zloader 2_1[.]0[.]4[.]0[.]vir

General

Target
zloader 2_1.0.4.0.vir
Size 300KB
Sample240221-wld89scg8t
SHA256 28e752ad86f8f53773bb2e147c1366f5e82b5a8fd2cd80af065decea2e11f694
MD5 81baef090e5c513c1598c348d072ce96
SHA1 d5795f51ec36ee0dabd073f694692e2aa507a04a
SHA512 699b797857f33e6937b2655418509d63d87fe18bd790d94c31a611d45b322aa2923d8be1c1df3e8c66ea7e78b93b693f7f366a38eb6b6ea6a4016a1364665520
SSDEEP 6144:ODRRTytCG2AD+dMLtfbPM+jf5nde+zDbf+qk7w:zCG2AKdMDPMMff+qkk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zloader 2_1.0.4.0.vir

File Explorer

zloader 2_1.0.4.0.vir

.dll 300KB

zloader 2_1.0.4.0.vir

IMPHASH da6bf84fff1ec1dc82fb3a0741b23f19
SHA256 28e752ad86f8f53773bb2e147c1366f5e82b5a8fd2cd80af065decea2e11f694
MD5 81baef090e5c513c1598c348d072ce96
SHA1 d5795f51ec36ee0dabd073f694692e2aa507a04a
SHA512 699b797857f33e6937b2655418509d63d87fe18bd790d94c31a611d45b322aa2923d8be1c1df3e8c66ea7e78b93b693f7f366a38eb6b6ea6a4016a1364665520
SSDEEP 6144:ODRRTytCG2AD+dMLtfbPM+jf5nde+zDbf+qk7w:zCG2AKdMDPMMff+qkk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

86257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\half\doctor\never\Care\order\Operate\gentle\Smallself.pdb

kernel32

CreateSemaphoreA SetSystemPowerState RemoveDirectoryA LocalAlloc VirtualProtect DeleteCriticalSection CloseHandle LocalFree CreateThread FormatMessageA HeapSize GetLocaleInfoA GetSystemTimeAsFileTime GetProcessHeap HeapAlloc SetEndOfFile GetCPInfo GetFileSize CreateFileA SetFileAttributesA GetLastError GetFileAttributesA GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA RtlUnwind SetFilePointer SetStdHandle GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId WriteFile GetConsoleCP GetConsoleMode InitializeCriticalSection MultiByteToWideChar ReadFile VirtualAlloc HeapReAlloc GetACP GetOEMCP FlushFileBuffers LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetWindowRect GetClientRect GetForegroundWindow CreateDialogIndirectParamA CreatePopupMenu GetSysColorBrush DispatchMessageA DialogBoxIndirectParamA

advapi32

RegCreateKeyA RegCloseKey RegQueryValueExA

cabinet

ord10 ord14 ord12

Resubmissions

Sharing