General

Malware Config

Signatures

Files

• FakeZoom.zip

  .zip

  Password: infected

• ZoomInstallerFull.exe

  .exe windows x64

  3ec43c2377bea4e2654cec905965a62a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  WriteFile

  Sleep

  CreateFileA

  CloseHandle

  CreateProcessA

  IsDebuggerPresent

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  TerminateProcess

  GetCurrentProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  GetModuleHandleW

  vcruntime140

  __current_exception

  __current_exception_context

  memset

  __C_specific_handler

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  _set_fmode

  __stdio_common_vsprintf

  api-ms-win-crt-runtime-l1-1-0

  _cexit

  _seh_filter_exe

  _exit

  _register_thread_local_exe_atexit_callback

  __p___argv

  _crt_atexit

  terminate

  _set_app_type

  _initialize_onexit_table

  _configure_narrow_argv

  exit

  __p___argc

  _c_exit

  _register_onexit_function

  _initialize_narrow_environment

  _initterm_e

  _get_initial_narrow_environment

  _initterm

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 75.4MB - Virtual size: 75.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 408B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 44B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ikm.aaa.dll

  .dll windows x64

  bbd59785b831ba0244fd5ab3586920bd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  ReleaseDC

  DrawFocusRect

  GetDesktopWindow

  GetWindowDC

  gdi32

  SelectObject

  CreateCompatibleDC

  CreateCompatibleBitmap

  CreateBitmap

  BitBlt

  CreatePen

  DeleteObject

  LineTo

  DeleteDC

  SetROP2

  MoveToEx

  vcruntime140

  strstr

  __C_specific_handler

  memset

  __std_type_info_destroy_list

  strrchr

  api-ms-win-crt-stdio-l1-1-0

  fopen

  fseek

  __stdio_common_vfprintf

  __acrt_iob_func

  fread

  __stdio_common_vsprintf

  fclose

  ftell

  api-ms-win-crt-string-l1-1-0

  isspace

  strncpy

  _stricmp

  strncmp

  api-ms-win-crt-convert-l1-1-0

  strtol

  strtod

  api-ms-win-crt-runtime-l1-1-0

  _execute_onexit_table

  _initialize_narrow_environment

  _cexit

  _configure_narrow_argv

  _seh_filter_dll

  _initialize_onexit_table

  exit

  _initterm_e

  _initterm

  kernel32

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  UnhandledExceptionFilter

  RtlCaptureContext

  IsDebuggerPresent

  InitializeSListHead

  DisableThreadLibraryCalls

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  TerminateProcess

  GetCurrentProcess

  SetUnhandledExceptionFilter

  Exports

  Exports

  hixComputeTextGeometry

  hixDItemGetAnchor

  hixDItemStyleChanged

  hixDItemStyleConfigureGCs

  hixDItemStyleFree

  hixDisplayText

  hixFm_AddToMaster

  hixFm_Configure

  hixFm_DeleteMaster

  hixFm_FindClientPtrByName

  hixFm_ForgetOneClient

  hixFm_FreeMasterInfo

  hixFm_GetFormInfo

  hixFm_StructureProc

  hixFm_Unlink

  hixFm_UnlinkFromMaster

  hixGetColorDItemGC

  hixGetDefaultDItemStyle

  hixGetHashTable

  hixGrDataFirstCell

  hixGrDataFirstRow

  hixGrDataNextCell

  hixGrDataNextRow

  hixGridDataConfigRowColSize

  hixGridDataCreateEntry

  hixGridDataDeleteEntry

  hixGridDataDeleteRange

  hixGridDataDeleteSearchedEntry

  hixGridDataFindEntry

  hixGridDataGetGridSize

  hixGridDataGetIndex

  hixGridDataGetRowColSize

  hixGridDataMoveRange

  hixGridDataSetFree

  hixGridDataSetInit

  hixGridDataUpdateSort

  hix_AddDItemType

  hix_ArgcError

  hix_CallConfigMethod

  hix_CallMethod

  hix_ChangeOneOption

  hix_ChangeOptions

  hix_ConfigureInfo2

  hix_ConfigureValue2

  hix_CreateCommands

  hix_CreateSubWindow

  hix_DItemCalculateSize

  hix_DItemComponent

  hix_DItemConfigure

  hix_DItemCreate

  hix_DItemDisplay

  hix_DItemDrawBackground

  hix_DItemFillNormalBG

  hix_DItemFree

  hix_DefinePixmap

  hix_DrawAnchorLines

  hix_EvalArgv

  hix_ExistMethod

  hix_Exit

  hix_FindConfigSpecByName

  hix_FindMethod

  hix_FindPublicMethod

  hix_FreeArgumentList

  hix_GetAnchorGC

  hix_GetChars

  hix_GetConfigSpecFullName

  hix_GetContext

  hix_GetDItemType

  hix_GetMethodFullName

  hix_GetRenderBuffer

  hix_GetScrollFractions

  hix_GetVar

  hix_GlobalVarEval

  hix_GrAddChangedRect

  hix_GrCancelDoWhenIdle

  hix_GrConfigSize

  hix_GrDoWhenIdle

  hix_GrFormat

  hix_GrFreeElem

  hix_GrFreeUnusedColors

  hix_GrScrollPage

  hix_GrSelection

  hix_GrSetSize

  hix_HLAllocColumn

  hix_HLCancelResizeWhenIdle

  hix_HLColumn

  hix_HLComputeGeometry

  hix_HLComputeHeaderGeometry

  hix_HLCreateHeaders

  hix_HLDrawHeader

  hix_HLElementLeftOffset

  hix_HLElementTopOffset

  hix_HLFindElement

  hix_HLFreeHeaders

  hix_HLHeader

  hix_HLIndicator

  hix_HLItem

  hix_HLItemInfo

  hix_HLMarkElementDirty

  hix_HLResizeNow

  hix_HLResizeWhenIdle

  hix_HandleSubCmds

  hix_Init

  hix_InitScrollInfo

  hix_LinkListAppend

  hix_LinkListDelete

  hix_LinkListDeleteRange

  hix_LinkListFind

  hix_LinkListFindAndDelete

  hix_LinkListInit

  hix_LinkListInsert

  hix_LinkListIteratorInit

  hix_LinkListNext

  hix_LinkListStart

  hix_MultiConfigureInfo

  hix_QueryAllOptions

  hix_QueryOneOption

  hix_SetDefaultStyleTemplate

  hix_SetRcFileName

  hix_SetScrollBarView

  hix_SetWindowItemSerial

  hix_SimpleListAppend

  hix_SimpleListDelete

  hix_SimpleListDeleteRange

  hix_SimpleListFind

  hix_SimpleListFindAndDelete

  hix_SimpleListInit

  hix_SimpleListInsert

  hix_SimpleListIteratorInit

  hix_SimpleListNext

  hix_SimpleListStart

  hix_SplitConfig

  hix_SuperClass

  hix_UnknownPublicMethodError

  hix_UnmapInvisibleWindowItems

  hix_UpdateScrollBar

  hix_ValueMissingError

  hix_WidgetConfigure2

  hix_WindowItemListRemove

  hix_ZAlloc

  hixpInitPixmapInstance

  hixpXpmAllocTmpBuffer

  hixpXpmDisplay

  hixpXpmFreeInstanceData

  hixpXpmFreeTmpBuffer

  hixpXpmRealizePixmap

  hixpXpmSetPixel

  hixCellUid

  hixColumnUid

  hixDisabledUid

  hixNormalUid

  init

  Sections

  .text

  Size: 274KB - Virtual size: 274KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 60KB - Virtual size: 62KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 20KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ