F:\VCtest\Projects\NEWGZXTEST\GZX61\Release\GZX.pdb
Static task
static1
Behavioral task
behavioral1
Sample
faf122288adb01b665f1ddb348f3be7322091691839087e89ccf06385dfad906.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
faf122288adb01b665f1ddb348f3be7322091691839087e89ccf06385dfad906.exe
Resource
win10v2004-20240730-en
General
-
Target
faf122288adb01b665f1ddb348f3be7322091691839087e89ccf06385dfad906.exe
-
Size
2.9MB
-
MD5
d5b4ff21b1820aebb511b1bb762dbc6f
-
SHA1
4cfeee0ffd95aa4818afc51951da0872117a524c
-
SHA256
faf122288adb01b665f1ddb348f3be7322091691839087e89ccf06385dfad906
-
SHA512
f33809d913bd0121ae7dcefa49bf320e7924c365c8a0a1b4066b6340d7e5acb283f3a317ffc0c6805e6284bac9eecb42b42bc30392e83b9a120dbe3523ab93d4
-
SSDEEP
24576:W5SNgHMGg2IubaHufK6bcx7nwU7fezrDRZSU+CS9xAk3q+D1fhDbtDYo17VeB/0P:W5SNgsGs0UsWVCS9xAk3q+DRgo1eW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource faf122288adb01b665f1ddb348f3be7322091691839087e89ccf06385dfad906.exe
Files
-
faf122288adb01b665f1ddb348f3be7322091691839087e89ccf06385dfad906.exe.exe windows:5 windows x86 arch:x86
82aabad7cf535fa108a1cafe32c97746
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc140u
ord8062
ord14137
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord11983
ord14466
ord12531
ord8000
ord14667
ord14234
ord4477
ord8817
ord13628
ord13800
ord5419
ord12793
ord1526
ord3833
ord890
ord1391
ord11038
ord2990
ord6348
ord14669
ord8464
ord2996
ord2215
ord6549
ord9139
ord968
ord6497
ord9128
ord3147
ord4222
ord8744
ord2993
ord13806
ord3872
ord6490
ord6129
ord9126
ord4886
ord3145
ord4219
ord1002
ord6589
ord10255
ord5984
ord5790
ord12542
ord8746
ord12541
ord2486
ord5357
ord8324
ord12865
ord8386
ord8470
ord1525
ord2463
ord462
ord7495
ord4225
ord6220
ord13756
ord3305
ord3302
ord8210
ord2761
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9132
ord12089
ord3838
ord11936
ord14588
ord8965
ord12220
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord4885
ord4936
ord4227
ord5003
ord4948
ord4966
ord4960
ord4954
ord10472
ord3697
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord10433
ord12251
ord12219
ord12928
ord5249
ord5549
ord5760
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord1113
ord6489
ord6566
ord3882
ord2304
ord1111
ord1133
ord1447
ord1070
ord1066
ord1180
ord4092
ord13911
ord7313
ord13442
ord952
ord2205
ord7997
ord1472
ord995
ord7653
ord10379
ord8360
ord12884
ord5110
ord1692
ord1523
ord12559
ord5117
ord8067
ord4859
ord7820
ord5850
ord6607
ord3932
ord2526
ord14377
ord13646
ord6533
ord9210
ord9235
ord12173
ord2760
ord13752
ord6218
ord3164
ord3403
ord3404
ord290
ord13656
ord12637
ord5013
ord4997
ord4942
ord11396
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord11015
ord9040
ord9693
ord4494
ord3055
ord14590
ord7923
ord12131
ord14596
ord6877
ord11717
ord1777
ord2246
ord13703
ord5935
ord12168
ord3265
ord3371
ord3372
ord2409
ord2682
ord12124
ord1067
ord2477
ord4815
ord2385
ord2389
ord296
ord360
ord13253
ord13960
ord280
ord1045
ord286
ord265
ord266
ord1511
ord12763
ord8712
ord12921
ord3941
ord1513
kernel32
GetModuleHandleA
GetModuleHandleW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
HeapAlloc
SetLastError
InitializeCriticalSectionAndSpinCount
GlobalUnlock
GlobalLock
SizeofResource
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetFileType
GetStdHandle
LoadResource
SleepEx
FreeLibrary
LockResource
GetCurrentThread
QueryPerformanceFrequency
MultiByteToWideChar
CreateEventA
InitializeCriticalSectionEx
FormatMessageW
WaitForMultipleObjects
ReleaseSRWLockExclusive
MoveFileExA
WaitForSingleObject
FindResourceW
VirtualQuery
GetVolumeInformationA
DeviceIoControl
SetUnhandledExceptionFilter
GetSystemTime
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetSystemInfo
GetQueuedCompletionStatus
lstrcatA
OutputDebugStringA
lstrlenA
TerminateThread
GetPrivateProfileStringA
CreateDirectoryA
GetFileAttributesA
GetTickCount
WideCharToMultiByte
HeapFree
GetProcessHeap
VirtualProtect
OutputDebugStringW
IsBadReadPtr
GetFileAttributesW
CreateDirectoryW
WritePrivateProfileStringW
CreateThread
CloseHandle
WritePrivateProfileStringA
GetPrivateProfileIntW
Sleep
GlobalSize
GetPrivateProfileIntA
GetModuleFileNameW
GetPrivateProfileStringW
GetCurrentDirectoryA
CreateFileA
GetFileSize
AcquireSRWLockExclusive
DeleteCriticalSection
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
ReadFile
InitializeCriticalSection
CreateIoCompletionPort
GetLastError
PostQueuedCompletionStatus
EnterCriticalSection
GetEnvironmentVariableA
GetDriveTypeA
LeaveCriticalSection
lstrcpyA
user32
SetTimer
SetWindowLongA
MessageBoxA
IsIconic
GetSystemMetrics
DrawIcon
LoadMenuW
GetSubMenu
GetCursorPos
OpenClipboard
GetClipboardData
CloseClipboard
GetClientRect
AppendMenuW
GetWindowTextA
GetSystemMenu
CallWindowProcA
LoadIconW
EnableWindow
MessageBoxW
KillTimer
wsprintfA
SendMessageW
advapi32
CryptReleaseContext
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptImportKey
OpenThreadToken
CryptAcquireContextA
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
shell32
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathA
DragQueryFileA
comctl32
InitCommonControlsEx
ole32
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
msvcp140
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_BADOFF@std@@3_JB
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
_Strcoll
_Strxfrm
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Xbad_function_call@std@@YAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
ws2_32
WSACloseEvent
getsockopt
htonl
htons
inet_ntoa
WSASocketW
WSAGetLastError
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
WSASetLastError
WSACleanup
socket
__WSAFDIsSet
accept
recvfrom
sendto
inet_addr
freeaddrinfo
inet_ntop
getaddrinfo
gethostname
WSAStartup
closesocket
shutdown
ntohs
getsockname
getpeername
recv
select
connect
ioctlsocket
gethostbyname
send
WSASend
WSARecv
WSAIoctl
setsockopt
listen
bind
WSACreateEvent
vcruntime140
strstr
__std_exception_copy
__std_exception_destroy
memchr
memset
__CxxFrameHandler3
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
strchr
_purecall
strrchr
memmove
__std_terminate
_CxxThrowException
memcpy
plfl32
P_GetDataValue
P_UserLogin
P_GetLoginValue
P_UserReg
P_CardReCharge
P_GetInfo
P_LoadSystem
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenW
InternetCloseHandle
iphlpapi
GetAdaptersInfo
dbghelp
MiniDumpWriteDump
api-ms-win-crt-utility-l1-1-0
srand
qsort
rand
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
_configure_wide_argv
_initterm
_initterm_e
_set_app_type
_cexit
__sys_nerr
__sys_errlist
_invalid_parameter_noinfo
_seh_filter_exe
_errno
_beginthreadex
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_invalid_parameter_noinfo_noreturn
_get_wide_winmain_command_line
_initialize_onexit_table
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
realloc
_set_new_mode
malloc
free
calloc
api-ms-win-crt-time-l1-1-0
_gmtime64
strftime
wcsftime
_time64
_localtime64_s
api-ms-win-crt-convert-l1-1-0
atoi
_wtoll
atoll
_wtof
strtol
strtoul
strtoll
wcstombs
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
_close
_fileno
fopen
__stdio_common_vfprintf
_set_fmode
fclose
fputs
fseek
__stdio_common_vswprintf
feof
ftell
fread
__stdio_common_vsscanf
_open
__stdio_common_vsprintf
fgets
__stdio_common_vsprintf_s
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
_lseeki64
_write
_read
fgetc
fwrite
ungetc
fputc
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
_strdup
toupper
strncpy
strcspn
strncmp
strspn
strpbrk
strtok
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_access
_stat64
_unlink
_fstat64
api-ms-win-crt-math-l1-1-0
_fdopen
__setusermatherr
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
bcrypt
BCryptGenRandom
crypt32
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
normaliz
IdnToUnicode
IdnToAscii
wldap32
ord217
ord143
ord301
ord200
ord30
ord79
ord46
ord33
ord32
ord27
ord26
ord22
ord41
ord211
ord60
ord45
ord35
ord50
Sections
.text Size: 644KB - Virtual size: 643KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ