ZFGameBrowser[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ZFGameBrowser.exe
Size

850KB
MD5

e5130f4109e8a5be23898e0507ffb6c0
SHA1

0be2d9d5337e6d1ce46afc3c1beffc5f2b5296f0
SHA256

da3bbdecb70e262a263af96f0b3569bd4b66f4ddf21b24ad1f56040a9896fa2d
SHA512

b1b3c7b2ce4be25c522b52ef25bc2c25a7878efe3b63536f68c28fd3be0f32f79cd4c61363aa2ce6efc4bb6a8b583609300324c095ce42d9c2e74d9ea455cff1
SSDEEP

24576:pXjAq1RaC6ZKusdvlhV9WbFMTwTcq1UtgSEh9k/26Aqkiiv:tB1iLg/I/N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ZFGameBrowser.exe

Files

ZFGameBrowser.exe
.exe windows:6 windows x64 arch:x64

7bd3a07deaabefd2bdbf08ff24293e6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

zf_cef

cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_string_map_free
cef_string_map_alloc
cef_dictionary_value_create
cef_value_create
cef_browser_host_create_browser
cef_list_value_create
cef_process_message_create
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_v8value_create_function
cef_log
cef_api_hash
cef_write_json
cef_parse_json
cef_uriencode
cef_base64encode
cef_get_mime_type
cef_parse_url
cef_add_cross_origin_whitelist_entry
cef_enable_highdpi_support
cef_quit_message_loop
cef_run_message_loop
cef_do_message_loop_work
cef_shutdown
cef_initialize
cef_execute_process
cef_register_scheme_handler_factory
cef_post_task
cef_currently_on
cef_string_list_free
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_ascii_to_utf16
cef_string_utf16_set
cef_string_utf16_cmp
cef_string_utf8_set
cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_string_utf16_to_utf8
cef_get_min_log_level
cef_string_map_append
cef_string_utf16_clear

kernel32

SetEndOfFile
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WriteConsoleW
FindFirstFileA
FindNextFileA
FindClose
GetCurrentThreadId
DeleteFileA
RemoveDirectoryA
GetModuleHandleW
ReadFile
WriteFile
UnmapViewOfFile
OpenProcess
CreateToolhelp32Snapshot
GetLastError
Process32NextW
CreateFileA
Process32FirstW
CloseHandle
RaiseException
CreateFileMappingA
LocalFree
GetCurrentProcessId
FormatMessageA
MapViewOfFile
IsDebuggerPresent
GetExitCodeProcess
GetCurrentProcess
CreateFileW
GetLocalTime
lstrcmpW
SetUnhandledExceptionFilter
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
GetFileType
HeapFree
HeapAlloc
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
GetStringTypeW
GetProcAddress
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCPInfo
CompareStringEx
LCMapStringEx
MultiByteToWideChar
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetExitCodeThread
Sleep
WaitForSingleObjectEx
RtlPcToFileHeader
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
TryAcquireSRWLockExclusive
HeapSize
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable

user32

IsWindow
ShowWindow
GetWindowRect
MoveWindow
SetParent
PostMessageW
GetGUIThreadInfo

shell32

CommandLineToArgvW

dbghelp

MiniDumpWriteDump

Exports

Exports

zfb_addCLISwitch
zfb_addUrlFolderMapping
zfb_browserExists
zfb_changeLoading
zfb_characterEvent
zfb_clearCookies
zfb_copyToColor32
zfb_createBrowser
zfb_destroyAllBrowsers
zfb_destroyBrowser
zfb_disableUrlJump
zfb_doNav
zfb_downloadCommand
zfb_editCookie
zfb_evalJS
zfb_flatColorTexture
zfb_free
zfb_geometry
zfb_getCookies
zfb_getImage
zfb_getMouseCursor
zfb_getMouseCustomCursor
zfb_getVersion
zfb_goToHTML
zfb_goToURL
zfb_hide
zfb_init
zfb_keyEvent
zfb_memcpy
zfb_mouseButton
zfb_mouseMove
zfb_mouseScroll
zfb_noop
zfb_numBrowsers
zfb_registerChangeCallback
zfb_registerConsoleCallback
zfb_registerContextMenuCallback
zfb_registerDialogCallback
zfb_registerJSCallback
zfb_registerNavStateCallback
zfb_registerPopupCallback
zfb_resize
zfb_sendCommandToFocusedFrame
zfb_sendContextMenuResults
zfb_sendDialogResults
zfb_sendRequestData
zfb_sendRequestHeaders
zfb_setAudioMuted
zfb_setCallbacksEnabled
zfb_setDebugFunc
zfb_setFocused
zfb_setLocalRequestHandler
zfb_setOverlay
zfb_setReadyCallback
zfb_setZoom
zfb_show
zfb_showDevTools
zfb_shutdown
zfb_tick

Sections

.text
Size: 605KB - Virtual size: 605KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7bd3a07deaabefd2bdbf08ff24293e6d

Headers

DLL Characteristics

File Characteristics

Imports

zf_cef

kernel32

user32

shell32

dbghelp

Exports

Exports

Sections

.text Size: 605KB - Virtual size: 605KB

.rdata Size: 182KB - Virtual size: 182KB

.data Size: 17KB - Virtual size: 25KB

.pdata Size: 34KB - Virtual size: 33KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 605KB - Virtual size: 605KB

.rdata
Size: 182KB - Virtual size: 182KB

.data
Size: 17KB - Virtual size: 25KB

.pdata
Size: 34KB - Virtual size: 33KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 8KB - Virtual size: 8KB