ZAT[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ZAT.exe
Size

7.3MB
MD5

ef0d477c9109a4b432c360ccef6b75ce
SHA1

f18ac4ea49f55829c930e71b89bf5e9f98afe8eb
SHA256

9479a55a5d4418fe5b13e91b1dae9e26018d2c6f19da416f05ca055c7b39704e
SHA512

136416d41b24080ff9015ec9fe2cb9b85bb1bafd1ff3745117761b07752c9fddaa84f4a1700e82f60170a2262cc5f3d68ebe2518388022700d6cdc2fb53072db
SSDEEP

196608:putSyK7jHEV5H+PuQra2QLaQDGT1DjMt5:g607BsxQDiob

Score

N/A

Malware Config

Signatures

Files

ZAT.exe
.exe windows x86

0a4cc8ff4c037c898fb3d24be14d53f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

d3d11

D3D11CreateDevice

d3d9

D3DPERF_SetOptions

dinput8

DirectInput8Create

winmm

timeEndPeriod
timeBeginPeriod

wsock32

connect
WSAStartup
socket
ioctlsocket
send
ntohl
getsockopt
__WSAFDIsSet
sendto
WSACleanup
htons
bind
WSAGetLastError
closesocket
getsockname
ntohs
select
recvfrom
setsockopt
inet_addr
inet_ntoa
listen
accept
recv

xinput1_3

ord3
ord4
ord2

kernel32

IsProcessorFeaturePresent
CreateMutexA
OpenProcess
SetUnhandledExceptionFilter
CreateEventA
SetCurrentDirectoryA
SetDllDirectoryA
FindClose
FindNextFileA
FindFirstFileA
UnmapViewOfFile
MapViewOfFile
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
LocalAlloc
CreateFileMappingA
GetFileSize
GetFileAttributesExA
ReadFile
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
CreateSemaphoreA
CloseHandle
GetModuleHandleA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
InterlockedExchangeAdd
InterlockedExchange
CreateFileA
WriteFile
GetFileAttributesA
LoadLibraryA
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetLocalTime
GetModuleFileNameA
CreateDirectoryA
GetLastError
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
HeapAlloc
GetProcessHeap
HeapFree
TlsGetValue
RaiseException
TlsAlloc
TlsSetValue
GetSystemInfo
ExitThread
SwitchToThread
Sleep
WaitForSingleObject
ReleaseSemaphore
QueryPerformanceFrequency
CreateWaitableTimerA
QueryPerformanceCounter
SetWaitableTimer
GetPriorityClass
GetCommandLineA
SetPriorityClass

user32

IsCharUpperW
GetAsyncKeyState
ClipCursor
SetCursorPos
SetForegroundWindow
SetWindowLongA
ShowCursor
GetCursorPos
ClientToScreen
MoveWindow
CharLowerBuffW
DefWindowProcA
GetKeyState
PostQuitMessage
EndPaint
BeginPaint
GetClientRect
GetWindowRect
DispatchMessageA
TranslateMessage
PeekMessageA
UpdateWindow
CreateWindowExA
RegisterClassA
LoadCursorA
DestroyWindow
AdjustWindowRect
GetSystemMetrics
GetForegroundWindow
SendMessageA
RegisterWindowMessageA
MessageBoxA
ShowWindow
MapVirtualKeyA
SetWindowPos
LoadIconA

advapi32

GetUserNameA

shell32

SHGetFolderPathAndSubDirA
SHGetFolderPathA

ole32

CoUninitialize
CoTaskMemFree
CoGetClassObject
CoCreateInstance
CoTaskMemAlloc
CoInitializeEx

msvcr100

__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
_amsg_exit
__getmainargs
_cexit
_wcsicmp
_wcsnicmp
_CIsinh
__libm_sse2_expf
__libm_sse2_logf
__libm_sse2_log10f
__libm_sse2_tanf
__libm_sse2_atan2
__libm_sse2_asinf
_CIfmod
__libm_sse2_acosf
__libm_sse2_powf
__libm_sse2_sinf
__libm_sse2_cosf
_onexit
_lock
__dllonexit
_unlock
cos
sin
floor
memcpy
_XcptFilter
memset
memcmp
_vsnprintf
_strnicmp
sscanf
_stricmp
malloc
free
_exit
vsprintf_s
_time64
_beginthreadex
_fpieee_flt
_snprintf
_splitpath
strnlen
strncat
fread
fclose
ftell
fseek
fopen
_fmode
exit
rand
srand
atoi
wcsncmp
wcsncpy
ceil
strtok
__libm_sse2_pow
__libm_sse2_log
vsprintf
toupper
islower
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_aligned_free
_aligned_malloc
qsort
memmove
_purecall
strncpy
tolower
strrchr
modf
isspace
isdigit
iswspace
iswdigit
strchr
wcschr
strstr
wcsstr
iswupper
isupper
strncmp
towlower

dbghelp

SymSetSearchPath
SymGetSearchPath
SymInitialize
SymGetOptions
SymSetOptions
SymLoadModule64
EnumerateLoadedModules64
SymGetLineFromAddr64
UnDecorateSymbolName
SymFromAddr
SymFunctionTableAccess64
SymGetModuleBase64
StackWalk64
SymGetModuleInfo64

psapi

EnumProcesses
GetProcessImageFileNameA

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bind
Size: 395KB - Virtual size: 395KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a4cc8ff4c037c898fb3d24be14d53f3

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3d9

dinput8

winmm

wsock32

xinput1_3

kernel32

user32

advapi32

shell32

ole32

msvcr100

dbghelp

psapi

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 104KB - Virtual size: 1.2MB

.rsrc Size: 72KB - Virtual size: 71KB

.reloc Size: 332KB - Virtual size: 332KB

.bind Size: 395KB - Virtual size: 395KB

.text
Size: 5.3MB - Virtual size: 5.3MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 104KB - Virtual size: 1.2MB

.rsrc
Size: 72KB - Virtual size: 71KB

.reloc
Size: 332KB - Virtual size: 332KB

.bind
Size: 395KB - Virtual size: 395KB