PredictiveBuffer.geode
- SHA256 da05b01cc6b28f3e567e748412d66d8e3012269911122209d5e7ca4ad2781903
Static task
static1
1 signatures
General
- Target PredictiveBuffer.geode
- Size 48KB
- Sample261107-tj5mbsfc93
- SHA256 da05b01cc6b28f3e567e748412d66d8e3012269911122209d5e7ca4ad2781903
- MD5 27620fc5df728f5cff4ca10a0ca42991
- SHA1 ff1ec38923775ae625ec5e551d43866e49d180f7
- SHA512 00d7d2a6a43526f5fe2ff507e0a7b977fe5ea6fa4f6cda450224f147be49f73c5cc3fe64f4125c6b7a0546255c0239f3a120f245edecaed851d400d4653f72f7
- SSDEEP 768:55vTbGbWQcSSOu1DRCzlRD3EZGVHhK5JMfs2ww39ohrCeFDMIAP91P9cKPk9zuGD:zyWQc2uSUyHo5JMfNtANSTgaGjse
- TLSH T15723028A3220E4725F18953F3B65EF96F37B10C5ECACEC2BE401698B1E954DC5E16116
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ai.predictivebuffer.dll
File Explorer
-
PredictiveBuffer.geode.zip 48KB
-
.geode_cache30B
-
about.md113B
-
ai.predictivebuffer.dll.dll 138KB
-
mod.json259B
.geode_cache
- SHA256 756cbf88d1330bd7f86322072c23b6c8f197c57f2d5f53756e1683113cf9b5eb
- MD5 53c115631f35f2ffa9776def870b4880
- SHA1 5b3c9655a57078298686f5f18b9893825ab6714b
- SHA512 5bed6872a1677ef85a4557786255ce327da9cb71c6eac4c65ddc7d90df7ebe3dffe6d8faf3b27434f33153f129af109a9850c81fce7ceb38c16ef558cbdc1f6b
- MD5 SHA1 SHA512
about.md
- SHA256 93d48a8b638e585ba9572a16dcafde1f3a045d1e2e1296706dea76d5bd3c9ef1
- MD5 26969ee08bfa8166ff0c6351137e0484
- SHA1 573deccf62fbe5faf1b3709ba337995c4a6f5d0e
- SHA512 196c22e96c50318735e690a8a105d5c0109dbe05ca5758602635e53419ac7bdcd248e32e357c12d4a4404c8a29e132d92bf077cb7a2862dbac751097281477fe
- TLSH T1A1B0126939B3B1B354521B721CA9141C731189C907F36683F4528F271350D547737C68
- MD5 SHA1 SHA512 TLSH
ai.predictivebuffer.dll
- IMPHASH 979deb1ee37e13d5b4086c9250ca7773
- SHA256 12a0ca520890298b019be790251906ad7db126bdc77fd14594ff49585dcfc2bb
- MD5 14350960e66470af19d41320760a913f
- SHA1 73d1880f12dcfcfda2693ec556de51aae1366959
- SHA512 4275f90a37658221a5f09071f3dd881d36460e1f9cbb85bc5969aafb5e2dc8d30e7c1cd1838e90993a633a46ff829d42047a23fbe3be8e8e0e98a652b3182cfe
- SSDEEP 1536:VzCclUcuOoLmYLj9b3O1M290jDVWXYa4X99xcx3shEWOX:VzCclUcuOOz5+M7jDVWr3F
- TLSH T180D30A167A16E07FC549C8B0918745435F2174CA0FA1BBEF5BC1AAB92DB57F8AF3A100
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
88336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
libcocos2d
?release@CCObject@cocos2d@@QEAAXXZ
?removeAllObjects@CCDictionary@cocos2d@@QEAAXXZ
?retain@CCObject@cocos2d@@QEAAXXZ
geode
?addReceiver@EventCenterThreadLocal@comm@geode@@QEAA?AVListenerHandle@23@PEBVBaseFilter@23@V?$move_only_function@$$A6A_KPEAVOpaquePortBase@comm@geode@@@Z@std@@V?$move_only_function@$$A6APEAVOpaquePortBase@comm@geode@@PEAV123@@Z@7@@Z
?claimHook@Mod@geode@@QEAA?AV?$Result@PEAVHook@geode@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$shared_ptr@VHook@geode@@@std@@@Z
?create@Hook@geode@@SA?AV?$shared_ptr@VHook@geode@@@std@@PEAX0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@VHandlerMetadata@hook@tulip@@VHookMetadata@78@@Z
?createConvention@hook@geode@@YA?AV?$shared_ptr@VCallingConvention@hook@tulip@@@std@@W4TulipConvention@1tulip@@@Z
?createWrapper@hook@geode@@YA?AV?$Result@PEAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@PEAXAEBVWrapperMetadata@1tulip@@@Z
?get@EventCenterThreadLocal@comm@geode@@SAPEAV123@XZ
?get@Loader@geode@@SAPEAV12@XZ
?getDisplayName@Hook@geode@@QEBA?AV?$basic_string_view@DU?$char_traits@D@std@@@std@@XZ
?isInternal@Mod@geode@@QEBA_NXZ
?runtime@async@geode@@YAAEAVRuntime@arc@@XZ
?setModifyClassName@Hook@geode@@QEAAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setPriority@Hook@geode@@QEAAXH@Z
?takeNextMod@Loader@geode@@IEAAPEAVMod@2@XZ
?vlogImpl@log@geode@@YAXUSeverity@2@PEAVMod@2@V?$basic_string_view@D@v12@fmt@@V?$basic_format_args@Vcontext@v12@fmt@@@67@@Z
kernel32
AcquireSRWLockExclusive
AllocConsole
DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
SetConsoleTitleA
SleepConditionVariableSRW
SystemTimeToFileTime
WakeAllConditionVariable
user32
GetAsyncKeyState
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0ios_base@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1ios_base@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exceptions@std@@YAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
__std_type_info_name
memcmp
memcpy
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
freopen_s
puts
api-ms-win-crt-runtime-l1-1-0
_cexit
_configure_narrow_argv
_crt_atexit
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
_seh_filter_dll
abort
api-ms-win-crt-math-l1-1-0
atan2f
atanf
ceilf
cosf
powf
sinf
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
free
malloc
api-ms-win-crt-string-l1-1-0
strcmp
strlen
geodeImplicitEntry
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
mod.json
- SHA256 765fbe8935d1ead9246dc4bc54017f99250a8cb63fee7a8d14248caf8fca9c8c
- MD5 4405607cdb67ff9cf7c1afd5acf30af5
- SHA1 6ba57b5d569a05fce64d4dd6fdb8c5547f8024ed
- SHA512 908988a50565d21153a6bd78fd167ee61c74608f091f3ebbc151111314238e581024606ff7f0488d36baafebfc70bef27518a23d928efc46876f07c4dc48a2da
- TLSH T14BD097134FC1B02B000062E638F005FF1E3501ADA6000CCF34047C11D2E08B20F13331
- MD5 SHA1 SHA512 TLSH