C:\gl\builds\cfx-fivem\master\fxserver.inter-build-cache\bin\server\windows\release\dbg\FXServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
FXServer.exe
Resource
win10v2004-20240226-en
General
-
Target
FXServer.exe
-
Size
268KB
-
MD5
3ea6577649a980b08cbc72b2dc2a20db
-
SHA1
b50e432002320d2fad0e44f6cc3ccbeb263e9c49
-
SHA256
e01e8b82f8cba05e0c4d08d413db575b517552aab3b73b709f28d19d0c9c9a20
-
SHA512
aa01d4932a540ac742002ec2bf04657a93961043b2ef42d4120fb8277af4e0892c2b5fa3bdf3c7ff9b3d152346534219208fdfd430db4902e24553d93dc990c3
-
SSDEEP
3072:8hrBLkxtiQOCIDLx+2Qfqf+Y1/N7l8xL+ASrGdDepUQKv7QjVbu1KVfP:8hrBoyw2Qfqf+glWOS4pvKv7II1Kf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FXServer.exe
Files
-
FXServer.exe.exe windows:6 windows x64 arch:x64
947b49af8a507c01bfe3eb2248051588
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateDirectoryW
IsDebuggerPresent
DebugActiveProcess
DebugActiveProcessStop
CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcessId
CreateRemoteThread
GetCommandLineW
CreateProcessW
GetProcessId
OpenProcess
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
GetModuleFileNameW
QueryPerformanceCounter
UnhandledExceptionFilter
LoadLibraryW
GetProcAddress
GetModuleHandleW
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
RtlVirtualUnwind
RtlLookupFunctionEntry
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
RegisterWaitForSingleObject
Sleep
CreateMutexW
ReleaseMutex
GetOverlappedResult
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
UnregisterWait
UnregisterWaitEx
GetSystemTimeAsFileTime
GetProcessTimes
FreeLibrary
VirtualQueryEx
CreateThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
WaitForMultipleObjects
ResetEvent
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
GetLastError
DuplicateHandle
WriteFile
CreateFileW
GetFullPathNameW
OutputDebugStringA
RtlCaptureContext
InitializeSListHead
user32
MessageBoxW
corert
?LoadComponent@ComponentLoader@@QEAA?AV?$fwRefContainer@VComponentData@@@@PEBD@Z
?ForAllComponents@ComponentLoader@@QEAAXAEBV?$function@$$A6AXV?$fwRefContainer@VComponentData@@@@@Z@std@@@Z
?Initialize@ComponentLoader@@QEAAXXZ
?CreateInstance@ComponentData@@QEAA?AV?$fwRefContainer@VComponent@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetInstance@ComponentLoader@@SA@XZ
msvcp140
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0_Locinfo@std@@QEAA@PEBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1_Locinfo@std@@QEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?width@ios_base@std@@QEBA_JXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140
_set_purecall_handler
wcsrchr
__C_specific_handler
wcsstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception
memchr
memcpy
memmove
memset
__std_terminate
memcmp
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
_c_exit
__p___wargv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
terminate
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_set_invalid_parameter_handler
exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vswprintf
fputc
__stdio_common_vsnprintf_s
fwrite
__p__commode
_set_fmode
ungetc
setvbuf
_fseeki64
fsetpos
fread
fgetpos
fgetc
fflush
fclose
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
_get_stream_buffer_pointers
__stdio_common_vfprintf
api-ms-win-crt-math-l1-1-0
_fdsign
_dclass
_ldsign
_ldclass
_fdclass
__setusermatherr
_dsign
api-ms-win-crt-locale-l1-1-0
localeconv
setlocale
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strcmp
wcscpy_s
api-ms-win-crt-convert-l1-1-0
_i64tow_s
wcstol
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
wininet
InternetConnectW
InternetOpenW
HttpSendRequestW
InternetReadFile
HttpQueryInfoW
HttpAddRequestHeadersW
InternetCrackUrlW
InternetCloseHandle
HttpOpenRequestW
InternetQueryDataAvailable
InternetSetOptionW
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ