F:\VCtest\Projects\NEWGZXTEST\KF\Release\GZX.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Zusy.496467.9473.7754.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Zusy.496467.9473.7754.exe
Resource
win10v2004-20240730-en
General
-
Target
SecuriteInfo.com.Variant.Zusy.496467.9473.7754.exe
-
Size
2.8MB
-
MD5
b61c9927437eb0ed2699293bee8acc46
-
SHA1
86a8e83422bd69a1cfed84f236d48367d55875a9
-
SHA256
0a0f33130d81d8f5ec5ef9fff4339f0e790db4d5fae9c7adfc3cf150b9f0b70d
-
SHA512
7dbfa0a2e6ee5809f2f5fdf18a159094edb759150c57429504c7999a832c3f2e5390043f713c64796d05607fdf4cb05494ec1ed5dd9ba77216bff96762046be6
-
SSDEEP
24576:EGW5NYp8mgnx8uj/8z2ufffe8rDRZSU+CS9xAk3q+D1fhDbtDYo17VeB/02t9FHc:E1jQf3WVCS9xAk3q+DRgo1eW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Variant.Zusy.496467.9473.7754.exe
Files
-
SecuriteInfo.com.Variant.Zusy.496467.9473.7754.exe.exe windows:5 windows x86 arch:x86
ec36f8e7238fa5815f1700163c6972ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc140u
ord2486
ord12541
ord12542
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord2409
ord5652
ord11725
ord11726
ord9132
ord12089
ord3838
ord11936
ord14588
ord8965
ord12220
ord6978
ord11002
ord11983
ord14466
ord5357
ord8324
ord10286
ord10287
ord9256
ord3266
ord10288
ord12262
ord3302
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord10285
ord4997
ord4942
ord5019
ord3305
ord13756
ord4974
ord4912
ord4927
ord4988
ord4502
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord13878
ord10284
ord12124
ord3941
ord3372
ord3371
ord3265
ord12168
ord5790
ord5984
ord10255
ord6589
ord1002
ord4219
ord3145
ord9126
ord6129
ord6490
ord3872
ord2993
ord8744
ord4222
ord3147
ord9128
ord6220
ord968
ord14785
ord9139
ord6549
ord4225
ord2215
ord2246
ord7495
ord3697
ord10472
ord4885
ord2761
ord5013
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord10433
ord12251
ord12219
ord12928
ord5249
ord5549
ord5760
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord1113
ord6489
ord6566
ord3882
ord2304
ord1111
ord1133
ord1447
ord1070
ord1066
ord1180
ord4092
ord13911
ord7313
ord13442
ord952
ord2205
ord7997
ord1472
ord995
ord7653
ord10379
ord12884
ord5110
ord8464
ord8062
ord14137
ord14234
ord8817
ord13628
ord13800
ord5419
ord12793
ord1526
ord3833
ord890
ord1391
ord11038
ord4859
ord290
ord5850
ord8067
ord7820
ord2990
ord462
ord2996
ord8210
ord13806
ord4886
ord8746
ord4227
ord1525
ord6607
ord3932
ord2526
ord14377
ord13646
ord6533
ord9210
ord8470
ord8386
ord9235
ord6497
ord12173
ord2760
ord13752
ord6218
ord3164
ord3403
ord13656
ord12637
ord1067
ord2477
ord4815
ord2385
ord2389
ord296
ord360
ord13253
ord13960
ord280
ord1045
ord286
ord265
ord266
ord1511
ord3404
ord11396
ord11015
ord9040
ord12131
ord12763
ord8712
ord12921
ord12865
ord1513
kernel32
SetLastError
GetModuleHandleA
GetModuleHandleW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
HeapAlloc
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
GlobalLock
GlobalSize
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetFileType
GetStdHandle
LoadLibraryA
SleepEx
FreeLibrary
GetProcAddress
GetCurrentThread
QueryPerformanceFrequency
MultiByteToWideChar
CreateEventA
InitializeCriticalSectionEx
FormatMessageW
ReleaseSRWLockExclusive
MoveFileExA
WaitForSingleObject
GlobalUnlock
DeleteCriticalSection
LockResource
LoadResource
SizeofResource
FindResourceW
VirtualQuery
GetVolumeInformationA
DeviceIoControl
CreateFileA
WritePrivateProfileStringW
CreateDirectoryW
GetFileAttributesW
SetUnhandledExceptionFilter
GetSystemTime
GetCurrentProcess
GetCurrentProcessId
CreateThread
TerminateThread
ReadFile
GetFileSize
GetPrivateProfileStringA
GetTickCount
WideCharToMultiByte
HeapFree
GetProcessHeap
VirtualProtect
OutputDebugStringW
IsBadReadPtr
WritePrivateProfileStringA
CloseHandle
Sleep
GetPrivateProfileIntA
GetModuleFileNameW
GetPrivateProfileStringW
GetCurrentDirectoryA
InitializeCriticalSection
CreateIoCompletionPort
GetLastError
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
GetSystemDirectoryA
GetDriveTypeA
GetFileAttributesA
CreateDirectoryA
lstrcpyA
lstrlenA
OutputDebugStringA
lstrcatA
GetQueuedCompletionStatus
GetSystemInfo
GetEnvironmentVariableA
GetPrivateProfileIntW
CreateFileW
GetCurrentThreadId
user32
IsIconic
GetSystemMetrics
DrawIcon
LoadMenuW
GetSubMenu
GetCursorPos
GetWindowTextA
OpenClipboard
GetClipboardData
CloseClipboard
KillTimer
MessageBoxA
SetTimer
GetClientRect
AppendMenuW
GetSystemMenu
LoadIconW
EnableWindow
wsprintfA
MessageBoxW
SendMessageW
advapi32
CryptReleaseContext
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptImportKey
OpenThreadToken
CryptAcquireContextA
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
shell32
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW
DragQueryFileA
SHGetSpecialFolderPathA
comctl32
InitCommonControlsEx
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??Bid@locale@std@@QAEIXZ
_Strcoll
_Strxfrm
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Xbad_function_call@std@@YAXXZ
ws2_32
send
gethostbyname
ioctlsocket
connect
select
recv
getpeername
getsockname
ntohs
shutdown
WSASend
sendto
recvfrom
accept
__WSAFDIsSet
socket
WSACleanup
WSASetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getsockopt
WSAStartup
gethostname
getaddrinfo
inet_ntop
freeaddrinfo
WSARecv
WSAIoctl
setsockopt
listen
htonl
htons
ntohl
inet_ntoa
WSASocketW
WSAGetLastError
inet_addr
closesocket
bind
vcruntime140
strstr
__std_exception_copy
__std_exception_destroy
memchr
memset
__CxxFrameHandler3
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
strchr
_purecall
strrchr
memmove
__std_terminate
_CxxThrowException
memcpy
plfl32
P_CardReCharge
P_UserReg
P_GetLoginValue
P_UserLogin
P_LoadSystem
P_GetInfo
P_GetDataValue
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenW
iphlpapi
GetAdaptersInfo
dbghelp
MiniDumpWriteDump
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
_get_wide_winmain_command_line
_register_onexit_function
_initterm_e
__sys_nerr
__sys_errlist
_exit
exit
_errno
_beginthreadex
_configure_wide_argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_initterm
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_crt_atexit
terminate
_controlfp_s
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
free
realloc
calloc
malloc
_set_new_mode
api-ms-win-crt-time-l1-1-0
_time64
strftime
_gmtime64
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
ftell
__acrt_iob_func
fseek
fread
fclose
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fputc
fwrite
__stdio_common_vfprintf
fputs
__stdio_common_vswprintf
feof
fflush
__stdio_common_vsscanf
_open
_fseeki64
fgets
_lseeki64
_set_fmode
_read
_write
__p__commode
_fileno
_close
fopen
api-ms-win-crt-convert-l1-1-0
atoi
strtoll
strtoul
strtol
wcstombs
_wtoll
atoll
api-ms-win-crt-string-l1-1-0
_strdup
toupper
strncpy
strspn
strpbrk
strncmp
strcspn
strtok
api-ms-win-crt-filesystem-l1-1-0
_unlink
_fstat64
_access
_stat64
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
bcrypt
BCryptGenRandom
crypt32
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
normaliz
IdnToUnicode
IdnToAscii
wldap32
ord50
ord45
ord60
ord41
ord46
ord217
ord143
ord22
ord26
ord27
ord211
ord33
ord35
ord79
ord30
ord200
ord301
ord32
Sections
.text Size: 541KB - Virtual size: 541KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ