D:\github\Fixed-CFF-For-Gmod-main\Release\ZepamGMOD.pdb
Static task
static1
Behavioral task
behavioral1
Sample
CFF.dll
Resource
win11-20231222-en
General
-
Target
CFF.dll
-
Size
1.1MB
-
MD5
4dbe6ed81309b4d8a081e056f24b4b9e
-
SHA1
88eb592011600e547f3292c2d2fecd14c6161bdf
-
SHA256
d832ceaa7add3cb347350d2fe16ead2929dd84b35158cf41ca0c3a588ed29d3c
-
SHA512
da87541efc9f0c6df93ba42e62ee07ec950785724d28030c581caf1b04f5bc90e4b3a581b512b1f6f6d41d0ef162f4fe4cb028a835b44f75f4f2058beba4355e
-
SSDEEP
24576:KVK3yzJ+4jYUPhdDDo41aZb8UUSZC+XMxr6Yh5Ka/oS4zplYlb5gJbep0YdQpovy:ydDDo4UXzglb5gMvCHUHwTgQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CFF.dll
Files
-
CFF.dll.dll windows:6 windows x86 arch:x86
3f7328c49b3a85d436cfdd5efa542210
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetEnvironmentVariableA
FindClose
GetProcAddress
WideCharToMultiByte
IsBadReadPtr
VirtualProtect
GetCurrentThreadId
IsBadWritePtr
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
DisableThreadLibraryCalls
FormatMessageA
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetModuleHandleW
CreateEventW
FindFirstFileA
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
MultiByteToWideChar
AreFileApisANSI
GetLocaleInfoEx
FindNextFileA
GetCurrentDirectoryA
WaitForSingleObjectEx
GetModuleHandleA
LocalFree
user32
GetActiveWindow
SetCursor
GetClientRect
OpenClipboard
CloseClipboard
GetClipboardData
SetClipboardData
FindWindowW
GetKeyState
ToAsciiEx
ScreenToClient
GetCursorPos
EmptyClipboard
MapVirtualKeyA
GetAsyncKeyState
SetCursorPos
GetKeyboardState
LoadCursorA
ClientToScreen
shell32
ShellExecuteA
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Xbad_function_call@std@@YAXXZ
_Mtx_trylock
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Random_device@std@@YAIXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
vcruntime140
memcpy
memmove
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
__std_type_info_compare
__std_type_info_name
memchr
memset
_CxxThrowException
__current_exception_context
__current_exception
__std_type_info_destroy_list
strstr
_except_handler4_common
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
terminate
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_wassert
_register_onexit_function
_initterm
_cexit
_crt_atexit
_execute_onexit_table
api-ms-win-crt-stdio-l1-1-0
fputc
fflush
fclose
fgetpos
__stdio_common_vsprintf
fputs
__stdio_common_vsscanf
_wfopen
fwrite
setvbuf
fseek
ungetc
fsetpos
fread
_fseeki64
_get_stream_buffer_pointers
ftell
__stdio_common_vsprintf_s
fgetc
fopen_s
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
_CIatan2
_CIfmod
_fdclass
lroundf
_libm_sse2_acos_precise
_libm_sse2_cos_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
ceil
round
roundf
_libm_sse2_atan_precise
api-ms-win-crt-convert-l1-1-0
atoll
atoi
atof
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
srand
qsort
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
.text Size: 480KB - Virtual size: 479KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 630KB - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 486.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ