Driver[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Driver.exe
Size

12.2MB
MD5

b1daf4383b3944a1b20f368615920892
SHA1

02d126ee2df3d3b46ca1f4068e7e3731f9a45afb
SHA256

c79987b0548f7130337c3f295c8fe269e120ceddad55c1159e6f5cbc6aa26616
SHA512

f328c1c974c84338a73c01b697aff89d6a7b4642ccee2779a05b5c81c3fe7bca6cfff49434c9d7955d41ed56e20805b989a2854f2b033de5d43fce9ef69d5499
SSDEEP

196608:qAhykL770fB9rkS/E24TaMswwAIfnOJR24YKrKefHH8MDbQiOFoP0A3z9:q4Y/rg+LwwCHh

Score

1^/10

Malware Config

Signatures

Files

Driver.exe
.exe windows:5 windows x86 arch:x86

1c6b9d0eb3e5878650d6b6b901e18e3a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:e0:d5:f7:95:b0:70:e0:1a:de:20:91:24:93:4f:5d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

16/12/2010, 00:00

Not After

02/03/2012, 23:59

Subject

CN=Ubisoft Entertainment,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ubisoft Entertainment,L=MONTREUIL,ST=Seine St Denis,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:a3:3c:d4:1b:5e:5d:c7:fe:2d:65:3b:f6:14:33:a1:2a:b6:e5:f2
Signer

Actual PE Digest

3d:a3:3c:d4:1b:5e:5d:c7:fe:2d:65:3b:f6:14:33:a1:2a:b6:e5:f2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathUnquoteSpacesW
PathRemoveArgsA
PathUnquoteSpacesA
PathRemoveFileSpecA
PathStripPathA
PathRemoveBackslashA
PathAddBackslashA

wininet

InternetSetCookieExA
InternetGetCookieExA

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses
GetIfEntry
GetBestInterface

binkw32

_BinkGetPlatformInfo@8
_BinkSetVolume@12
_BinkRequestStopAsyncThread@4
_BinkWaitStopAsyncThread@4
_BinkStartAsyncThread@8
_BinkSetMemory@8
_BinkSetSoundOnOff@8
_BinkWait@4
_BinkFreeGlobals@0
_BinkGoto@12
_BinkDoFrame@4
_BinkSetSoundSystem@8
_BinkShouldSkip@4
_BinkGetFrameBuffersInfo@8
_BinkRegisterFrameBuffers@8
_BinkDoFrameAsync@12
_BinkSetSoundTrack@8
_BinkSetIOSize@4
_BinkDoFrameAsyncWait@8
_BinkClose@4
_BinkGetRealtime@12
_BinkOpen@8
_BinkGetTrackID@8
_BinkSetVideoOnOff@8
_BinkPause@8
_BinkNextFrame@4
_BinkOpenDirectSound@4

xinput1_3

ord2
ord4
ord3

ws2_32

gethostname
setsockopt
shutdown
gethostbyaddr
getnameinfo
WSASetLastError
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAIoctl
connect
WSARecvFrom
socket
bind
accept
closesocket
ntohs
gethostbyname
WSASendTo
WSAGetLastError
__WSAFDIsSet
select
send
recvfrom
recv
listen
ioctlsocket
getsockopt
inet_addr
htons
ntohl
WSASocketA
WSAWaitForMultipleEvents
WSAGetOverlappedResult
inet_ntoa
htonl
WSAStartup
WSACleanup
getpeername
WSAResetEvent
getsockname
sendto

winhttp

WinHttpConnect
WinHttpSendRequest
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpWriteData

dfengine

GetDFEngine

ubiorbitapi_r2_loader

??1OrbitClient@orbitclient@mg@@QAE@XZ
?StartLauncher@OrbitClient@orbitclient@mg@@QAE_NIIPBD0@Z
?Update@OrbitClient@orbitclient@mg@@QAEXXZ
?GetInstallationErrorString@OrbitClient@orbitclient@mg@@QAEPAGPBD@Z
?GetInstallationErrorNum@OrbitClient@orbitclient@mg@@QAEIXZ
??0OrbitClient@orbitclient@mg@@QAE@XZ
?GetLoginDetails@OrbitClient@orbitclient@mg@@QAEXIPAVIGetLoginDetailsListener@23@@Z
?GetRequestUniqueId@OrbitClient@orbitclient@mg@@QAEIXZ
?GetSavegameList@OrbitClient@orbitclient@mg@@QAEXIPAVIGetSavegameListListener@23@I@Z
?GetSize@SavegameInfo@orbitclient@mg@@QAEIXZ
?GetSavegameId@SavegameInfo@orbitclient@mg@@QAEIXZ
?GetProductId@SavegameInfo@orbitclient@mg@@QAEIXZ
?GetName@SavegameInfo@orbitclient@mg@@QAEPBGXZ
?RemoveSavegame@OrbitClient@orbitclient@mg@@QAEXIPAVIRemoveSavegameListener@23@II@Z

kernel32

GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
GetTimeZoneInformation
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFullPathNameA
CompareStringW
CompareStringA
GetConsoleCP
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
EnumSystemLocalesA
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
LocalFileTimeToFileTime
SetFileTime
GetProcessHeap
GetSystemTimeAsFileTime
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetDriveTypeA
FileTimeToLocalFileTime
RtlUnwind
ExitProcess
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
HeapAlloc
HeapFree
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileW
HeapSize
SetEndOfFile
GetStartupInfoA
WaitForMultipleObjects
ResetEvent
GlobalAlloc
GetEnvironmentVariableA
FormatMessageA
SetThreadAffinityMask
SetEnvironmentVariableA
CreateEventW
WaitForMultipleObjectsEx
GetCurrentProcessId
DebugBreak
GetThreadPriority
SetThreadIdealProcessor
GetExitCodeThread
SetLastError
SleepEx
DisconnectNamedPipe
InterlockedDecrement
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
GetQueuedCompletionStatus
CreateIoCompletionPort
IsDebuggerPresent
SetConsoleCtrlHandler
SetThreadPriorityBoost
SuspendThread
RaiseException
TryEnterCriticalSection
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
FlushFileBuffers
CopyFileA
SetFileAttributesA
GetFileAttributesA
OpenThread
SwitchToThread
GetLogicalDriveStringsA
FlushConsoleInputBuffer
LoadLibraryA
FreeLibrary
GetStdHandle
GetFileType
GetVersion
ExpandEnvironmentStringsA
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemInfo
GetFileAttributesExA
MultiByteToWideChar
WideCharToMultiByte
CreateProcessA
CloseHandle
WaitForSingleObject
GetComputerNameA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ExitThread
SetEvent
Sleep
InitializeCriticalSection
CreateEventA
CreateThread
InitializeCriticalSectionAndSpinCount
LockResource
SizeofResource
LoadResource
GetModuleHandleA
FindResourceA
lstrcpyW
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateDirectoryA
GetProcAddress
GetVersionExA
FindClose
FindNextFileA
FindFirstFileA
GetFileTime
CreateFileA
GetTickCount
GetSystemTime
GetModuleFileNameA
GetLocalTime
VirtualQuery
GetThreadTimes
GetCurrentThread
GetProcessTimes
GetCurrentProcess
ReleaseSemaphore
VirtualAlloc
VirtualFree
CreateSemaphoreA
SetThreadPriority
OutputDebugStringA
GetLastError
ReadFile
WriteFile
GetFileSizeEx
GetOverlappedResult
DeleteFileA
MoveFileA
RemoveDirectoryA
TerminateProcess
GlobalFree
GetCommandLineW
GlobalMemoryStatus
GetCommandLineA
LocalFree
SystemTimeToFileTime
GetFileAttributesW
ExpandEnvironmentStringsW
GetCurrentThreadId
ResumeThread
SetFilePointer
FileTimeToSystemTime

user32

UnregisterClassA
SetWindowLongA
SetWindowPos
SetRect
DefWindowProcA
MonitorFromRect
GetMonitorInfoA
AdjustWindowRect
ClientToScreen
ClipCursor
CharLowerBuffW
CharUpperBuffW
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
GetSystemMetrics
LoadIconA
RegisterClassA
CreateWindowExA
UpdateWindow
DestroyWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardState
keybd_event
GetClientRect
SetCursor
GetWindowLongA
GetParent
GetForegroundWindow
GetActiveWindow
ShowWindow
SetForegroundWindow
BringWindowToTop
wsprintfW
GetKeyboardLayoutList
MessageBoxA
GetAsyncKeyState
ScreenToClient
GetCursorPos
PostQuitMessage

advapi32

ReportEventA
GetUserNameA
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
RegisterEventSourceA

shell32

CommandLineToArgvW
SHGetPathFromIDListA
ord155
ShellExecuteA
SHGetSpecialFolderPathA
ShellExecuteW
SHGetFolderPathA

ole32

CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoInitializeEx

oleaut32

SysAllocString
SysFreeString

imagehlp

SymGetModuleBase
SymFunctionTableAccess
StackWalk
SymGetLineFromAddr
SymGetSymFromAddr
UnDecorateSymbolName
SymGetOptions
SymSetOptions
SymInitialize
SymCleanup
SymGetModuleInfo

ddraw

DirectDrawCreateEx

dsound

ord12
ord11

dinput8

DirectInput8Create

winmm

mmioCreateChunk
mmioSeek
mmioSetInfo
mmioAdvance
mmioGetInfo
mmioClose
mmioOpenA
timeGetTime
mmioRead
mmioAscend
mmioWrite
mmioDescend

dbghelp

MiniDumpWriteDump

d3dx9_36

D3DXGetShaderConstantTable
D3DXCreateEffect
D3DXCreateTexture
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXSaveSurfaceToFileA

d3d9

D3DPERF_EndEvent
D3DPERF_BeginEvent
Direct3DCreate9

Exports

Exports

?AddPlayerMotionDevice@MotionEngine@AK@@YA?AW4AKRESULT@@EKKPAX@Z
?Break@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?BypassEnvironment@SoundEngine@AK@@YA?AW4AKRESULT@@K_N@Z
?CancelBankCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CancelEventCallback@SoundEngine@AK@@YAXK@Z
?CancelEventCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CheckPoolId@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ClearBanks@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ClearPreparedEvents@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?Close@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?Create@StreamMgr@AK@@YAPAVIAkStreamMgr@2@ABUAkStreamMgrSettings@@@Z
?CreateDevice@StreamMgr@AK@@YAKABUAkDeviceSettings@@PAVIAkLowLevelIOHook@12@@Z
?CreatePool@MemoryMgr@AK@@YAJPAXKKKK@Z
?CreateVorbisFilePlugin@@YAPAVIAkSoftwareCodec@@PAX@Z
?DestroyDevice@StreamMgr@AK@@YA?AW4AKRESULT@@K@Z
?DestroyPool@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?Falign@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?Free@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?GetBlock@MemoryMgr@AK@@YAPAXJ@Z
?GetDefaultDeviceSettings@StreamMgr@AK@@YAXAAUAkDeviceSettings@@@Z
?GetDefaultInitSettings@MusicEngine@AK@@YAXAAUAkMusicSettings@@@Z
?GetDefaultInitSettings@SoundEngine@AK@@YAXAAUAkInitSettings@@@Z
?GetDefaultPlatformInitSettings@SoundEngine@AK@@YAXAAUAkPlatformInitSettings@@@Z
?GetDefaultSettings@StreamMgr@AK@@YAXAAUAkStreamMgrSettings@@@Z
?GetFileLocationResolver@StreamMgr@AK@@YAPAVIAkFileLocationResolver@12@XZ
?GetIDFromString@SoundEngine@AK@@YAKPBD@Z
?GetIDFromString@SoundEngine@AK@@YAKPB_W@Z
?GetMaxPools@MemoryMgr@AK@@YAJXZ
?GetNumPools@MemoryMgr@AK@@YAJXZ
?GetPlayingSegmentInfo@MusicEngine@AK@@YA?AW4AKRESULT@@KAAUAkSegmentInfo@@@Z
?GetPoolAttributes@MemoryMgr@AK@@YA?AW4AkMemPoolAttributes@@J@Z
?GetPoolMemoryUsed@MemoryMgr@AK@@YAXJAAUPoolMemInfo@12@@Z
?GetPoolName@MemoryMgr@AK@@YAPA_WJ@Z
?GetPoolStats@MemoryMgr@AK@@YA?AW4AKRESULT@@JAAUPoolStats@12@@Z
?GetSourcePlayPosition@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ@Z
?GetSpeakerConfiguration@SoundEngine@AK@@YAKXZ
?GetTimeStamp@Monitor@AK@@YAJXZ
?Init@MusicEngine@AK@@YA?AW4AKRESULT@@PAUAkMusicSettings@@@Z
?Init@SoundEngine@AK@@YA?AW4AKRESULT@@PAUAkInitSettings@@PAUAkPlatformInitSettings@@@Z
?IsInitialized@MemoryMgr@AK@@YA_NXZ
?IsInitialized@SoundEngine@AK@@YA_NXZ
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KJ@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1J@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2JAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKP6AXKW43@JPAX@Z2AAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2JAAK@Z
?LockPlaylist@DynamicSequence@SoundEngine@AK@@YAPAVPlaylist@123@K@Z
?Malign@MemoryMgr@AK@@YAPAXJIK@Z
?Malloc@MemoryMgr@AK@@YAPAXJI@Z
?Open@DynamicSequence@SoundEngine@AK@@YAKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXW4DynamicSequenceType@123@@Z
?Pause@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?Play@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?PlaySourcePlugin@SoundEngine@AK@@YAKKKI@Z
?PostCode@Monitor@AK@@YA?AW4AKRESULT@@W4ErrorCode@12@W4ErrorLevel@12@@Z
?PostEvent@SoundEngine@AK@@YAKKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@@Z
?PostEvent@SoundEngine@AK@@YAKPBDIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@@Z
?PostEvent@SoundEngine@AK@@YAKPB_WIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PBDW4ErrorLevel@12@@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PB_WW4ErrorLevel@12@@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@KI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PBDI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WI@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KP6AXKW43@JPAX@Z2W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WW4AkBankContent@12@@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WKP6AXKW43@JPAX@Z3@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKKP6AXKW43@JPAX@Z4@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDKP6AXKW43@JPAX@Z5@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WKP6AXKW43@JPAX@Z5@Z
?RegisterCodec@SoundEngine@AK@@YA?AW4AKRESULT@@KKP6APAVIAkSoftwareCodec@@PAX@Z1@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@IPBD@Z
?RegisterMotionDevice@MotionEngine@AK@@YAXKKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@Z@Z
?RegisterPlugin@SoundEngine@AK@@YA?AW4AKRESULT@@W4AkPluginType@@KKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@ZP6APAVIAkPluginParam@2@1@Z@Z
?ReleaseBlock@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?RemovePlayerMotionDevice@MotionEngine@AK@@YAXEKK@Z
?RenderAudio@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KI@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDI@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WI@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKKPAKK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPBDPAPBDK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPB_WPAPB_WK@Z
?Resume@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KIM_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIM_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIM_N@Z
?SetActiveListeners@SoundEngine@AK@@YA?AW4AKRESULT@@IK@Z
?SetAttenuationScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetBankLoadIOSettings@SoundEngine@AK@@YA?AW4AKRESULT@@MD@Z
?SetEnvironmentVolume@SoundEngine@AK@@YA?AW4AKRESULT@@KM@Z
?SetEnvironmentVolumes@SoundEngine@AK@@YA?AW4AKRESULT@@KABUAkSpeakerVolumes@@@Z
?SetFileLocationResolver@StreamMgr@AK@@YAXPAVIAkFileLocationResolver@12@@Z
?SetGameObjectDryLevelValue@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetGameObjectEnvironmentsValues@SoundEngine@AK@@YA?AW4AKRESULT@@IPAUAkEnvironmentValue@@K@Z
?SetListenerPipeline@SoundEngine@AK@@YA?AW4AKRESULT@@K_N0@Z
?SetListenerPosition@SoundEngine@AK@@YA?AW4AKRESULT@@ABUAkListenerPosition@@K@Z
?SetListenerScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@KM@Z
?SetListenerSpatialization@SoundEngine@AK@@YA?AW4AKRESULT@@K_NPAUAkSpeakerVolumes@@@Z
?SetLocalOutput@Monitor@AK@@YA?AW4AKRESULT@@KP6AXW4ErrorCode@12@PB_WW4ErrorLevel@12@KI@Z@Z
?SetMonitoring@MemoryMgr@AK@@YA?AW4AKRESULT@@J_N@Z
?SetMultiplePositions@SoundEngine@AK@@YA?AW4AKRESULT@@IPBUAkSoundPosition@@GW4MultiPositionType@12@@Z
?SetObjectObstructionAndOcclusion@SoundEngine@AK@@YA?AW4AKRESULT@@IKMM@Z
?SetPlayerListener@MotionEngine@AK@@YAXEE@Z
?SetPlayerVolume@MotionEngine@AK@@YAXEM@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPBD@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPB_W@Z
?SetPosition@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetPositionInternal@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KMI@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDMI@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WMI@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@KK@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@KKI@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0I@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0I@Z
?SetVolumeThreshold@SoundEngine@AK@@YA?AW4AKRESULT@@M@Z
?StartOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W@Z
?Stop@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?StopAll@SoundEngine@AK@@YAXI@Z
?StopOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?StopPlayingID@SoundEngine@AK@@YAXK@Z
?StopSourcePlugin@SoundEngine@AK@@YA?AW4AKRESULT@@KKK@Z
?Term@MemoryMgr@AK@@YAXXZ
?Term@MusicEngine@AK@@YAXXZ
?Term@SoundEngine@AK@@YAXXZ
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WPAJ@Z
?UnlockPlaylist@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?UnregisterAllGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?UnregisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?m_pStreamMgr@IAkStreamMgr@AK@@1PAV12@A

Sections

.text
Size: 9.8MB - Virtual size: 9.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 921KB - Virtual size: 14.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 229B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c6b9d0eb3e5878650d6b6b901e18e3a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

62:e0:d5:f7:95:b0:70:e0:1a:de:20:91:24:93:4f:5dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

3d:a3:3c:d4:1b:5e:5d:c7:fe:2d:65:3b:f6:14:33:a1:2a:b6:e5:f2Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

wininet

iphlpapi

binkw32

xinput1_3

ws2_32

winhttp

dfengine

ubiorbitapi_r2_loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

imagehlp

ddraw

dsound

dinput8

winmm

dbghelp

d3dx9_36

d3d9

Exports

Exports

Sections

.text Size: 9.8MB - Virtual size: 9.8MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 921KB - Virtual size: 14.5MB

.tls Size: 512B - Virtual size: 229B

.rsrc Size: 284KB - Virtual size: 284KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

62:e0:d5:f7:95:b0:70:e0:1a:de:20:91:24:93:4f:5d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

3d:a3:3c:d4:1b:5e:5d:c7:fe:2d:65:3b:f6:14:33:a1:2a:b6:e5:f2
Signer

.text
Size: 9.8MB - Virtual size: 9.8MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 921KB - Virtual size: 14.5MB

.tls
Size: 512B - Virtual size: 229B

.rsrc
Size: 284KB - Virtual size: 284KB