factorio[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
factorio.exe
Size 41.5MB
Sample261001-pg4vsswxfx
SHA256 38d946de7b89edb48c76e0c02f86146b56f266e5fc5737bfa5219a7034dcf392
MD5 468ce4088d36a45a380f52a29df09076
SHA1 b340b5b86dc79a16ebe73c27c7e1b1da98c95fb0
SHA512 5e333d0ad7b76576f9e05c17c9b1d9a888d253a4218757cad81ff38e872857a14a1d4890b291bcd915583aa7646336a052cd009a355e42b94eaf3dfa7e152518
SSDEEP 393216:0blbspJVab0hRZSSjV0vwaTVQzJVxIWwC40BhFyN:mbmMwgC4SF4
TLSH
T19E973A0672A305DDE176D0788507DE22E6B2F46543709BEB13B105AA8FDF7E85E7B220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

factorio.exe

.exe 41.5MB

factorio.exe

IMPHASH b7116f17ff2d2fdda62ab6606efbc89c
SHA256 38d946de7b89edb48c76e0c02f86146b56f266e5fc5737bfa5219a7034dcf392
MD5 468ce4088d36a45a380f52a29df09076
SHA1 b340b5b86dc79a16ebe73c27c7e1b1da98c95fb0
SHA512 5e333d0ad7b76576f9e05c17c9b1d9a888d253a4218757cad81ff38e872857a14a1d4890b291bcd915583aa7646336a052cd009a355e42b94eaf3dfa7e152518
SSDEEP 393216:0blbspJVab0hRZSSjV0vwaTVQzJVxIWwC40BhFyN:mbmMwgC4SF4
TLSH
T19E973A0672A305DDE176D0788507DE22E6B2F46543709BEB13B105AA8FDF7E85E7B220
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

5c:a4:97:94:96:5d:0d:f4:2e:aa:03:81:26:25:8d:b4:4f:5f:3a:d9:06:af:f0:99:c3:de:31:03:8c:a9:1d:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Wube Software Ltd,O=Wube Software Ltd,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c14737570706f727440666163746f72696f2e636f6d

Chains

May 21, 2026

CN=Wube Software Ltd,O=Wube Software Ltd,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c14737570706f727440666163746f72696f2e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Wube Software Ltd,O=Wube Software Ltd,L=London,ST=London,C=GB,1.2.840.113549.1.9.1=#0c14737570706f727440666163746f72696f2e636f6d

Serial Number

36:a4:cf:f5:da:8d:79:0a:66:b2:fa:ad

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2025 - Aug 15, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

27214792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\build\AppData\Local\Temp\factorio-build-37qY35\bin\FinalSteamReleasex64vsbt\factorio.pdb

steam_api64

SteamAPI_UnregisterCallback SteamAPI_RunCallbacks SteamInternal_FindOrCreateUserInterface SteamAPI_UnregisterCallResult SteamAPI_Init SteamAPI_RestartAppIfNecessary SteamAPI_RegisterCallback SteamAPI_RegisterCallResult SteamAPI_GetHSteamUser SteamAPI_Shutdown SteamInternal_ContextInit

dnsapi

DnsFree DnsQuery_UTF8

wldap32

ord301 ord211 ord22 ord46 ord45 ord26 ord27 ord200 ord79 ord60 ord33 ord41 ord32 ord35 ord30 ord143 ord50 ord217

gdi32

SelectObject CreateSolidBrush DeleteObject CreateBitmap CreateDIBSection DeleteDC GetDeviceCaps GetDeviceGammaRamp CreateDCW SetDeviceGammaRamp GetICMProfileW CombineRgn GetStockObject GetDIBits CreateCompatibleBitmap SetPixelFormat GetPixelFormat SwapBuffers ChoosePixelFormat DescribePixelFormat CreateFontIndirectW GetTextMetricsW CreateCompatibleDC GetTextExtentPoint32A BitBlt Rectangle SetDCBrushColor CreateRectRgn

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree PropVariantClear CLSIDFromString CoInitialize

winmm

timeBeginPeriod timeEndPeriod

gdiplus

GdipGetImageWidth GdipSaveImageToStream GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipBitmapLockBits GdipFree GdipDisposeImage GdipAlloc GdipCreateBitmapFromStream GdipBitmapUnlockBits GdipCloneImage GdipGetImageEncoders GdipGetImageHeight GdipGetImageEncodersSize

shell32

SHGetFolderPathW ord155 DragQueryFileW DragFinish DragAcceptFiles SHOpenFolderAndSelectItems ShellExecuteW ord190

shlwapi

ord12

user32

MonitorFromPoint EnumDisplayDevicesW EnumDisplaySettingsW SetWindowRgn GetWindowThreadProcessId GetWindowTextLengthW GetFocus MonitorFromRect MonitorFromWindow SetActiveWindow SetWindowLongPtrW SendMessageW RemovePropW SetWindowTextW GetWindowLongPtrW ShowWindow GetMonitorInfoW RegisterClassW AttachThreadInput CreateIconFromResource UnhookWindowsHookEx SetLayeredWindowAttributes IntersectRect SetFocus SetPropW SetWindowsHookExW FlashWindowEx SetWindowLongW GetParent PtInRect SetForegroundWindow GetWindowTextW CopyImage CreateIconIndirect LoadCursorW SetCapture SystemParametersInfoW ReleaseCapture SetCursorPos ReleaseDC RegisterRawInputDevices GetMessageW DestroyWindow CreateWindowExW GetClipboardSequenceNumber PostThreadMessageW UnregisterDeviceNotification GetRawInputDeviceInfoA GetRawInputDeviceList GetDesktopWindow GetDoubleClickTime MapVirtualKeyW GetKeyboardState IsClipboardFormatAvailable RegisterWindowMessageA GetWindowLongW DefWindowProcW AdjustWindowRectEx GetKeyState GetMessageExtraInfo CallWindowProcW PostMessageW GetWindowRect GetMenu GetDC SetWindowPos GetPropW FillRect ScreenToClient CallNextHookEx GetSystemMetrics UnregisterClassW MsgWaitForMultipleObjects RegisterClassExW GetAsyncKeyState DispatchMessageW SetTimer DestroyIcon ClientToScreen PeekMessageW GetRawInputData ValidateRect TrackMouseEvent GetClipCursor GetMessageTime GetUpdateRect TranslateMessage LoadIconW ClipCursor SetCursor GetClientRect KillTimer GetClassInfoExW InvalidateRect IsIconic GetCursorPos GetClipboardData EnumDisplayDevicesA MessageBoxW EnumDisplayMonitors MapVirtualKeyA MessageBoxA GetMonitorInfoA EnumDisplaySettingsA GetForegroundWindow ChangeWindowMessageFilter UnregisterClassA RegisterWindowMessageW ChangeDisplaySettingsExW ToUnicode SetClipboardData EmptyClipboard CloseClipboard OpenClipboard DrawTextW GetDlgItem SystemParametersInfoA DialogBoxIndirectParamW EndDialog RegisterClassExA CreateWindowExA RegisterDeviceNotificationW

imm32

ImmAssociateContext ImmSetCompositionWindow ImmSetCompositionFontW ImmReleaseContext ImmGetContext

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

setupapi

CM_Get_Device_IDA CM_Locate_DevNodeA CM_Get_Parent SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA

kernel32

UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead SetEvent InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetStartupInfoW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetStdHandle ReadConsoleW GetConsoleOutputCP GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW GetDriveTypeW RtlUnwindEx LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetStringTypeW GetEnvironmentStringsW CompareStringEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent GetNativeSystemInfo GetExitCodeThread SwitchToThread RtlPcToFileHeader SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetFileInformationByHandleEx MoveFileExW CopyFileW AreFileApisANSI SetFileInformationByHandle SetFileAttributesW SetEndOfFile GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindClose CreateDirectoryW GetCurrentDirectoryW ReadProcessMemory GetThreadContext GetVersionExA GetFileAttributesA ResumeThread GetCurrentDirectoryA SuspendThread Thread32First Thread32Next OutputDebugStringA RtlCaptureContext GetModuleFileNameA AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock MoveFileExA PeekNamedPipe WaitForMultipleObjects GetSystemDirectoryA VerifyVersionInfoA WideCharToMultiByte MultiByteToWideChar SleepEx FormatMessageA SetLastError GetConsoleMode GetOverlappedResult ResetEvent DeviceIoControl CancelIo TlsFree TlsGetValue TlsAlloc TlsSetValue GetSystemPowerStatus LoadLibraryW GlobalUnlock GlobalLock GlobalAlloc GetModuleHandleExW CreateFileA GetFileTime CreateEventW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetCPInfo DecodePointer CreateSemaphoreW ReleaseSemaphore LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection TryEnterCriticalSection CreateThread WaitForSingleObjectEx SetThreadPriority LoadLibraryExW QueryPerformanceCounter OutputDebugStringW ExitProcess MulDiv GetTickCount EnumResourceNamesW SetFilePointerEx Process32First GetConsoleScreenBufferInfo SetConsoleActiveScreenBuffer GetCurrentProcess SetConsoleScreenBufferSize GetStdHandle TerminateProcess GetModuleFileNameW LockFile CreateConsoleScreenBuffer InitializeCriticalSectionEx WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW HeapValidate GetModuleHandleA FindFirstChangeNotificationW OpenProcess CreateToolhelp32Snapshot Sleep GetModuleHandleExA FormatMessageW K32GetModuleFileNameExA GetLastError AttachConsole GetFileAttributesExW K32GetProcessMemoryInfo GetCurrentThread FindCloseChangeNotification LoadLibraryA QueryPerformanceFrequency DeleteFileW Process32Next CloseHandle RaiseException K32GetModuleInformation FindNextChangeNotification RtlUnwind UnlockFile GetProcAddress LocalFree DeleteCriticalSection VerSetConditionMask GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx SetThreadExecutionState GetModuleHandleW FreeLibrary K32GetPerformanceInfo VerifyVersionInfoW SetConsoleOutputCP GetFileType K32EnumProcessModules WriteConsoleInputA AllocConsole OpenThread IsDebuggerPresent SetUnhandledExceptionFilter GetEnvironmentVariableA ReadFile GetFileSizeEx WriteFile SetErrorMode SetFilePointer

advapi32

CryptDestroyHash CryptDestroyKey CryptEncrypt CryptImportKey CryptGenRandom CryptAcquireContextA RegQueryValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext CryptGetHashParam GetUserNameA CryptCreateHash CryptHashData

iphlpapi

GetIpAddrTable

ws2_32

htonl htons recv recvfrom ntohl gethostname ioctlsocket WSAIoctl WSASetLastError WSAAddressToStringW getpeername getsockname getsockopt WSACleanup __WSAFDIsSet accept bind closesocket select listen getaddrinfo WSAStartup send sendto setsockopt WSAGetLastError socket ntohs connect freeaddrinfo

crypt32

CertFreeCertificateChain CertAddCertificateContextToStore CertGetNameStringA CertFindExtension CertCreateCertificateChainEngine CertGetNameStringW CryptVerifyMessageSignature CertFreeCertificateChainEngine CertGetCertificateChain PFXImportCertStore CertFreeCertificateContext CryptStringToBinaryA CertEnumCertificatesInStore CertCloseStore CertFindCertificateInStore CertOpenStore CryptDecodeObjectEx CryptQueryObject

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateHeader ImageGetCertificateData ImageEnumerateCertificates

AmdPowerXpressRequestHighPerformance NvOptimusEnablement luaL_addlstring luaL_addstring luaL_addvalue luaL_argcounterror luaL_argerror luaL_buffinit luaL_buffinitsize luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_checkunsigned luaL_checkversion_ luaL_error luaL_execresult luaL_fileresult luaL_getmetafield luaL_getsubtable luaL_gsub luaL_len luaL_loadbufferx luaL_loadfilex luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_optunsigned luaL_prepbuffsize luaL_pushmodule luaL_pushresult luaL_pushresultsize luaL_ref luaL_requiref luaL_setfuncs luaL_setmetatable luaL_testudata luaL_tolstring luaL_traceback luaL_unref luaL_where lua_absindex lua_arith lua_atpanic lua_callk lua_checkstack lua_close lua_compare lua_concat lua_copy lua_createtable lua_dump lua_error lua_gc lua_getallocf lua_getctx lua_getfield lua_getglobal lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_getuservalue lua_insert lua_iscfunction lua_isnumberorstringconvertabletonumber lua_isstringornumberconvertabletostring lua_isuserdata lua_len lua_load lua_newstate lua_newthread lua_newuserdata lua_next lua_pcallk lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushunsigned lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawgetp lua_rawlen lua_rawset lua_rawseti lua_rawsetp lua_remove lua_replace lua_setallocf lua_setfield lua_setglobal lua_sethook lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_setuservalue lua_status lua_toboolean lua_tocfunction lua_tointegerx lua_tolstring lua_tonumberx lua_topointer lua_tothread lua_tounsignedx lua_touserdata lua_type lua_typename lua_upvalueid lua_upvaluejoin lua_version lua_xmove

Name

.text

Size

27.2MB

Virtual Size

27.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.4MB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.1MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

701KB

Virtual Size

701KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

factorio.exe

steam_api64

dnsapi

wldap32

gdi32

ole32

winmm

gdiplus

shell32

shlwapi

user32

imm32

oleaut32

setupapi

kernel32

advapi32

iphlpapi

ws2_32

crypt32

version

wintrust

imagehlp

generic