E:\GitHub\OGSR-Engine\bin_x64\xrEngine.pdb
Static task
static1
Behavioral task
behavioral1
Sample
xrEngine.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
xrEngine.exe
Resource
win10v2004-20240802-en
General
-
Target
xrEngine.exe
-
Size
13.8MB
-
MD5
99b49008d7ac722be3f8a655b2b8f156
-
SHA1
7503e4baaaf6ec478155c11ace6d14e631a74b83
-
SHA256
58ac3341209df06ff4b2d33bd441c9da28c34203a386ad018505defb954a5a0f
-
SHA512
ed503f15f820f5ff9f86261e87349833103b2277d0e032dd78cf3e1136cedfea53ac44cde378fdbbb1b161bd137a31400aea2989ede98baf9b5e1bb0a00dd180
-
SSDEEP
196608:2vnSe/nOZLaQacL/Yq+4a2efeS8FPmjj7KAa+jnTuLZOjWcZqxcj72vOAPpIqi:2PSe/nOZLaQpe8FPmjHKAa+jWvOCO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xrEngine.exe
Files
-
xrEngine.exe.exe windows:6 windows x64 arch:x64
Password: testingg
eafb763fec527a5c75dd40fbd16f31b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvfw32
ICClose
ICLocate
ICDecompress
ICSendMessage
avifil32
AVIFileRelease
AVIFileInfoA
AVIFileOpenA
AVIFileInit
winmm
timeBeginPeriod
mmioOpenA
mmioAscend
mmioSeek
timeGetTime
mmioRead
mmioDescend
mmioClose
timeEndPeriod
dinput8
DirectInput8Create
kernel32
LoadLibraryA
GetLastError
GetProcAddress
FreeLibrary
GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
OpenMutexA
CreateMutexA
CloseHandle
GetModuleHandleA
IsDebuggerPresent
WideCharToMultiByte
Sleep
GlobalMemoryStatusEx
K32GetProcessMemoryInfo
GetCurrentProcess
GetSystemInfo
SetFileAttributesA
GetCurrentThreadId
GetCurrentProcessId
WriteProcessMemory
SetUnhandledExceptionFilter
GetCommandLineA
GetModuleFileNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetComputerNameA
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
GetFileAttributesA
SetFilePointer
ReadFile
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadId
RaiseException
CreateEventA
SetEvent
WaitForSingleObject
GetVersion
GetLogicalProcessorInformation
GetSystemTimes
RtlCaptureContext
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
UnmapViewOfFile
FormatMessageA
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
TerminateProcess
GetStdHandle
GetEnvironmentVariableA
WriteConsoleA
FlsAlloc
FlsSetValue
FlsFree
GetProcessTimes
GetCurrentProcessorNumber
VirtualAlloc
VirtualFree
VirtualQuery
GetLargePageMinimum
VirtualUnlock
GetNumaHighestNodeNumber
GetNumaProcessorNode
GetNumaNodeProcessorMask
GetCurrentThread
VerifyVersionInfoW
VerSetConditionMask
OutputDebugStringA
SwitchToThread
user32
SetCursorPos
AdjustWindowRect
SetRect
CreateWindowExA
DefWindowProcA
RegisterClassA
LoadCursorA
LoadIconA
DispatchMessageA
TranslateMessage
PeekMessageA
ClipCursor
SetForegroundWindow
GetSystemMetrics
GetWindowRect
SetWindowLongPtrA
EnumDisplaySettingsA
MessageBoxA
MapWindowPoints
GetClientRect
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetClipboardData
ShowWindow
DestroyWindow
ShowCursor
LoadImageA
SendDlgItemMessageA
SystemParametersInfoA
CreateDialogParamA
SetWindowPos
GetDesktopWindow
MapVirtualKeyA
ToAscii
PostQuitMessage
GetCursorPos
MapVirtualKeyExA
ToAsciiEx
GetWindowThreadProcessId
GetKeyboardLayout
GetWindowLongPtrA
GetKeyboardState
ScreenToClient
GetAsyncKeyState
PostMessageA
gdi32
GetStockObject
ole32
CoInitializeEx
CoUninitialize
CoCreateGuid
msvcp140
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBAPEBDPEBD0PEA_W@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
_Thrd_yield
?get_new_handler@std@@YAP6AXXZXZ
_Xtime_get_ticks
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
_Last_write_time
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Xruntime_error@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Query_perf_counter
_Query_perf_frequency
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Thrd_join
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
??_7codecvt_base@std@@6B@
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?uncaught_exceptions@std@@YAHXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?id@?$ctype@_W@std@@2V0locale@2@A
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
??_7_Facet_base@std@@6B@
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strcoll
_Strxfrm
??_7facet@locale@std@@6B@
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Random_device@std@@YAIXZ
msvcp140_atomic_wait
__std_bulk_submit_threadpool_work
__std_close_threadpool_work
__std_wait_for_threadpool_work_callbacks
__std_create_threadpool_work
__std_parallel_algorithms_hw_threads
dbghelp
SymGetSymFromAddr64
MiniDumpWriteDump
SymGetModuleInfo64
SymGetLineFromAddr64
SymGetModuleBase64
SymFunctionTableAccess64
SymGetOptions
SymSetOptions
SymInitialize
SymCleanup
StackWalk64
powrprof
CallNtPowerInformation
luajit
lua_call
lua_error
lua_insert
lua_rawset
lua_rawseti
lua_pushlstring
lua_getfield
lua_dump
lua_tointeger
lua_objlen
lua_isuserdata
lua_isnumber
lua_typename
lua_getlocal
lua_getinfo
lua_getstack
lua_gc
luaL_newmetatable
lua_equal
lua_pushnumber
lua_setfield
lua_pushinteger
lua_createtable
lua_replace
lua_gettop
lua_settable
lua_pushcclosure
lua_pushlightuserdata
lua_setmetatable
lua_newuserdata
lua_getupvalue
lua_iscfunction
lua_close
lua_atpanic
luaL_openlibs
luaL_newstate
lua_remove
lua_rawget
lua_pcall
luaL_loadbuffer
lua_isstring
luaL_traceback
lua_pushvalue
lua_tolstring
lua_tonumber
lua_pushboolean
lua_pushnil
lua_next
lua_type
lua_settop
lua_toboolean
lua_gettable
lua_pushstring
lua_getmetatable
lua_touserdata
lua_rawgeti
vcruntime140
memset
memcpy
__std_type_info_name
__RTtypeid
__current_exception_context
__std_terminate
_CxxThrowException
_set_purecall_handler
strchr
__RTCastToVoid
strrchr
__C_specific_handler
__std_type_info_compare
strstr
memchr
__RTDynamicCast
memcmp
_purecall
__std_exception_destroy
__std_exception_copy
memmove
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-time-l1-1-0
_strdate
asctime
_time64
_tzset
_localtime64
_strtime
strftime
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
abort
_exit
terminate
_beginthreadex
_c_exit
_register_thread_local_exe_atexit_callback
exit
signal
_errno
__sys_errlist
_controlfp
_clearfp
_set_new_handler
_set_invalid_parameter_handler
_invalid_parameter_noinfo
_set_abort_behavior
set_terminate
quick_exit
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
__pctype_func
_create_locale
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strncpy_s
strtok
isspace
iswspace
strncmp
_strlwr
tolower
_strupr
isalpha
isalnum
strncpy
toupper
strcat_s
isprint
_strlwr_s
strcpy_s
_strupr_l
_strlwr_l
strcmp
strcspn
_stricmp
strncat_s
api-ms-win-crt-stdio-l1-1-0
fwrite
fread
_get_stream_buffer_pointers
fclose
_fseeki64
fsetpos
setvbuf
fflush
ungetc
fputc
fgetc
__stdio_common_vsprintf
fopen
__stdio_common_vsprintf_s
_sopen_dispatch
__stdio_common_vsnprintf_s
fseek
ftell
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
fgetpos
__stdio_common_vsscanf
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-math-l1-1-0
log
fmodf
floor
_fdopen
__setusermatherr
logf
cos
atanf
atan2f
expf
atan
_copysign
asinf
acosf
sinf
sqrt
tanf
_ldclass
_fdclass
_dclass
_dsign
_fpclass
_fdsign
exp
_ldsign
modff
cosf
ldexp
pow
powf
sin
api-ms-win-crt-convert-l1-1-0
wcstombs_s
mbstowcs
_itoa
strtol
atof
atoi
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_splitpath
_unlink
_findnext64i32
_findclose
_stat64i32
_rmdir
rename
_findfirst64i32
api-ms-win-crt-heap-l1-1-0
realloc
calloc
_heapwalk
malloc
_set_new_mode
free
openal32
alBufferData
alDeleteBuffers
alDeleteSources
alGenBuffers
alGenSources
alGetError
alGetProcAddress
alGetSourcei
alGetString
alIsExtensionPresent
alIsSource
alListener3f
alListenerf
alListenerfv
alSource3f
alSource3i
alSourcePlay
alSourceQueueBuffers
alSourceStop
alSourceUnqueueBuffers
alSourcef
alSourcei
alcCloseDevice
alcCreateContext
alcDestroyContext
alcGetContextsDevice
alcGetCurrentContext
alcGetError
alcGetIntegerv
alcGetString
alcIsExtensionPresent
alcMakeContextCurrent
alcOpenDevice
d3dx9_43
D3DXMatrixOrthoOffCenterLH
D3DXVec3TransformNormal
D3DXVec3TransformCoordArray
D3DXMatrixInverse
D3DXGetFVFVertexSize
D3DXVec3Normalize
D3DXDeclaratorFromFVF
D3DXGetDeclVertexSize
D3DXMatrixMultiply
D3DXMatrixTranslation
D3DXGetDeclLength
d3dx11_43
D3DX11LoadTextureFromTexture
D3DX11FilterTexture
D3DX11SaveTextureToMemory
D3DX11GetImageInfoFromMemory
D3DX11CreateTextureFromMemory
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DGetInputSignatureBlob
D3DCompile
D3DDisassemble
D3DReflect
dxgi
CreateDXGIFactory1
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
SystemFunction036
GetUserNameA
shell32
ShellExecuteA
Sections
.text Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 219KB - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ