C:\Users\Windows\Desktop\fivemunban3.0\x64\Release\sc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fzxcm.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fzxcm.exe
Resource
win10v2004-20240412-en
General
-
Target
fzxcm.exe
-
Size
11.5MB
-
MD5
f59e4063e815a8ab793cbd234fcc093c
-
SHA1
ce6a1f373640bee616a213616feed9990972f490
-
SHA256
15950eae74735854cc70e18f0479e57abe578c9e506fe905628a5c4be227593d
-
SHA512
bc50a692e196dfa3c8f1ee20b40eecc21692b9eaaded287c1795b114826890797f625e0f71f65f5b281822d62250793225cda17794d8371c7e32fc918a3efab1
-
SSDEEP
196608:n2jsc4WNcrGFT+6X0Ah1mWPfDfmqnplolXgelWTlc2ad/EEhIsq5BeD2ln36GLg6:2/2SzdQ4DHslXgJczv05Beon3zEY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fzxcm.exe
Files
-
fzxcm.exe.exe windows:6 windows x64 arch:x64
3b7f536eeed404b5a0c6cd768fcba3fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptReleaseContext
shell32
ShellExecuteA
imm32
ImmSetCompositionWindow
msvcp140
??1_Lockit@std@@QEAA@XZ
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
normaliz
IdnToAscii
wldap32
ord143
crypt32
CryptDecodeObjectEx
ws2_32
setsockopt
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
winhttp
WinHttpCloseHandle
ntdll
RtlVirtualUnwind
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
H� M)/ߔ7�>��(b�G��R�lH G�?�(�=���������|T������� |n�y����8#R��� ��)�#��$7ރ��7��&DCe�<g��+�V�h>�x�>a��ޫ#<t���۽�P~�d�=g�-T������p��q��� s�PC�k���'ʹ�}��5f���jʡ<�-U4_̥4�4c�K)+1T����R����K���W�W��Q&���-�UL&�~~q�{x���'��~�<�dq�8���Kprgl��DE5��U�0K̏R�v��[^���-�]2fL��hP����Cnr�}n]w$_W�nG�l�,����iz���3��S��1�$5ñ~��@Eߙx���DY��l�Te#�Ӟu�n.��&�+xo����2���V6cl�|��s)|�(��Ç��;M��,x/@�����`�/e��2Kü���.8 �=��"�{�Yf�Q�.~?�c����Mtn�� ��ǿx<'pT���b��~�kO]-3p~;���_lፌ��_�.*�, {D�ɑ6�� Sl��@��F�� �'��6cl�T�G������Z=3�yp���h�J�̫^�� �3�͵��Y\���c���/*^ˮk>��/��r����B�6�Sy��y�c�c��p*І�Uܛæ&�u)�|�Z<(��T� �fB�S+GlYܕ��3:���jlq%�A��M�F m�C�<�����zL���T� U�H��D�D��1CKF�`�����6�1�Y��d���A=q��f;93���a��=o��;�r�Ŕ� �Ж/kW窇@�h�� ���X���82 ��� 1s}/8\*s(矰�*p�*H_����!P��30�ͼ��e�� 𤾏���"�,��B���QOn#�[6)����_kg:�g�T{Ѹ�/1AVn�t�>�桏�ؓ;�?���~�b��=�LH��� ���ynZ�R�����1{������O�ܨ֧�&Kx��{�f�R����:�->c���9W�UN��X}�@[��}cW���q،C��!��o�,`r��f<ک\3��>��2C��Hx��m�,��P�f#f㭃�%�~�����NW�#���$#,���l�p���2���b5�_c�x��2�V�N�Ӥ����z~䟉|H�/�C�6X�?�A�ֶ�¬�ǭW#��/#e�@x&����Ƃ1 Ir$k �j�*�$�T�E�k�%Ȳ���^��Qt��U�[;�o����k(�������d�1��i2���pZ�ZY�����&;wJc�0|�xB���eM�'D��:-M`�b���-O���K K���-އ��4~��/�:�8;���W�[ޖV!cUX'ó���Bj�$j!@N�2��>T�4�}H�d���T����]X���� �5�ԇ�Hz(�����J�.��q ���:�9A;n�O�՞��.��}�O��8�~}ҿN؎9Q�A��� 2�okHս�~(Y��v� ��t2�F��*��!�P��\�������浈엔Щ���t����WM>xM�Qt9b�=�߉(5w�v���!����W� ��������i�H5�E?��0�;@��\����[ޕ%��Cɏ�/G���w����)Nb��𝨔/���V �}2��3�Ǜ��Y<�EO9���Er��ק�3FB�ݽA�戬�z���U� �,ܵ�7?�k��@�����1��x ���TF�����̲�sY.���a�R��'?�.�����Z��d���X��\J��a��.��fJ�֎{���u�:��D����=��p�eZ��i ��T'K����{�c��bk�hv�0�V�`�*eYE�`���lG�F}���u,�I�S���G��AVD6T����{I���1�O��7�Ҟ�����e<Ow1�5�<=���.�$��)S�E�N�[��v��6������'�$��rK�����V�=�$f��/s�K�k�(����t ��P���W������:N=�=�OdW�Ԑ{tl��b����2���S$o�9?|��e��o�|�Ky�}Q��86} -K��x`_PLڍ�l]���$s��w�2y����; ��*;\$�$����&�����f�Cq�H��-Xjx���gCq쇛�PgG��yvK�,t�����Ye���a �$�n��x���h �����hʏ�c��`�Cy�Ȍ\Ui�$:{s�ۀTx53]��{���Tk �@�_�������w��0g�w_Kx���kX�췚��j�[K�/��5ȷzǡIvs? ��&�'$�:�������"�.s��Bj��{�Ko`;\K� �zt�3]���&�ZG*�x�c�D����L\�1�������������_� ��|,/�J���L�(sf<��U�K��*�&\�*�)&\��H���V)~��#rO��|nט��;�������8a(��4��m���n]� ނ~y��T�])�#��5���W6�o�h�&�:*���ר������P�7����Z�1Jr7?4�n��)��m!�M�j�ѫp*�eFxe�Nz��H��L������:�"�\|���!�ww��M!=)���H0���9��O �>C����둰�V*���^x��>V���1��y% �(iD��ͼ~}�bdl��0~.��k"G&�x�s�E�Q��H1P�\~0��2\����Z��Ҷ%�~b�"c���\3d f.�.��%Q�@Vc��}S���FL�,���*�FQ�Ql<l=�̼�gC�j3Lq�)������^(2��{�,K���q���>��� k4ٺ������w9a1�X_���}�4�Wz<�g�1�'��v�q�V 5�������7}C���Ô���F�^�p���z�/|̏��l�L�",N��W�������;� L�t�%��x6����w�*��FH�����U�p}�"a��!c���'s��u����Ö�&�7n���@��On$���:�������;�tu�f�cBc{����*�� Ӈ�XT���ig�yg�
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 282KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.q:K Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.\dh Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.>I# Size: 11.5MB - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ