c:\github-runner\_work\garrysmod.main\garrysmod.main\x86-64\src\garrysmod\tools\gmad\obj\gmad\win64\Release\gmad.pdb
Static task
static1
1 signatures
General
-
Target
gmad.exe
-
Size
424KB
-
MD5
4b3a34e96a8ede44da1e0fd28527dcb8
-
SHA1
ba3da13f41c9ecbdeb5a3ca7afb8b4262c326c54
-
SHA256
9b0883ff0f0b8568719ebba5c6ec77690ade0b477334cd4a87e29420d8de92e4
-
SHA512
dc3f1de89e78f0ac2b53a856c86f5f132ad934cde030be2beca37be99432ef1dc30a0fcae81f7438b943b6656d22ecf4c168a9be7848e5c96347242ef3312c48
-
SSDEEP
12288:RaIf0ewO33skvC7BvB9btdDxgROcoWx3:7f0eV27Bp9btdDANR
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gmad.exe
Files
-
gmad.exe.exe windows:6 windows x64 arch:x64
Password: e
051a5c6613be975bcb1b218bd6c3cee4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
SetConsoleTextAttribute
FindClose
FindFirstFileExA
FindNextFileA
OutputDebugStringA
GetLastError
QueryPerformanceCounter
FreeLibrary
GetProcAddress
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
SetConsoleCursorPosition
GetCPInfo
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
WriteConsoleW
HeapSize
SetEndOfFile
CreateDirectoryW
GetConsoleScreenBufferInfo
GetStringTypeW
GetStdHandle
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
SetEnvironmentVariableW
GetCurrentDirectoryW
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
HeapFree
HeapAlloc
GetFileAttributesExW
HeapReAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
SetStdHandle
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
RtlUnwind
Sections
.text Size: 300KB - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ