Static task
static1
Behavioral task
behavioral1
Sample
zip.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
zip.exe
Resource
win10v2004-20240412-en
General
-
Target
zip.exe
-
Size
132KB
-
MD5
83af340778e7c353b9a2d2a788c3a13a
-
SHA1
55c5a72010291fca2275ccfb5b497dd0bac11a60
-
SHA256
e9929598c98359773b7c51e3c4461d0f99b1703790ff775aee3c63a9a9a74ca8
-
SHA512
fcc810d84bfe8876123757b5e7bbbb571d7fbf3b3068b81215bdecfd0742ac94edeef5589277a67c40693d1182676604bc0e2f2610421ac138c59750e1cfed86
-
SSDEEP
3072:8yiIL2aUStYI4kOojhmlDUaKhVV4dD+mO3teRl:k2bukOkhK4aKhVV/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource zip.exe
Files
-
zip.exe.exe windows:4 windows x86 arch:x86
1665839200a65d025db1cbab5f8050be
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetSecurityDescriptorLength
GetKernelObjectSecurity
kernel32
GetVolumeInformationA
GetFileAttributesA
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
CloseHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetVersion
GetFileType
GetFileTime
ReadFile
SetConsoleMode
GetConsoleMode
FindNextFileA
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
InterlockedExchange
CreateMutexA
lstrcpynA
GetDriveTypeA
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
lstrlenA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
MultiByteToWideChar
MoveFileA
SetStdHandle
HeapReAlloc
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetFilePointer
SetHandleCount
GetStdHandle
GetStartupInfoA
WriteFile
FlushFileBuffers
WideCharToMultiByte
UnhandledExceptionFilter
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetTimeZoneInformation
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSize
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
VirtualProtect
GetSystemInfo
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
RtlUnwind
LCMapStringA
LCMapStringW
GetLocaleInfoW
DeleteFileA
SetFileAttributesA
GetFileInformationByHandle
PeekNamedPipe
RemoveDirectoryA
SetEnvironmentVariableW
GetCurrentDirectoryA
GetExitCodeProcess
CreateProcessA
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE