Static task
static1
Behavioral task
behavioral1
Sample
zkoko.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
zkoko.exe
Resource
win10v2004-20221111-en
General
-
Target
zkoko.zip
-
Size
6.9MB
-
MD5
5d3fd37eacc55e07cfe7a13d88f06bd6
-
SHA1
23fb41b69c8d75c836f39c9c71d09f44874d17cd
-
SHA256
d6cd96e0af6ab1f93c7b5913336d9a266259e083e3fc1164f556d0672a9e795c
-
SHA512
268ccd74716523e5a266a379eb12719cc1f2df10b2dae3456580348469852f4a8b3e72ce8586c855bbe15fa52dca21c18a2877e400424d8d43e1c7d5eed13867
-
SSDEEP
196608:4CC57Xic8GxBrv/vcNgYlUbKQmjUDB7I4XG0Epd:wXicjpew7I4XDI
Malware Config
Signatures
Files
-
zkoko.zip.zip
-
zkoko.exe.exe windows x86
43b7c6cb27f8db03c07400fcae36fad0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DrawTextW
CharUpperBuffW
gdi32
CreateCompatibleDC
advapi32
GetUserNameW
shell32
CommandLineToArgvW
ole32
CoUninitialize
shlwapi
PathCompactPathExW
winmm
PlaySoundW
Sections
.text Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.R6| Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.H2v Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pTy Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ