C:\Temp\i_Tools\ZIP\ZipFold\Release.140\ZipFold.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8cfc0986b42a3d07bda14e03df3bc1ed63904b7dac13a091905e107f986619f3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8cfc0986b42a3d07bda14e03df3bc1ed63904b7dac13a091905e107f986619f3.exe
Resource
win10v2004-20240412-en
General
-
Target
8cfc0986b42a3d07bda14e03df3bc1ed63904b7dac13a091905e107f986619f3
-
Size
439KB
-
MD5
83b940a7820136eb1b7ea11067018a58
-
SHA1
3b7987936905be761c8d0f47ee89b9853c9d491b
-
SHA256
8cfc0986b42a3d07bda14e03df3bc1ed63904b7dac13a091905e107f986619f3
-
SHA512
01b940347ca588d7bd29b3db2a5009336efacdca935bbfa5c86f1d4857b3932cdbecda15c6fc35829d7a38228fe11672f9ba15ca2a2c436fa61c364636ed4fa2
-
SSDEEP
6144:bgOcT2kivHGCJ+KMpZg6Ajy6DgVs2ZlEAdChhDRm5HzO:p3fwHH+AoDc5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8cfc0986b42a3d07bda14e03df3bc1ed63904b7dac13a091905e107f986619f3
Files
-
8cfc0986b42a3d07bda14e03df3bc1ed63904b7dac13a091905e107f986619f3.exe windows:6 windows x86 arch:x86
936a2603b07545e32a87b8cd4dd8e8e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathStripToRootW
PathSkipRootW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
mfc140u
ord5583
ord1144
ord503
ord1142
ord2885
ord5886
ord13669
ord13979
ord6956
ord12586
ord11962
ord500
ord5514
ord6555
ord321
ord2396
ord8464
ord14259
ord8360
ord12921
ord8757
ord8756
ord14411
ord14417
ord8712
ord12884
ord4742
ord4664
ord4663
ord2925
ord2996
ord2990
ord5921
ord1687
ord1693
ord1692
ord1689
ord1521
ord1526
ord1525
ord1523
ord293
ord290
ord286
ord280
ord285
ord3009
ord14320
ord13251
ord12559
ord8182
ord5884
ord5109
ord5074
ord4323
ord1653
ord12784
ord5512
ord3849
ord494
ord2389
ord2378
ord2383
ord2385
ord266
ord265
ord1511
ord6751
ord12168
ord4499
ord2562
ord3696
ord4885
ord1068
ord14604
ord362
ord1391
ord890
ord2246
ord1450
ord8049
ord3075
ord2470
ord13257
ord13258
ord13964
ord974
ord1477
ord13260
ord2889
ord1003
ord1067
ord5586
ord3068
ord13253
ord13960
ord360
ord14657
ord12405
ord4616
ord12425
ord2874
ord4797
ord2205
ord8470
ord7653
ord1472
ord8386
ord12247
ord10433
ord12928
ord12865
ord4589
ord8324
ord5357
ord10379
ord2486
ord12542
ord12541
ord14589
ord7922
ord14595
ord9398
ord4152
ord5699
ord545
ord2332
ord4090
ord12947
ord7941
ord2034
ord11983
ord11982
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord995
ord6860
ord3852
ord5918
ord12239
ord8217
ord12251
ord12219
ord1111
ord4092
ord5249
ord5549
ord5760
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord2304
ord13085
ord13086
ord358
ord6489
ord898
ord6795
ord3882
ord6566
ord4815
ord1045
ord296
ord1663
ord1513
ord5840
ord2215
ord2256
ord5590
ord8177
ord4715
ord4735
ord346
ord1060
ord12348
ord14600
ord11991
ord12317
ord13110
ord13762
ord12637
ord1175
ord7493
ord11038
ord12131
ord6218
ord13752
ord2760
ord9210
ord12172
ord9040
ord11015
ord11396
ord10472
ord458
ord3403
ord3404
ord3164
ord6531
ord3305
ord3302
ord10255
ord8210
ord5390
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord3833
ord11936
ord14588
ord8965
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord14507
ord6877
ord13473
ord11717
ord13028
ord14128
ord7810
ord14131
ord8817
ord13703
ord5935
ord7820
ord14137
ord2682
ord12124
ord3941
ord3371
ord3372
ord13966
ord3265
ord2409
kernel32
GetFileAttributesW
GetLogicalDrives
GetLongPathNameW
GetVolumeInformationW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
Beep
CloseHandle
CreateMutexW
Sleep
GetCurrentProcess
CreateProcessW
GetTickCount
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LocalFree
FormatMessageW
GetDriveTypeW
LoadLibraryW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
CopyFileW
MoveFileW
MultiByteToWideChar
WideCharToMultiByte
GetACP
LCMapStringW
GetUserDefaultLCID
SetConsoleCtrlHandler
OutputDebugStringA
SetLastError
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceW
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
OutputDebugStringW
GetLastError
HeapDestroy
RaiseException
lstrlenW
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
DecodePointer
user32
TranslateMessage
SystemParametersInfoW
LoadIconW
GetDesktopWindow
IsRectEmpty
OffsetRect
SetRectEmpty
MessageBeep
MessageBoxW
GetWindowRect
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawIcon
AppendMenuW
GetSystemMenu
GetSystemMetrics
EnableWindow
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsIconic
IsWindow
SendMessageW
PeekMessageW
DispatchMessageW
wsprintfW
UnregisterClassW
InflateRect
CopyRect
FillRect
GetSysColor
gdi32
Polygon
RoundRect
GetDeviceCaps
Ellipse
advapi32
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
shell32
SHGetFolderPathW
SHFileOperationW
ShellExecuteW
DragQueryFileW
ole32
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
VariantClear
VariantInit
SysAllocString
msvcp140
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
gdiplus
GdipFillRectangleI
GdipFillRectangle
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateLineBrushI
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipFillPie
vcruntime140
wcschr
__std_type_info_destroy_list
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
memset
__std_terminate
__CxxFrameHandler3
_purecall
memmove
wcsstr
_CxxThrowException
memcpy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_recalloc
malloc
api-ms-win-crt-runtime-l1-1-0
_exit
_get_wide_winmain_command_line
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_configure_wide_argv
_seh_filter_dll
_configure_narrow_argv
_controlfp_s
terminate
_wsystem
_set_app_type
exit
_initterm_e
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_errno
_initterm
_seh_filter_exe
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
wcspbrk
iswcntrl
_wcsdup
wcsncpy_s
wcscpy_s
iswspace
iswprint
iswdigit
_wcslwr_s
isdigit
api-ms-win-crt-filesystem-l1-1-0
_wremove
_wstat64
_waccess
_wmkdir
_wrmdir
api-ms-win-crt-stdio-l1-1-0
_wsopen_s
_set_fmode
fclose
fread
__p__commode
fwrite
_wfopen_s
_close
api-ms-win-crt-convert-l1-1-0
_itow_s
wcstod
wcstol
wcstoul
_wtof
_wtoi
_i64tow_s
_wtoi64
_wcstoui64
api-ms-win-crt-environment-l1-1-0
_wdupenv_s
api-ms-win-crt-time-l1-1-0
_localtime64_s
wcsftime
_time64
api-ms-win-crt-multibyte-l1-1-0
_ismbslead
api-ms-win-crt-math-l1-1-0
_except1
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ