t6zm - Zombies Offline[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

t6zm - Zombies Offline.exe
Size

12.5MB
MD5

837c6ae7dc13412fb4dd346cd7c987ff
SHA1

8be38c2acd6f084badbb953214079f3c5176910b
SHA256

2aff340f22f0c68bf46511c7bbc6167e4bb84524817f54cae08e8f60e6f9afc3
SHA512

c9a691955473ce2da963f3fbe6dd018f44b1bff537a1fe69c4aa080369430cb53b92818a490012a4f9c8e9d09332e6cbe9ea41f16ff069d933249f6c7413fd3f
SSDEEP

393216:3XYCs8QTHxoMo5uEQ5ysQNpLViuZw5gST:Gpqw7

Score

1^/10

Malware Config

Signatures

Files

t6zm - Zombies Offline.exe
.exe windows:5 windows x86

b5217f7e510cdca41e76c04812a5df52

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:5c:80:c6:d0:2d:d5:1e:55:ba:a6:82:10:59:9b:4a
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/06/2014, 00:00

Not After

29/06/2017, 12:00

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:f3:54:4d:97:52:c6:00:c2:cb:12:cd:da:bd:a8:f3:6b:46:92:03
Signer

Actual PE Digest

1e:f3:54:4d:97:52:c6:00:c2:cb:12:cd:da:bd:a8:f3:6b:46:92:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

steam_api

SteamGameServer_Init
SteamGameServer
SteamGameServer_Shutdown
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_Shutdown
SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_RunCallbacks
SteamAPI_Init
SteamAPI_RestartAppIfNecessary
SteamUtils
SteamUserStats
SteamApps
SteamNetworking
SteamGameServer_RunCallbacks
SteamUser
SteamFriends

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod
mixerClose
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerSetControlDetails
mixerGetDevCapsA
waveInGetNumDevs
mixerGetNumDevs

wsock32

htonl
recvfrom
select
sendto
shutdown
connect
socket
ioctlsocket
htons
recv
__WSAFDIsSet
WSAStartup
WSACleanup
gethostname
ntohl
closesocket
accept
bind
send
WSAGetLastError
setsockopt
gethostbyname
ntohs
inet_ntoa

faultrep

ReportFault

dxgi

CreateDXGIFactory1

dsound

ord6
ord11

kernel32

FormatMessageA
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CompareStringW
HeapQueryInformation
GetExitCodeProcess
CreatePipe
LoadLibraryW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
SetEnvironmentVariableA
SleepEx
GetExitCodeThread
TerminateThread
HeapAlloc
CreateFileW
InterlockedExchange
CloseHandle
GetFileInformationByHandleEx
HeapFree
CreateFileA
GetCurrentThreadId
GetTickCount
lstrlenW
GetStartupInfoW
GetModuleFileNameA
InterlockedIncrement
GetFileInformationByHandle
CreateSemaphoreA
InterlockedCompareExchange
Sleep
GetCurrentProcessId
GetModuleHandleA
GetLastError
ReleaseSemaphore
OpenFileById
GetTimeZoneInformation
GetProcessHeap
lstrcmpiW
FileTimeToSystemTime
GetProcessTimes
GetCurrentProcess
UnmapViewOfFile
HeapSize
SetLastError
InterlockedDecrement
GetFullPathNameW
GetConsoleWindow
SizeofResource
LoadLibraryA
GetSystemTime
WriteFile
QueryPerformanceFrequency
VirtualQuery
GetCommandLineW
GetCurrentDirectoryW
LockResource
CreateEventA
WaitForSingleObject
GetFullPathNameA
GetComputerNameA
SetEvent
CreateFileMappingA
MapViewOfFile
GetModuleHandleExA
DebugBreak
ExpandEnvironmentStringsA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetFileTime
LoadResource
GetProcAddress
ExitProcess
GetSystemTimeAsFileTime
FindResourceW
GetEnvironmentStringsW
lstrlenA
FreeLibrary
QueryPerformanceCounter
SetFilePointer
GetFileSize
ReadFile
RaiseException
ResetEvent
GetProcessAffinityMask
DuplicateHandle
GetCurrentThread
CreateThread
SuspendThread
ResumeThread
SetThreadPriority
OutputDebugStringW
InterlockedExchangeAdd
DeleteFileA
SetFileAttributesA
GetCurrentDirectoryA
VirtualAlloc
VirtualFree
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GlobalMemoryStatus
SetProcessAffinityMask
GetThreadPriority
OutputDebugStringA
GetDriveTypeA
GlobalUnlock
GlobalSize
GlobalLock
GlobalAlloc
GetVersionExA
SetErrorMode
SetUnhandledExceptionFilter
TerminateProcess
WaitForMultipleObjects
MulDiv
SetPriorityClass
SetThreadExecutionState
WideCharToMultiByte
GetSystemInfo
GetSystemDirectoryW
OpenFileMappingA
GetModuleFileNameW
GetWindowsDirectoryW
HeapCreate
HeapDestroy
OpenEventA
CreateSemaphoreW
GetModuleHandleW
OpenProcess
PulseEvent
FindClose
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
GetDriveTypeW
HeapReAlloc
ExitThread
CreateProcessA
GetTimeFormatA
GetDateFormatA
GetCommandLineA
HeapSetInformation
PeekNamedPipe
GetFileType
IsProcessorFeaturePresent
GetStdHandle
GetLocaleInfoW
UnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEnvironmentVariableW
CreateDirectoryA
MoveFileA
RtlUnwind
MultiByteToWideChar
EncodePointer
DecodePointer
ReleaseMutex
CreateMutexA
GetVersion
FlushConsoleInputBuffer
ReadConsoleInputA
SetConsoleMode
GetFileAttributesA

user32

SetWindowTextA
CallWindowProcA
PostQuitMessage
DestroyWindow
DefWindowProcA
CloseWindow
RegisterClassA
LoadImageA
CreateWindowExA
SendMessageA
AdjustWindowRect
SetWindowPos
MapVirtualKeyA
LoadCursorA
GetSystemMetrics
LoadIconA
RegisterClassExA
PeekMessageA
EmptyClipboard
SetClipboardData
OpenClipboard
GetClientRect
MonitorFromWindow
RegisterWindowMessageA
GetClipboardData
CloseClipboard
GetMessageA
DispatchMessageA
TranslateMessage
ShowWindow
ClientToScreen
GetCursorPos
ScreenToClient
GetForegroundWindow
SetFocus
GetWindowRect
SetCursorPos
GetActiveWindow
ChangeDisplaySettingsA
EnumThreadWindows
GetDesktopWindow
GetDC
ReleaseDC
GetWindowTextA
GetWindowLongA
SetWindowLongA
PostMessageA
MessageBoxA
ShowCursor
GetClassLongA
AdjustWindowRectEx
GetMonitorInfoA
SetCursor
IsWindow
GetMenuItemCount
SetClassLongA
EnumDisplaySettingsA
DeleteMenu
GetMenuItemID
GetSystemMenu
GetUserObjectInformationW
GetProcessWindowStation
MoveWindow

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetObjectA
SelectObject
DeleteObject
StretchBlt
DeleteDC
GetBitmapBits
BitBlt
CreateDCA
GetDeviceCaps
SetDeviceGammaRamp
CreateFontA
CreateSolidBrush
GetDIBits

advapi32

InitializeSecurityDescriptor
RegOpenKeyExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptAcquireContextA
CryptReleaseContext
RegQueryValueExW
RegCloseKey
SetSecurityDescriptorDacl
CryptGenRandom

shell32

ShellExecuteA
SHGetFolderPathA

ole32

CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
StringFromGUID2
CLSIDFromString

oleaut32

VariantInit
VariantClear

wintrust

WinVerifyTrust

wininet

InternetConnectA
InternetReadFile
InternetWriteFile
HttpEndRequestA
HttpQueryInfoA
HttpAddRequestHeadersA
HttpSendRequestExA
HttpOpenRequestA
InternetQueryOptionA
InternetSetOptionA
HttpSendRequestA
InternetCrackUrlA
InternetOpenA
InternetCloseHandle

xinput1_3

ord4
ord2
ord3

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

ws2_32

WSASetLastError
getsockname
getsockopt
inet_ntoa

psapi

GetProcessMemoryInfo

binkw32

_BinkWaitStopAsyncThread@4
_BinkSetMemory@8
_BinkGetRealtime@12
_BinkGetFrameBuffersInfo@8
_BinkPause@8
_BinkControlBackgroundIO@8
_BinkDoFrameAsync@12
_BinkStartAsyncThread@8
_BinkSetSoundTrack@8
_BinkOpen@8
_BinkGetError@0
_BinkDoFrameAsyncWait@8
_BinkClose@4
_BinkGetRects@8
_BinkRequestStopAsyncThread@4
_BinkRegisterFrameBuffers@8
_BinkSetIOSize@4
_BinkDoFrame@4
_BinkNextFrame@4

d3d11

D3D11CreateDeviceAndSwapChain
D3D11CreateDevice

Exports

Exports

NvOptimusEnablement

Sections

.text
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.conceal
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.interpr
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.0MB - Virtual size: 54.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5217f7e510cdca41e76c04812a5df52

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:5c:80:c6:d0:2d:d5:1e:55:ba:a6:82:10:59:9b:4aCertificate

Extended Key Usages

Key Usages

1e:f3:54:4d:97:52:c6:00:c2:cb:12:cd:da:bd:a8:f3:6b:46:92:03Signer

Headers

DLL Characteristics

File Characteristics

Imports

steam_api

winmm

wsock32

faultrep

dxgi

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wintrust

wininet

xinput1_3

wtsapi32

ws2_32

psapi

binkw32

d3d11

Exports

Exports

Sections

.text Size: 7.3MB - Virtual size: 7.3MB

.conceal Size: 75KB - Virtual size: 75KB

.interpr Size: 26KB - Virtual size: 25KB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 3.0MB - Virtual size: 54.3MB

.tls Size: 7KB - Virtual size: 6KB

.version Size: 512B - Virtual size: 4B

.rodata Size: 3KB - Virtual size: 2KB

.rsrc Size: 256KB - Virtual size: 255KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:5c:80:c6:d0:2d:d5:1e:55:ba:a6:82:10:59:9b:4a
Certificate

1e:f3:54:4d:97:52:c6:00:c2:cb:12:cd:da:bd:a8:f3:6b:46:92:03
Signer

.text
Size: 7.3MB - Virtual size: 7.3MB

.conceal
Size: 75KB - Virtual size: 75KB

.interpr
Size: 26KB - Virtual size: 25KB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 3.0MB - Virtual size: 54.3MB

.tls
Size: 7KB - Virtual size: 6KB

.version
Size: 512B - Virtual size: 4B

.rodata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 256KB - Virtual size: 255KB