C:\gl\builds\cfx-fivem\master\fxserver\.build-cache\bin\server\windows\release\dbg\FXServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
FXServer.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
FXServer.exe
Resource
win10v2004-20240508-en
General
-
Target
FXServer.exe
-
Size
270KB
-
MD5
01d20e885c2c2515a2e84dbb8e034c8e
-
SHA1
3e9873304e7338eb809107feacdca2367c650ef7
-
SHA256
84a6bf059f4a3db03e723dc7cd078e5f29c619fae123d0254f5feaba6d196d9a
-
SHA512
238b963ee8343a316cf6932b5af38200e29d6f7a65b75039f0244adce0ab2c7bd6329e2e68208ed89a4bbf7f352ad9dc76526d377b72c8c602fa1700949a9e52
-
SSDEEP
6144:UQkgTZmAqZ0/qYwFkhVq2Z6bbM2Ak1Kf:eZ0dxOyyAMKf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FXServer.exe
Files
-
FXServer.exe.exe windows:6 windows x64 arch:x64
5bcf44f3c0f4da6a565c4b64e3a8d021
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateDirectoryW
IsDebuggerPresent
DebugActiveProcess
DebugActiveProcessStop
CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcessId
CreateRemoteThread
GetCommandLineW
CreateProcessW
GetProcessId
OpenProcess
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
GetModuleFileNameW
QueryPerformanceCounter
UnhandledExceptionFilter
LoadLibraryW
GetProcAddress
GetModuleHandleW
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
RtlVirtualUnwind
RtlLookupFunctionEntry
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
RegisterWaitForSingleObject
Sleep
CreateMutexW
ReleaseMutex
GetOverlappedResult
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
UnregisterWait
UnregisterWaitEx
GetSystemTimeAsFileTime
GetProcessTimes
FreeLibrary
VirtualQueryEx
CreateThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
WaitForMultipleObjects
ResetEvent
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
GetLastError
DuplicateHandle
WriteFile
CreateFileW
GetFullPathNameW
OutputDebugStringA
RtlCaptureContext
InitializeSListHead
user32
MessageBoxW
corert
?LoadComponent@ComponentLoader@@QEAA?AV?$fwRefContainer@VComponentData@@@@PEBD@Z
?ForAllComponents@ComponentLoader@@QEAAXAEBV?$function@$$A6AXV?$fwRefContainer@VComponentData@@@@@Z@std@@@Z
?Initialize@ComponentLoader@@QEAAXXZ
?CreateInstance@ComponentData@@QEAA?AV?$fwRefContainer@VComponent@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetInstance@ComponentLoader@@SA@XZ
msvcp140
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0_Locinfo@std@@QEAA@PEBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1_Locinfo@std@@QEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?width@ios_base@std@@QEBA_JXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140
_set_purecall_handler
wcsrchr
__C_specific_handler
wcsstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception
memchr
memcmp
memcpy
memmove
memset
__std_terminate
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
_c_exit
__p___wargv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
terminate
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_set_invalid_parameter_handler
exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vswprintf
fputc
__stdio_common_vsnprintf_s
fwrite
__p__commode
_set_fmode
ungetc
setvbuf
_fseeki64
fsetpos
fread
fgetpos
fgetc
fflush
fclose
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
_get_stream_buffer_pointers
__stdio_common_vfprintf
api-ms-win-crt-math-l1-1-0
_fdsign
_dclass
_ldsign
_ldclass
_fdclass
__setusermatherr
_dsign
api-ms-win-crt-locale-l1-1-0
localeconv
setlocale
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strcmp
wcscpy_s
api-ms-win-crt-convert-l1-1-0
_i64tow_s
wcstol
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
wininet
InternetConnectW
InternetOpenW
HttpSendRequestW
InternetReadFile
HttpQueryInfoW
HttpAddRequestHeadersW
InternetCrackUrlW
InternetCloseHandle
HttpOpenRequestW
InternetQueryDataAvailable
InternetSetOptionW
Sections
.text Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ