zig[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

zig.exe
Size

148.8MB
MD5

d3b675d9dbe08f2994b9e01be8f4bc8d
SHA1

8317e3d2e62839f99d9bb117eaea5913ca37b761
SHA256

d3ecb4c98f6639e57ddca147f4008437ee07558c969b1c3dc62697ffb06ac94e
SHA512

bf7947500bec21bfe9655dd08f274114784e8a314091bba458d6667248e70fdfd0b63be95ab3ee5da39a4b01148d2e4cb38a42960f484f2992d18ae1c989168e
SSDEEP

786432:7Ixf4iy9nUjOwC1am1+IyuTHZFHORaRnVhzkIIGCsYOmw6uEJheu8DvODn:0d4luOJ1am1+Iyu7ZNVSIqOmw0he

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zig.exe

Files

zig.exe
.exe windows:6 windows x64 arch:x64

d3933970aed78181cf2ce63985e2d849

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ucrtbase

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__acrt_iob_func
__daylight
__intrinsic_setjmpex
__p___argc
__p___argv
__p___wargv
__p__commode
__p__environ
__p__fmode
__p__wenviron
__pctype_func
__setusermatherr
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vswprintf
__sys_nerr
__timezone
__tzname
_aligned_free
_aligned_malloc
_beginthreadex
_cexit
_close
_configthreadlocale
_configure_narrow_argv
_configure_wide_argv
_create_locale
_crt_at_quick_exit
_crt_atexit
_errno
_exit
_fileno
_free_locale
_fseeki64
_ftelli64
_get_osfhandle
_gmtime64
_heapwalk
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_isctype
_isctype_l
_iswalpha_l
_iswcntrl_l
_iswdigit_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_localtime64
_localtime64_s
_lseeki64
_mbtowc_l
_open_osfhandle
_read
_register_thread_local_exe_atexit_callback
_set_app_type
_set_error_mode
_set_invalid_parameter_handler
_set_new_mode
_setmode
_strcoll_l
_strdup
_strftime_l
_strtod_l
_strtoi64_l
_strtoui64_l
_strxfrm_l
_time64
_tolower_l
_toupper_l
_towlower_l
_towupper_l
_tzset
_wcscoll_l
_wcsxfrm_l
_write
abort
acos
asctime
asin
atan
atan2
atoi
calloc
cosh
exit
fclose
fflush
fopen
fputc
fread
free
fwrite
getenv
isalnum
isalpha
islower
isupper
iswctype
isxdigit
localeconv
longjmp
malloc
mbrlen
mbrtowc
mbsrtowcs
memchr
modf
pow
putchar
puts
qsort
rand
rand_s
realloc
rint
setlocale
signal
sinh
srand
strchr
strcmp
strerror
strerror_s
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strstr
strtod
strtof
strtok
strtol
strtoll
strtoul
strtoull
tanh
tolower
toupper
wcrtomb
wcrtomb_s
wcslen
wcstod
wcstol
wcstoul

advapi32

AdjustTokenPrivileges
CryptAcquireContextA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegGetValueW
RegLoadAppKeyW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

kernel32

AcquireSRWLockExclusive
AddVectoredExceptionHandler
AssignProcessToJobObject
CancelIo
CloseHandle
CompareStringOrdinal
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateHardLinkW
CreateJobObjectW
CreateNamedPipeW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsW
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetLargePageMinimum
GetLastError
GetLogicalProcessorInformationEx
GetModuleFileNameW
GetModuleHandleW
GetNativeSystemInfo
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessGroupAffinity
GetProcessHeap
GetProcessTimes
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetThreadId
GetVolumePathNameW
HeapAlloc
HeapFree
InitOnceExecuteOnce
InitializeCriticalSection
K32EnumProcessModulesEx
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSRWLockExclusive
RemoveVectoredExceptionHandler
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
SearchPathW
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetCurrentDirectoryW
SetErrorMode
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetInformationJobObject
SetLastError
SetProcessAffinityMask
SetThreadGroupAffinity
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
UnlockFileEx
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

ntdll

NtClose
NtCreateFile
NtDeviceIoControlFile
NtFsControlFile
NtLockFile
NtProtectVirtualMemory
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryObject
NtQueryVolumeInformationFile
NtReadVirtualMemory
NtSetInformationFile
NtUnlockFile
NtWriteVirtualMemory
RtlEqualUnicodeString
RtlGetFullPathName_U
RtlGetVersion
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlUpcaseUnicodeChar
RtlWaitOnAddress
RtlWakeAddressAll

ws2_32

WSAGetLastError
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getsockname
ioctlsocket
listen
setsockopt

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

_GCC_specific_handler
_Unwind_DeleteException
_Unwind_ForcedUnwind
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_RaiseException
_Unwind_Resume
_Unwind_SetGR
_Unwind_SetIP
unw_get_fpreg
unw_get_proc_info
unw_get_proc_name
unw_get_reg
unw_getcontext
unw_init_local
unw_is_fpreg
unw_is_signal_frame
unw_local_addr_space
unw_regname
unw_resume
unw_set_fpreg
unw_set_reg
unw_step

Sections

.text
Size: 91.9MB - Virtual size: 91.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53.8MB - Virtual size: 53.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 816KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 679KB - Virtual size: 678KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3933970aed78181cf2ce63985e2d849

Headers

DLL Characteristics

File Characteristics

Imports

ucrtbase

advapi32

kernel32

ntdll

ws2_32

crypt32

shell32

ole32

version

Exports

Exports

Sections

.text Size: 91.9MB - Virtual size: 91.9MB

.rdata Size: 53.8MB - Virtual size: 53.8MB

.data Size: 816KB - Virtual size: 1.3MB

.pdata Size: 1.7MB - Virtual size: 1.7MB

.rodata Size: 1KB - Virtual size: 1KB

.tls Size: 9KB - Virtual size: 9KB

.reloc Size: 679KB - Virtual size: 678KB

.text
Size: 91.9MB - Virtual size: 91.9MB

.rdata
Size: 53.8MB - Virtual size: 53.8MB

.data
Size: 816KB - Virtual size: 1.3MB

.pdata
Size: 1.7MB - Virtual size: 1.7MB

.rodata
Size: 1KB - Virtual size: 1KB

.tls
Size: 9KB - Virtual size: 9KB

.reloc
Size: 679KB - Virtual size: 678KB