Static task
static1
Behavioral task
behavioral1
Sample
ZoomInstallerFull.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
ZoomInstallerFull.exe
Resource
win7-20221111-en
General
-
Target
ZoomInstallerFull.exe
-
Size
76.4MB
-
MD5
aeb04e767a408e5ac643cd467751afff
-
SHA1
cc2b84718bcec1fe34b3e9189762149f4a91fc23
-
SHA256
9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd
-
SHA512
d7e4e4c523290ac5afec1382c275dacc8a1657d7a75c2298c3bbf1fe7881253a3b5005895b72954f5062f6cd25a52df6f72c4d0022335f2349c6ede2d0e66114
-
SSDEEP
1572864:jpDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGsF:9DLfrQQ/FA3RAicfUjByfFIDJ
Malware Config
Signatures
Files
-
ZoomInstallerFull.exe.exe windows x64
3ec43c2377bea4e2654cec905965a62a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
Sleep
CreateFileA
CloseHandle
CreateProcessA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
vcruntime140
__current_exception
__current_exception_context
memset
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_exit
_register_thread_local_exe_atexit_callback
__p___argv
_crt_atexit
terminate
_set_app_type
_initialize_onexit_table
_configure_narrow_argv
exit
__p___argc
_c_exit
_register_onexit_function
_initialize_narrow_environment
_initterm_e
_get_initial_narrow_environment
_initterm
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76.4MB - Virtual size: 76.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ