Static task
static1
General
-
Target
zsync.exe
-
Size
92KB
-
MD5
2e9d3dc697a2e1fc5c5be1f7e04508dd
-
SHA1
0f72289874472de314aecefeb5457812f1c72481
-
SHA256
dbc39d1d4ddc8c744e7840a294f906920c532adc0dc9e69f7664a91b55b2ff77
-
SHA512
d938a7d94c869b3b67c70d016b10c6a3c79fc3e928f3471a829b925041feb192f2f4d77993cd450d8246e0a4eec94f2275fd44ffbb931e15a5f9e74624dc0d16
-
SSDEEP
1536:/9yPhoPyrELhNx4xKM87bsp9G8e5VuSYJadGo7/TjX3DvrnAvp3ITPvsXXlgpoIW:KEL+kM87QpRKuSGI/TjX3DvrnAvp3ITn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource zsync.exe
Files
-
zsync.exe.exe windows:4 windows x86 arch:x86
75aba96403230b969632fcae056d7ce4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateFileA
CreateFileW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetVolumeInformationW
InitializeCriticalSection
InterlockedCompareExchange
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
_access
_close
_fileno
_getpid
_isatty
_read
_strdup
_strnicmp
_tzset
_unlink
_write
__argv
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_atoi64
_cexit
_close
_daylight
_errno
_fdopen
_fmode
_get_osfhandle
_gmtime64
_initterm
_iob
_lock
_lseeki64
_mktime64
_onexit
_open_osfhandle
_pclose
_popen
_stat64
_stricmp
_strnicmp
_time64
_unlock
_utime64
_vsnprintf
_winmajor
abort
atoi
atol
calloc
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fread
free
fwrite
getenv
isalnum
islower
isspace
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
perror
printf
puts
rand
realloc
rename
rewind
signal
srand
sscanf
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strrchr
strstr
vfprintf
wprintf
ws2_32
WSACleanup
WSAGetLastError
WSAHtonl
WSASocketA
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
ntohs
recv
send
shutdown
Sections
.text Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE