zClient[.]exe | Triage

Sharing

General

Target

zClient.exe
Size

11KB
MD5

cb193c19c0dec219faccc9f86bcd7e9d
SHA1

69982cb1befa5f2f85bdd535c7f3ed3f4fb22f82
SHA256

01cc3e89f932f50a6f672209fc914d13e171dd84b98fbe0c1b0cb7928ca96044
SHA512

01672ead03ff5ebabce839af1599ac8ce805cebd8485d9b5996ebc489d43e19b7cfd2c9d90859ef9bdebc85b0ecfe9a58203c577508b3241541031dfb9facedd
SSDEEP

192:kA3R3OwHkeHe90o0WbFj5OGfdSck9TRq9i4yaqzGJP5xzM:kA8wEeHUFOGfdSck9Ts9caEGJPjz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zClient.exe

Files

zClient.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ