E:\Projects\gzdoom-g4.12.2\build\RelWithDebInfo\gzdoom.pdb
Static task
static1
Behavioral task
behavioral1
Sample
gzdoom.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
gzdoom.exe
Resource
win10v2004-20240802-en
General
-
Target
gzdoom.exe
-
Size
10.8MB
-
MD5
d0e81927f79b097e4ef4914be351ceef
-
SHA1
37d09924045d2f67f50aa5deb024e614b1ebfbb1
-
SHA256
d3e783bac3e70f4b8024d5c9102ffeb32cc715e8397f9a9ab588e624fe312d8c
-
SHA512
70e4799325f4216f28fae6f7a27d6dc39ccf6825e5d3b3f17dfae3bc6d16f2b7e9d9ab256ca7a02cc8a857329245891dc94597af6e0c54b6419bd51f13470b98
-
SSDEEP
196608:t6YsI1CaJTrw4JleRCADhx/Uu11BWdamiYSzB:t61I1xdrwceRC+x/U41SHSz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gzdoom.exe
Files
-
gzdoom.exe.exe windows:6 windows x64 arch:x64
b9a61687c0c95b68993e9000fb086238
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
psapi
GetModuleInformation
wsock32
inet_addr
ntohl
recvfrom
sendto
ioctlsocket
gethostbyname
WSAStartup
WSACleanup
WSAGetLastError
htons
inet_ntoa
closesocket
socket
bind
winmm
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
dinput8
DirectInput8Create
ole32
CoInitialize
CoTaskMemFree
CoUninitialize
user32
DispatchMessageW
PeekMessageW
DefWindowProcW
PostQuitMessage
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
TranslateMessage
IsClipboardFormatAvailable
GetKeyState
MapVirtualKeyW
SetCapture
ReleaseCapture
InvalidateRect
AdjustWindowRectEx
GetWindowLongW
GetRawInputData
SetForegroundWindow
GetFocus
GetActiveWindow
SetFocus
EmptyClipboard
GetForegroundWindow
RegisterRawInputDevices
GetClientRect
MonitorFromWindow
GetMessageW
RegisterClassExW
SetTimer
KillTimer
LoadImageW
GetWindowRect
ShowCursor
SetCursorPos
GetCursorPos
ClientToScreen
ClipCursor
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetRawInputDeviceInfoW
ShowWindow
GetDC
ReleaseDC
MessageBoxA
EnumDisplaySettingsW
RegisterClassW
CreateWindowExW
SetWindowTextW
ScreenToClient
SetWindowTextA
GetUpdateRect
EndPaint
BeginPaint
GetDlgItem
EndDialog
DialogBoxParamW
CreateDialogParamW
CallWindowProcW
SendMessageW
SendMessageA
GetDesktopWindow
DestroyWindow
UnregisterClassW
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
GetMonitorInfoA
SetWindowLongW
IsZoomed
SetWindowPos
MoveWindow
CreateIconIndirect
DestroyCursor
SetClassLongPtrW
SetCursor
GetAsyncKeyState
LoadIconW
LoadCursorW
SetWindowLongPtrW
GetWindowLongPtrW
gdi32
SetBkColor
GetMapMode
BitBlt
DPtoLP
GetObjectW
SetMapMode
SetPixelFormat
DescribePixelFormat
ChoosePixelFormat
SwapBuffers
CreateDIBSection
SetPixelV
SelectObject
Rectangle
GetStockObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
CreateSolidBrush
GetDeviceCaps
SetDIBitsToDevice
comctl32
ord345
ord17
comdlg32
GetSaveFileNameW
dbghelp
SymGetLineFromAddr64
SymInitialize
SymGetSymFromAddr64
SymCleanup
ImageNtHeader
zmusic
ZMusic_Stop
ZMusic_SetGenMidi
ZMusic_SetWgOpn
ZMusic_SetDmxGus
ZMusic_CreateMIDISource
ZMusic_IsMIDI
ZMusic_VolumeChanged
ZMusic_WriteSMF
ZMusic_GetStats
ZMusic_IsPlaying
ZMusic_GetStreamInfo
ZMusic_IsLooping
ZMusic_SetSubsong
ZMusic_Close
ZMusic_MIDIDumpWave
ZMusic_IdentifyMIDIType
ZMusic_GetLastError
ZMusic_GetMidiDevices
ZMusic_Update
ChangeMusicSettingInt
FindLoopTags
SoundDecoder_Close
SoundDecoder_Read
SoundDecoder_GetInfo
CreateDecoder
ChangeMusicSettingFloat
ZMusic_Resume
ZMusic_Pause
ZMusic_Start
ZMusic_FillStream
ZMusic_OpenSong
ChangeMusicSettingString
ZMusic_SetCallbacks
ZMusic_GetADLBanks
advapi32
RegSetValueExW
RegCreateKeyExW
GetUserNameW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
kernel32
RtlUnwind
RtlUnwindEx
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
GetLogicalProcessorInformationEx
GetCurrentProcessorNumberEx
GetThreadPriority
SignalObjectAndWait
SetLastError
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
InitializeSListHead
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleExW
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetSystemTimeAsFileTime
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
GetCommandLineA
ExitThread
HeapSize
CreateDirectoryW
GetFileAttributesExW
GetDriveTypeW
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
DeleteFileW
RemoveDirectoryW
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
SetStdHandle
GetCPInfo
FlsAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
RaiseException
RtlPcToFileHeader
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryAcquireSRWLockExclusive
GetNativeSystemInfo
SwitchToThread
WaitForSingleObjectEx
ReleaseSemaphore
SetEvent
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFreeEx
VirtualAllocEx
GetSystemInfo
GlobalFree
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateMutexW
ReleaseMutex
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
GetTickCount64
AllocConsole
SleepEx
GetCurrentProcess
SetPriorityClass
GlobalAlloc
GlobalUnlock
GlobalLock
FreeLibrary
GetProcAddress
LoadLibraryW
RtlCaptureContext
VerSetConditionMask
GetStdHandle
GetCommandLineW
GetFileInformationByHandle
WriteFile
CloseHandle
DuplicateHandle
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
Sleep
QueueUserAPC
ExitProcess
GetCurrentThread
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleW
LoadLibraryA
VerifyVersionInfoW
AttachConsole
GetConsoleMode
SetConsoleMode
ReadConsoleW
FlushConsoleInputBuffer
SetConsoleCP
SetConsoleOutputCP
SetCurrentDirectoryW
GetCurrentDirectoryW
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
GetVersionExW
GetModuleHandleA
LocalFree
GetProcessAffinityMask
SetThreadAffinityMask
FormatMessageA
GetNumaProcessorNode
GetEnvironmentVariableW
CreateFileW
GetFullPathNameW
MoveFileExW
RtlVirtualUnwind
GetFileSize
GetTempFileNameW
ReadFile
SetFilePointer
GetTempPathW
WaitForSingleObject
GetCurrentProcessId
CreateThread
GetExitCodeThread
VirtualQuery
GetWindowsDirectoryW
IsDebuggerPresent
OutputDebugStringW
RtlAddFunctionTable
RtlDeleteFunctionTable
RtlLookupFunctionEntry
HeapCreate
HeapReAlloc
HeapFree
WideCharToMultiByte
FindClose
FindFirstFileW
FindNextFileW
MultiByteToWideChar
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
lstrlenW
PeekNamedPipe
WaitNamedPipeW
shell32
ShellExecuteW
SHGetKnownFolderPath
ShellExecuteA
dwmapi
DwmSetWindowAttribute
DwmDefWindowProc
Exports
Exports
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Sections
.text Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text.un Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 514KB - Virtual size: 10.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 293KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
vreg Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
creg Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
freg Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
areg Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
yreg Size: 1024B - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
greg Size: 1024B - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata.u Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata.u Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rodata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 302KB - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ