zort[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

zort.zip
Size

1KB
MD5

b690cb8f221f37c7fc5b49954ba7cdcf
SHA1

5e3083424b0ac3242d2117cd3741da7b9045b54d
SHA256

a8eb7c9e1f6520a20c1e5b119a69f53dd93aa2cd93517b0948ba12fab5aefeb9
SHA512

637211b64a2293ecc57e51cc118f5d4ae40995b8deacdebde755f916247af5fdbdfea162b3acc3da672b2e96484fa32ba89e573f968fe7b10c1657f5f9abb543

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/launcher.exe

Files

zort.zip
.zip

Password: 12345
launcher.exe
.exe windows x64

Password: 12345

b4c6fff030479aa3b12625be67bf4914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
ExitProcess

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ktbe
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE