Static task
static1
Behavioral task
behavioral1
Sample
ZDGame.exe
Resource
win10v2004-20240508-en
General
-
Target
ZDGame.exe
-
Size
214.1MB
-
MD5
3390be4819c620580a58bd5e00e2586c
-
SHA1
76d0cfa455f1c40e8352d5a5bd7236d120892421
-
SHA256
fb6d2f13555ada51cde40bb2049733587ab3bfbb7553e471903be2c7a39825fd
-
SHA512
160877afbb4ef57e544a411ef742af2feaf7d5ad916b0ea2bc7c427696e418b2d16a7b53c676062d5b42f7c191d6d72e6102d426de4f145762b08766e3409012
-
SSDEEP
6291456:Gc7mnIGYSOPNJAt/jUSXdZo1AKR5K4Jkr9YHQsi8lw:D7mnt9SNKBLc1AKR5K4Rwsi8W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ZDGame.exe
Files
-
ZDGame.exe.exe windows:4 windows x64 arch:x64
89f773c6565e634322d1ea0965a9544f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
OpenProcessToken
SystemFunction036
kernel32
AddVectoredExceptionHandler
CancelIo
CloseHandle
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileW
CreateHardLinkW
CreateNamedPipeW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileInformationByHandle
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
GetTimeZoneInformation
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
MoveFileExW
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
RemoveDirectoryW
RtlCaptureContext
RtlUnwindEx
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetUnhandledExceptionFilter
Sleep
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrlenW
GetCurrentThreadId
GetTickCount
RtlAddFunctionTable
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
ole32
CoTaskMemFree
shell32
CommandLineToArgvW
SHGetKnownFolderPath
msvcrt
__C_specific_handler
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_exit
_filelengthi64
_fileno
_fmode
_initterm
_localtime64
_lock
_lseeki64
_mktime64
_onexit
_stat64
_time64
_unlock
_utime64
_vsnprintf
_write
abort
atoi
bsearch
calloc
exit
fclose
fflush
fgetpos
fopen_s
fprintf
fread
free
freopen_s
fsetpos
fwprintf
fwrite
malloc
memcmp
memcpy
memmove
memset
raise
realloc
remove
signal
strcmp
strlen
strncmp
vfprintf
wcscpy
_snwprintf
_read
_open
_lseek
_getpid
_close
user32
MessageBoxW
userenv
GetUserProfileDirectoryW
ws2_32
WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
Sections
.text Size: 758KB - Virtual size: 757KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ