OBS_OpenVR_InputPlugin_v1[.]5[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

OBS_OpenVR_InputPlugin_v1.5.zip
Size

376KB
MD5

ee896e6d5aa63aaa4a7a8026ef17f733
SHA1

e7b9d36bc14821c69c0091a917b79494786d1be8
SHA256

56c972a062395ab5da0e5ffefa9d396d9c238d3266a60dfed7f973f7421aaa84
SHA512

3256c814ef2d48de32b9be5eec83557eba8e153a8f2d9da522a819b728851a3023e0c4b911118243db43c054bd6d8417c04af2b628c15226302f7eade91cb268
SSDEEP

6144:Rc93EkfsdSCxCShKyIeJ1i9j8l9B3mjXMSOJsCGmasMc6gZHjx0joJxw:u2kfs0ACSh3f1i9jQ9Rq8SOiCGmaT6Hc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/obs-plugins/64bit/win-openvr.dll

Files

OBS_OpenVR_InputPlugin_v1.5.zip
.zip
data/obs-plugins/win-openvr/locale/en-US.ini
data/obs-plugins/win-openvr/locale/fi-FI.ini
data/obs-plugins/win-openvr/win-openvr-presets.ini
obs-plugins/64bit/openvr_api.dll
.dll windows:6 windows x64 arch:x64

2a6e52a9f3233429e2cd662fe9dedeef

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-10-2018 00:00

Not After

07-10-2021 12:00

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:31:cc:b4:2d:1c:8d:ed:fd:47:84:9f:5a:ad:f5:68:01:a2:38:1c
Signer

Actual PE Digest

2e:31:cc:b4:2d:1c:8d:ed:fd:47:84:9f:5a:ad:f5:68:01:a2:38:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steamvr_rel_win64\build\src\openvr_api\Retailopenvr_api\win64\2017\openvr_api.pdb

Imports

kernel32

GetModuleFileNameW
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryExA
MultiByteToWideChar
GetACP
GetEnvironmentVariableA
SetEnvironmentVariableA
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TryEnterCriticalSection
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LoadLibraryW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetCurrentProcess
TerminateProcess
ReadFile
GetDriveTypeW
GetFullPathNameW
GetCurrentDirectoryW
CreateFileW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetCurrentThread
HeapFree
GetStdHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
HeapAlloc
SetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapReAlloc
GetTimeZoneInformation
FlushFileBuffers
HeapSize
SetEndOfFile
WriteConsoleW
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue

shell32

SHGetFolderPathW

Exports

Exports

LiquidVR
VRCompositorSystemInternal
VRControlPanel
VRDriverDirectInternal
VRHeadsetView
VRPaths
VRRenderModelsInternal
VRSceneGraph
VRTrackedCameraInternal
VRVirtualDisplay
VR_GetGenericInterface
VR_GetInitToken
VR_GetRuntimePath
VR_GetStringForHmdError
VR_GetVRInitErrorAsEnglishDescription
VR_GetVRInitErrorAsSymbol
VR_InitInternal
VR_InitInternal2
VR_IsHmdPresent
VR_IsInterfaceVersionValid
VR_IsRuntimeInstalled
VR_RuntimePath
VR_ShutdownInternal

Sections

.text
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
obs-plugins/64bit/win-openvr.dll
.dll windows:6 windows x64 arch:x64

f7eb7d8ed7eeae47214802254da38db5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

obs

bmalloc
obs_properties_add_button
obs_find_module_file
obs_property_set_modified_callback
obs_property_set_visible
obs_property_set_description
obs_source_active
obs_get_base_effect
obs_properties_add_int_slider
obs_property_int_set_limits
obs_property_list_add_int
obs_register_source_s
gs_texture_open_shared
gs_texture_destroy
gs_effect_loop
text_lookup_getstr
text_lookup_destroy
bfree
obs_enter_graphics
obs_source_get_name
obs_leave_graphics
obs_module_load_locale
obs_source_draw
obs_properties_add_list
obs_properties_add_bool
obs_properties_get
obs_properties_create
obs_data_get_bool
obs_data_get_int
obs_data_set_default_bool
obs_data_set_default_int
obs_data_set_double
obs_data_set_int
blog

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount64

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

d3d11

D3D11CreateDevice

openvr_api

VR_GetInitToken
VR_IsInterfaceVersionValid
VR_GetGenericInterface
VR_InitInternal2
VR_ShutdownInternal

vcruntime140

memmove
__std_exception_destroy
__std_exception_copy
memset
__C_specific_handler
_CxxThrowException
__std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fopen
fclose
__stdio_common_vfscanf

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

Exports

Exports

obs_module_free_locale
obs_module_load
obs_module_set_locale
obs_module_set_pointer
obs_module_ver

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt

Sharing

General

Malware Config

Signatures

Files

2a6e52a9f3233429e2cd662fe9dedeef

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

2e:31:cc:b4:2d:1c:8d:ed:fd:47:84:9f:5a:ad:f5:68:01:a2:38:1cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Exports

Exports

Sections

.text Size: 530KB - Virtual size: 529KB

.rdata Size: 172KB - Virtual size: 171KB

.data Size: 14KB - Virtual size: 22KB

.pdata Size: 26KB - Virtual size: 25KB

.rsrc Size: 43KB - Virtual size: 43KB

.reloc Size: 6KB - Virtual size: 5KB

f7eb7d8ed7eeae47214802254da38db5

Headers

DLL Characteristics

File Characteristics

Imports

obs

kernel32

msvcp140

d3d11

openvr_api

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 76B

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

2e:31:cc:b4:2d:1c:8d:ed:fd:47:84:9f:5a:ad:f5:68:01:a2:38:1c
Signer

.text
Size: 530KB - Virtual size: 529KB

.rdata
Size: 172KB - Virtual size: 171KB

.data
Size: 14KB - Virtual size: 22KB

.pdata
Size: 26KB - Virtual size: 25KB

.rsrc
Size: 43KB - Virtual size: 43KB

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 76B