gfdfgd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gfdfgd.exe
Size 3.8MB
Sample260715-sld2qaat71
SHA256 ccb5cbf96604af191409a280147aa2d077af6c0ae1183fc61620179444c3f516
MD5 cbd8e9cfaa07522a2a0253cad00fe24c
SHA1 77deb54198472cb85f5a39ea93542b5207f7042a
SHA512 5b42ced23cec23f9173b581f175189ea786195dec2ed3dec55855d1682fd9a35b16cba0b1d3dc4e42f07e8d60c2d053c6aee410500b72f2e6a4ff8869ba5cbf8
SSDEEP 49152:4juPeiu9ryjkRDG7iD2dqEt2NXK+l6nvz2MWiM:Cuu1ywRDIBdp2IP
TLSH
T160069C719A9C8B4EF02AB039C1939617E7F1BC0D2721DF8BAAD09DB7495F190F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gfdfgd.exe

File Explorer

gfdfgd.exe

.exe 3.8MB

gfdfgd.exe

IMPHASH 4fa96ea2f891e93669027dd4e42b639f
SHA256 ccb5cbf96604af191409a280147aa2d077af6c0ae1183fc61620179444c3f516
MD5 cbd8e9cfaa07522a2a0253cad00fe24c
SHA1 77deb54198472cb85f5a39ea93542b5207f7042a
SHA512 5b42ced23cec23f9173b581f175189ea786195dec2ed3dec55855d1682fd9a35b16cba0b1d3dc4e42f07e8d60c2d053c6aee410500b72f2e6a4ff8869ba5cbf8
SSDEEP 49152:4juPeiu9ryjkRDG7iD2dqEt2NXK+l6nvz2MWiM:Cuu1ywRDIBdp2IP
TLSH
T160069C719A9C8B4EF02AB039C1939617E7F1BC0D2721DF8BAAD09DB7495F190F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3383928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

kernel32

Process32First SetConsoleTextAttribute SetConsoleTitleA GetStdHandle DeviceIoControl WaitForSingleObject CreateFileW CreateToolhelp32Snapshot Sleep Process32Next CloseHandle Beep lstrcmpiA CreateProcessA GetModuleHandleA GetLocalTime GetComputerNameA MultiByteToWideChar GlobalAlloc AcquireSRWLockExclusive GlobalLock SleepConditionVariableSRW GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter WakeAllConditionVariable IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetCurrentThreadId WideCharToMultiByte ReleaseSRWLockExclusive GlobalFree

user32

mouse_event UnregisterClassA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect TranslateMessage IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DestroyWindow SetWindowPos ShowWindow PeekMessageA SetWindowLongA GetWindowLongA SetWindowDisplayAffinity DefWindowProcA CreateWindowExA MessageBoxA PostQuitMessage RegisterClassExA UpdateWindow GetCursorPos DispatchMessageA GetSystemMetrics GetAsyncKeyState SetLayeredWindowAttributes

shell32

ShellExecuteA

ole32

CoInitialize

msvcp140

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException memcpy strstr __std_terminate __std_exception_copy __std_exception_destroy memchr memcmp memmove

api-ms-win-crt-heap-l1-1-0

realloc malloc _set_new_mode free _callnewh

api-ms-win-crt-string-l1-1-0

toupper strncpy tolower strcpy_s strcmp strncmp isspace

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _invoke_watson _errno

api-ms-win-crt-filesystem-l1-1-0

remove _lock_file _unlock_file

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __p__commode __stdio_common_vfprintf fputc __stdio_common_vsscanf __acrt_iob_func fflush fclose fgetc fwrite _wfopen __stdio_common_vsprintf fseek ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos

api-ms-win-crt-math-l1-1-0

roundf fmodf pow _dsign powf sinf sqrt floorf ldexp _dclass sqrtf _fdclass fminf acosf asin cosf tanf fmaxf __setusermatherr ceilf atan2

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoll strtol

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort