outline_Embolden
FT_Outline_EmboldenXY
FT_Outline_GetInsideBorder
FT_Outline_GetOutsideBorder
FT_Outline_Get_Bitmap
FT_Outline_Get_CBox
FT_Outline_Get_Orientation
FT_Outline_New
FT_Outline_New_Internal
FT_Outline_Render
FT_Outline_Reverse
FT_Outline_Transform
FT_Outline_Translate
FT_Property_Get
FT_Property_Set
FT_Reference_Face
FT_Reference_Library
FT_Remove_Module
FT_Render_Glyph
FT_Request_Size
FT_RoundFix
FT_Select_Charmap
FT_Select_Size
FT_Set_Char_Size
FT_Set_Charmap
FT_Set_Debug_Hook
FT_Set_Default_Properties
FT_Set_Pixel_Sizes
FT_Set_Renderer
FT_Set_Transform
FT_Sfnt_Table_Info
FT_Sin
FT_Stream_OpenBzip2
FT_Stream_OpenGzip
FT_Stream_OpenLZW
FT_Stroker_BeginSubPath
FT_Stroker_ConicTo
FT_Stroker_CubicTo
FT_Stroker_Done
FT_Stroker_EndSubPath
FT_Stroker_Export
FT_Stroker_ExportBorder
FT_Stroker_GetBorderCounts
FT_Stroker_GetCounts
FT_Stroker_LineTo
FT_Stroker_New
FT_Stroker_ParseOutline
FT_Stroker_Rewind
FT_Stroker_Set
FT_Tan
FT_Vector_From_Polar
FT_Vector_Length
FT_Vector_Polarize
FT_Vector_Rotate
FT_Vector_Transform
FT_Vector_Unit
IMG_Init
IMG_Linked_Version
IMG_Load
IMG_LoadBMP_RW
IMG_LoadCUR_RW
IMG_LoadGIF_RW
IMG_LoadICO_RW
IMG_LoadJPG_RW
IMG_LoadLBM_RW
IMG_LoadPCX_RW
IMG_LoadPNG_RW
IMG_LoadPNM_RW
IMG_LoadSVG_RW
IMG_LoadTGA_RW
IMG_LoadTIF_RW
IMG_LoadTexture
IMG_LoadTextureTyped_RW
IMG_LoadTexture_RW
IMG_LoadTyped_RW
IMG_LoadWEBP_RW
IMG_LoadXCF_RW
IMG_LoadXPM_RW
IMG_LoadXV_RW
IMG_Load_RW
IMG_Quit
IMG_ReadXPMFromArray
IMG_SaveJPG
IMG_SaveJPG_RW
IMG_SavePNG
IMG_SavePNG_RW
IMG_isBMP
IMG_isCUR
IMG_isGIF
IMG_isICO
IMG_isJPG
IMG_isLBM
IMG_isPCX
IMG_isPNG
IMG_isPNM
IMG_isSVG
IMG_isTIF
IMG_isWEBP
IMG_isXCF
IMG_isXPM
IMG_isXV
PHYSFS_addToSearchPath
PHYSFS_caseFold
PHYSFS_close
PHYSFS_deinit
PHYSFS_delete
PHYSFS_deregisterArchiver
PHYSFS_enumerate
PHYSFS_enumerateFiles
PHYSFS_enumerateFilesCallback
PHYSFS_eof
PHYSFS_exists
PHYSFS_fileLength
PHYSFS_flush
PHYSFS_freeList
PHYSFS_getAllocator
PHYSFS_getBaseDir
PHYSFS_getCdRomDirs
PHYSFS_getCdRomDirsCallback
PHYSFS_getDirSeparator
PHYSFS_getErrorByCode
PHYSFS_getLastError
PHYSFS_getLastErrorCode
PHYSFS_getLastModTime
PHYSFS_getLinkedVersion
PHYSFS_getMountPoint
PHYSFS_getPrefDir
PHYSFS_getRealDir
PHYSFS_getSearchPath
PHYSFS_getSearchPathCallback
PHYSFS_getUserDir
PHYSFS_getWriteDir
PHYSFS_init
PHYSFS_isDirectory
PHYSFS_isInit
PHYSFS_isSymbolicLink
PHYSFS_mkdir
PHYSFS_mount
PHYSFS_mountHandle
PHYSFS_mountIo
PHYSFS_mountMemory
PHYSFS_openAppend
PHYSFS_openRead
PHYSFS_openWrite
PHYSFS_permitSymbolicLinks
PHYSFS_read
PHYSFS_readBytes
PHYSFS_readSBE16
PHYSFS_readSBE32
PHYSFS_readSBE64
PHYSFS_readSLE16
PHYSFS_readSLE32
PHYSFS_readSLE64
PHYSFS_readUBE16
PHYSFS_readUBE32
PHYSFS_readUBE64
PHYSFS_readULE16
PHYSFS_readULE32
PHYSFS_readULE64
PHYSFS_registerArchiver
PHYSFS_removeFromSearchPath
PHYSFS_seek
PHYSFS_setAllocator
PHYSFS_setBuffer
PHYSFS_setErrorCode
PHYSFS_setSaneConfig
PHYSFS_setWriteDir
PHYSFS_stat
PHYSFS_supportedArchiveTypes
PHYSFS_swapSBE16
PHYSFS_swapSBE32
PHYSFS_swapSBE64
PHYSFS_swapSLE16
PHYSFS_swapSLE32
PHYSFS_swapSLE64
PHYSFS_swapUBE16
PHYSFS_swapUBE32
PHYSFS_swapUBE64
PHYSFS_swapULE16
PHYSFS_swapULE32
PHYSFS_swapULE64
PHYSFS_symbolicLinksPermitted
PHYSFS_tell
PHYSFS_ucs4stricmp
PHYSFS_unmount
PHYSFS_utf16stricmp
PHYSFS_utf8FromLatin1
PHYSFS_utf8FromUcs2
PHYSFS_utf8FromUcs4
PHYSFS_utf8FromUtf16
PHYSFS_utf8ToUcs2
PHYSFS_utf8ToUcs4
PHYSFS_utf8ToUtf16
PHYSFS_utf8stricmp
PHYSFS_write
PHYSFS_writeBytes
PHYSFS_writeSBE16
PHYSFS_writeSBE32
PHYSFS_writeSBE64
PHYSFS_writeSLE16
PHYSFS_writeSLE32
PHYSFS_writeSLE64
PHYSFS_writeUBE16
PHYSFS_writeUBE32
PHYSFS_writeUBE64
PHYSFS_writeULE16
PHYSFS_writeULE32
PHYSFS_writeULE64
SDL_AddEventWatch
SDL_AddHintCallback
SDL_AddTimer
SDL_AllocFormat
SDL_AllocPalette
SDL_AllocRW
SDL_AtomicAdd
SDL_AtomicCAS
SDL_AtomicCASPtr
SDL_AtomicGet
SDL_AtomicGetPtr
SDL_AtomicLock
SDL_AtomicSet
SDL_AtomicSetPtr
SDL_AtomicTryLock
SDL_AtomicUnlock
SDL_AudioInit
SDL_AudioQuit
SDL_AudioStreamAvailable
SDL_AudioStreamClear
SDL_AudioStreamFlush
SDL_AudioStreamGet
SDL_AudioStreamPut
SDL_BuildAudioCVT
SDL_CalculateGammaRamp
SDL_CaptureMouse
SDL_ClearError
SDL_ClearHints
SDL_ClearQueuedAudio
SDL_CloseAudio
SDL_CloseAudioDevice
SDL_ComposeCustomBlendMode
SDL_CondBroadcast
SDL_CondSignal
SDL_CondWait
SDL_CondWaitTimeout
SDL_ConvertAudio
SDL_ConvertPixels
SDL_ConvertSurface
SDL_ConvertSurfaceFormat
SDL_CreateColorCursor
SDL_CreateCond
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateRGBSurfaceWithFormat
SDL_CreateRGBSurfaceWithFormatFrom
SDL_CreateRenderer
SDL_CreateSemaphore
SDL_CreateShapedWindow
SDL_CreateSoftwareRenderer
SDL_CreateSystemCursor
SDL_CreateTexture
SDL_CreateTextureFromSurface
SDL_CreateThread
SDL_CreateThreadWithStackSize
SDL_CreateWindow
SDL_CreateWindowAndRenderer
SDL_CreateWindowFrom
SDL_DXGIGetOutputInfo
SDL_DYNAPI_entry
SDL_DelEventWatch
SDL_DelHintCallback
SDL_Delay
SDL_DequeueAudio
SDL_DestroyCond
SDL_DestroyMutex
SDL_DestroyRenderer
SDL_DestroySemaphore
SDL_DestroyTexture
SDL_DestroyWindow
SDL_DetachThread
SDL_Direct3D9GetAdapterIndex
SDL_DisableScreenSaver
SDL_DuplicateSurface
SDL_EnableScreenSaver
SDL_EnclosePoints
SDL_Error
SDL_EventState
SDL_FillRect
SDL_FillRects
SDL_FilterEvents
SDL_FlushEvent
SDL_FlushEvents
SDL_FreeAudioStream
SDL_FreeCursor
SDL_FreeFormat
SDL_FreePalette
SDL_FreeRW
SDL_FreeSurface
SDL_FreeWAV
SDL_GL_BindTexture
SDL_GL_CreateContext
SDL_GL_DeleteContext
SDL_GL_ExtensionSupported
SDL_GL_GetAttribute
SDL_GL_GetCurrentContext
SDL_GL_GetCurrentWindow
SDL_GL_GetDrawableSize
SDL_GL_GetProcAddress
SDL_GL_GetSwapInterval
SDL_GL_LoadLibrary
SDL_GL_MakeCurrent
SDL_GL_ResetAttributes
SDL_GL_SetAttribute
SDL_GL_SetSwapInterval
SDL_GL_SwapWindow
SDL_GL_UnbindTexture
SDL_GL_UnloadLibrary
SDL_GameControllerAddMapping
SDL_GameControllerAddMappingsFromRW
SDL_GameControllerClose
SDL_GameControllerEventState
SDL_GameControllerFromInstanceID
SDL_GameControllerGetAttached
SDL_GameControllerGetAxis
SDL_GameControllerGetAxisFromString
SDL_GameControllerGetBindForAxis
SDL_GameControllerGetBindForButton
SDL_GameControllerGetButton
SDL_GameControllerGetButtonFromString
SDL_GameControllerGetJoystick
SDL_GameControllerGetPlayerIndex
SDL_GameControllerGetProduct
SDL_GameControllerGetProductVersion
SDL_GameControllerGetStringForAxis
SDL_GameControllerGetStringForButton
SDL_GameControllerGetVendor
SDL_GameControllerMapping
SDL_GameControllerMappingForDeviceIndex
SDL_GameControllerMappingForGUID
SDL_GameControllerMappingForIndex
SDL_GameControllerName
SDL_GameControllerNameForIndex
SDL_GameControllerNumMappings
SDL_GameControllerOpen
SDL_GameControllerRumble
SDL_GameControllerUpdate
SDL_GetAssertionHandler
SDL_GetAssertionReport
SDL_GetAudioDeviceName
SDL_GetAudioDeviceStatus
SDL_GetAudioDriver
SDL_GetAudioStatus
SDL_GetBasePath
SDL_GetCPUCacheLineSize
SDL_GetCPUCount
SDL_GetClipRect
SDL_GetClipboardText
SDL_GetClosestDisplayMode
SDL_GetColorKey
SDL_GetCurrentAudioDriver
SDL_GetCurrentDisplayMode
SDL_GetCurrentVideoDriver
SDL_GetCursor
SDL_GetDefaultAssertionHandler
SDL_GetDefaultCursor
SDL_GetDesktopDisplayMode
SDL_GetDisplayBounds
SDL_GetDisplayDPI
SDL_GetDisplayMode
SDL_GetDisplayName
SDL_GetDisplayOrientation
SDL_GetDisplayUsableBounds
SDL_GetError
SDL_GetEventFilter
SDL_GetGlobalMouseState
SDL_GetGrabbedWindow
SDL_GetHint
SDL_GetHintBoolean
SDL_GetKeyFromName
SDL_GetKeyFromScancode
SDL_GetKeyName
SDL_GetKeyboardFocus
SDL_GetKeyboardState
SDL_GetMemoryFunctions
SDL_GetModState
SDL_GetMouseFocus
SDL_GetMouseState
SDL_GetNumAllocations
SDL_GetNumAudioDevices
SDL_GetNumAudioDrivers
SDL_GetNumDisplayModes
SDL_GetNumRenderDrivers
SDL_GetNumTouchDevices
SDL_GetNumTouchFingers
SDL_GetNumVideoDisplays
SDL_GetNumVideoDrivers
SDL_GetPerformanceCounter
SDL_GetPerformanceFrequency
SDL_GetPixelFormatName
SDL_GetPlatform
SDL_GetPowerInfo
SDL_GetPrefPath
SDL_GetQueuedAudioSize
SDL_GetRGB
SDL_GetRGBA
SDL_GetRelativeMouseMode
SDL_GetRelativeMouseState
SDL_GetRenderDrawBlendMode
SDL_GetRenderDrawColor
SDL_GetRenderDriverInfo
SDL_GetRenderTarget

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 968KB - Virtual size: 968KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7220a76b3ef64b5f316db6bacae32945

Headers

DLL Characteristics

File Characteristics

Imports

secur32

shlwapi

openal32

x64-vcruntime140-ruby250

user32

gdi32

winmm

imm32

ole32

oleaut32

version

advapi32

shell32

sigc-vc120-2_0

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 968KB - Virtual size: 968KB

.data Size: 95KB - Virtual size: 192KB

.pdata Size: 165KB - Virtual size: 165KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 968KB - Virtual size: 968KB

.data
Size: 95KB - Virtual size: 192KB

.pdata
Size: 165KB - Virtual size: 165KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 13KB - Virtual size: 13KB