9e07993d3c7f9c74a437000905beac53a505dc57f1197f74bd4ca98533efe7e0
- SHA256 9e07993d3c7f9c74a437000905beac53a505dc57f1197f74bd4ca98533efe7e0
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GixRadar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
GixRadar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
boost_random-vc143-mt-x64-1_86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
boost_random-vc143-mt-x64-1_86.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
zlib1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
zlib1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 9e07993d3c7f9c74a437000905beac53a505dc57f1197f74bd4ca98533efe7e0
- Size 10.3MB
- Sample261027-ya5cesgt4n
- SHA256 9e07993d3c7f9c74a437000905beac53a505dc57f1197f74bd4ca98533efe7e0
- MD5 2990084a73d13e893a220b71b19ec364
- SHA1 eec40a0ed0c2870c0e374946362c51245d0fa5ff
- SHA512 7083830eb0c2b3599d3bdf03452845f96afd3c542fd873c4b1661cee34ef853799020c22f9b6334620820f570889209c049208f0b235892296c2b39a7cf3f90c
- SSDEEP 196608:KFHjDkySaT2EzItVKmCWosOitc8ORTqAGnOWOh8r74bWUzkOgQf47m2kLg5:KRbfzW7losJORu7OW8a4bWUIDmumTL+
- TLSH T15BB6330D2129BDC8E04795BF65F9945EB4DFBC3CFE2B10E9340B59253844629326EAF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/GixRadar.exe unpack001/boost_random-vc143-mt-x64-1_86.dll unpack001/zlib1.dll
File Explorer
-
9e07993d3c7f9c74a437000905beac53a505dc57f1197f74bd4ca98533efe7e0.zip 10.3MB
-
GixRadar.exe.exe 14.1MB
-
boost_random-vc143-mt-x64-1_86.dll.dll 30KB
-
zlib1.dll.dll 88KB
GixRadar.exe
- IMPHASH 98a2fc8d4900172a6a203eea9cdb29b1
- SHA256 a4e055bf2ca30a6854bc4428d1c29bc5d2b6a427cca9a863d828501f451bc9b7
- MD5 5b955336d6a06f064db9bb6bee131bdd
- SHA1 05653f4746d11d82ff97d51c917d5527e547ff79
- SHA512 b1390ac7748ffd4fa99ea4f065f7577056c032adb0d11fe0b9aaa3bee1bfa996cb2fedee8818e76efa28c54553ac0c2fba4e63237c7bd1c46f621441c560307a
- SSDEEP 196608:ghiUbclCVIrNwUWgQYejSpx0m1wXlNfoEikfIcb6g4Z4nYP06SThlC:eiUbcI6rNrKjmf1OiG/u3wYP03h
- TLSH T166E601D52ECE6169E92ACB72879880BBD3DA338D6F0449D3D0881184142EEDED37D677
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7737520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetWaitableTimer
user32
BeginPaint
gdi32
SelectObject
ntdll
RtlVirtualUnwind
ws2_32
bind
cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetNumberValue
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InitHooks
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithLength
cJSON_ParseWithLengthOpts
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_SetValuestring
cJSON_Version
cJSON_free
cJSON_malloc
Name
.text
Size
Virtual Size
706KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rvkhh
Size
13.9MB
Virtual Size
13.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.hmihf
Size
68KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
57KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=195, id=261, version=33145,
count=26, id=260, version=33145,
count=8, id=259, version=33145,
count=1, productName=Unmarked objects (old),
count=96, id=261, version=30034,
count=17, id=260, version=30034,
count=10, id=259, version=30034,
count=11, id=257, version=33145,
count=242, id=1, productName=Unmarked objects,
count=8, id=264, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
boost_random-vc143-mt-x64-1_86.dll
- IMPHASH bedcccb1cea61a3838ecafcea39db855
- SHA256 b3ebc4d0a89186bd2a6a99e65146fb4707eaf9622493c8fc76a68689f2e3f75a
- MD5 2c156eefe07a1a8c1dba8d0fc27b3b69
- SHA1 e0d0411b1c9387022c5ba8a8bd59e973023a60e0
- SHA512 b4c78a1774a7f3a146f668caf3e1f84a98e515689b730be7d9fe3c8b87c2aceb3a3e7634ea5d16748943c48f8c104fe48942f1b5da2f7b3848cc33f1f5bbaea9
- SSDEEP 384:0/XRHpw1WA3aovQofwWf5L0d6r1p2V/8YJ7FTYVN5hJOj4Rgm2Np11Loy0DdkKy9:0tpfeocnRk/rfTYDOAgPMRR+
- TLSH T1EED22A567B6801D5F25A413DC9936E5AE2F6B81407228BCF13E0032E1F3B7D86D7B642
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16988
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\huihu\Desktop\vcpkg-2025.01.13\buildtrees\boost-random\x64-windows-rel\stage\bin\boost_random-vc143-mt-x64-1_86.pdb
kernel32
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
GetLastError
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptEnumProvidersA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_purecall
memcpy
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm
_initterm_e
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_cexit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
??0random_device@random@boost@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0random_device@random@boost@@QEAA@XZ
??1random_device@random@boost@@QEAA@XZ
??Rrandom_device@random@boost@@QEAAIXZ
?entropy@random_device@random@boost@@QEBANXZ
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=34321,
count=8, id=260, version=34321,
count=19, id=261, version=34321,
count=6, id=257, version=34321,
count=5, id=257, version=30795,
count=58, id=1, productName=Unmarked objects,
count=1, id=261, version=34809,
count=1, id=256, version=34809,
count=1, id=255, version=34809,
count=1, id=258, version=34809,
zlib1.dll
- IMPHASH d879d2294039900ef484e0f01607f882
- SHA256 7a5f10b0b075d354c9015e60721ece7a35de9348d9095ebd1bad1c0604b0c141
- MD5 f87e50e9e0c1c55f43751f4019a667f5
- SHA1 831ea82eefe24c4f09135b46a930974e1097552c
- SHA512 7bbf863766c06a5cfad7e8c32c27e33a1dfd20da6ffada005bab838ff7d70ea2bc6f0fa784fe2c9e684d127babad36d675b13c67d0819ba31e3454f248c77652
- SSDEEP 1536:lFQ5SVDXNVLIXUcZEpmrfJ7wl8lj6IOcIOZ/A2B7Gr:HkSZ9Jf8Ep27wKISZ/A2BK
- TLSH T11D938C9A6AB012A6CAF74078D4D30B9DD331B01007A55BDF9688A76A1F13AD41F363FD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
56816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\huihu\Desktop\vcpkg-2025.01.13\buildtrees\zlib\x64-windows-rel\zlib.pdb
vcruntime140
__std_type_info_destroy_list
__C_specific_handler
memmove
memchr
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
_wopen
_write
_read
_close
__stdio_common_vsprintf
_open
_lseeki64
api-ms-win-crt-heap-l1-1-0
malloc
free
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-runtime-l1-1-0
_errno
strerror
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_cexit
kernel32
DisableThreadLibraryCalls
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine_gen
crc32_combine_op
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=34321,
count=4, id=253, version=34321,
count=3, id=259, version=34321,
count=8, id=260, version=34321,
count=12, id=261, version=34321,
count=2, id=257, version=30795,
count=49, id=1, productName=Unmarked objects,
count=15, id=260, version=34809,
count=1, id=256, version=34809,
count=1, id=255, version=34809,
count=1, id=151,
count=1, id=258, version=34809,