Static task
static1
Behavioral task
behavioral1
Sample
ZIM Third PartyPlace ents.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ZIM Third PartyPlace ents.exe
Resource
win10v2004-20231127-en
General
-
Target
ZIM Third PartyPlace ents.7z
-
Size
653KB
-
MD5
1cfdc93a256d2fce20e5f45ff51c7fb3
-
SHA1
486a6a6d469a77a4c2e54a2726c27d7ed87e00b5
-
SHA256
a1c015cd5b54daaa34d28df0ed8bb0ed2743994c3b3449a2cebc52f829c2b6d6
-
SHA512
85d208ff3342361d350647928f76095b6c2657f55b9a5bb17e76ee6b02a3af54141017a0ca5fcd6eb98fff66a9a12709ef2a0a2ca36fbb14d0947535a4b63db3
-
SSDEEP
12288:nP+/BFw09c31PLk1bG13UW1o0cZBch1ZP9eEgLMg7b9pYe0bJpfkYg0v1p6v//x:P+z9clPLI+3UWxcwh11Eiy9aXbJXgMmh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ZIM Third PartyPlace ents.exe
Files
-
ZIM Third PartyPlace ents.7z.7z
-
ZIM Third PartyPlace ents.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 670KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ