zcb3[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

zcb3.exe
Size

10.7MB
MD5

036c7ae24daeb9fd6ae8831fec546ac9
SHA1

8b1109f84374043f2e5e18f06e6f63678dcded18
SHA256

9ba8a29827bdf718aa2373597916ae0620df5d41a6bf6858a5fb89ad51280a2c
SHA512

6d2cf030a519187572b393ed11e4ebc9e23a96cf5df5648c30d7361e349f27b4ff60623c4d2e9adcffa98e88cb6acf19e2dbf34c9ea84d9bc1bc5fe7431d9cd5
SSDEEP

98304:BJGgvorbMpJMbbOBopCPS/0ktW+RiJsPYg6qYrz1VOQbniZtf++GmsB/MN:Gm0IPqT9gVOufi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zcb3.exe

Files

zcb3.exe
.exe windows:6 windows x64 arch:x64

f1e12271e1d9631422e3b8f681bb2e04

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

SetConsoleMode
GetConsoleMode
GetStdHandle
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
GetProcAddress
SwitchToThread
SetUnhandledExceptionFilter
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeConsole
SetFilePointerEx
ReleaseSRWLockExclusive
GetConsoleScreenBufferInfo
AcquireSRWLockShared
GetExitCodeProcess
GetLastError
QueryPerformanceCounter
GlobalLock
GlobalSize
GlobalUnlock
AcquireSRWLockExclusive
HeapReAlloc
MultiByteToWideChar
GlobalAlloc
WaitForSingleObject
GlobalFree
WakeAllConditionVariable
FindClose
IsProcessorFeaturePresent
CloseHandle
SetConsoleTextAttribute
HeapFree
GetCurrentThreadId
ReleaseSRWLockShared
GetFileType
CopyFileExW
MoveFileExW
TryAcquireSRWLockExclusive
FreeLibrary
SetThreadErrorMode
LoadLibraryExW
LoadLibraryW
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
WriteFileEx
SleepEx
GetSystemInfo
Sleep
GetModuleHandleA
SleepConditionVariableSRW
WakeConditionVariable
ReadFileEx
CreateThread
CreateNamedPipeW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetModuleFileNameW
GetCommandLineW
InitializeProcThreadAttributeList
DeleteFileW
LocalFree
CreateProcessA
ExitProcess
CreateFileW
GetCurrentProcess
DuplicateHandle
SetLastError
GetFinalPathNameByHandleW
GetCurrentThread
GetFileAttributesW
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetTempPathW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindNextFileW
CreateDirectoryW
FindFirstFileW
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
CompareStringOrdinal
FreeEnvironmentStringsW
SetHandleInformation
GetEnvironmentStringsW
TerminateProcess

ntdll

NtCreateFile
RtlNtStatusToDosError
NtReadFile
NtWriteFile

user32

ShowWindow
SetWindowLongW
GetSystemMenu
EnableMenuItem
GetWindowLongW
AdjustWindowRectEx
GetClipCursor
ClipCursor
ShowCursor
DestroyIcon
GetClassNameW
RemovePropW
GetClassInfoExW
ToUnicodeEx
GetKeyboardLayout
SetWindowTextW
SetCursorPos
GetWindowTextW
MapVirtualKeyExW
GetForegroundWindow
RegisterWindowMessageA
OpenClipboard
SystemParametersInfoA
GetWindowTextLengthW
GetWindowRect
SetClipboardData
EmptyClipboard
CreateIcon
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
ValidateRect
GetRawInputData
DispatchMessageW
TranslateMessage
KillTimer
SetTimer
GetMessageW
RegisterRawInputDevices
CallWindowProcW
GetPropW
SetWindowLongPtrW
EnumDisplayMonitors
GetCursorPos
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
ReleaseCapture
SetCapture
MonitorFromRect
SetCursor
LoadCursorW
DestroyWindow
GetMenu
SetPropW
RedrawWindow
SetWindowPlacement
GetWindowPlacement
ChangeDisplaySettingsExW
GetMonitorInfoW
IsProcessDPIAware
GetKeyboardState
GetKeyState
GetAsyncKeyState
InvalidateRgn
SetWindowPos
ClientToScreen
FlashWindowEx
RegisterTouchWindow
SetWindowDisplayAffinity
PeekMessageW
DefWindowProcW
SetForegroundWindow
SendInput
MapVirtualKeyW
MonitorFromWindow
CreateWindowExW
RegisterClassExW
MonitorFromPoint
GetDC
GetWindowLongPtrW
CreateIconFromResourceEx
IsIconic
GetClientRect
SendMessageW
GetSystemMetrics
GetActiveWindow
ReleaseDC
PostMessageW

oleaut32

SetErrorInfo
SafeArrayPutElement
SysFreeString
SafeArrayCreateVector
SysAllocStringLen
SysStringLen
GetErrorInfo

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent
UiaLookupId
UiaRaiseAutomationEvent
UiaGetReservedNotSupportedValue
UiaReturnRawElementProvider
UiaHostProviderFromHwnd

opengl32

wglCreateContext
wglShareLists
wglGetProcAddress
wglGetCurrentContext
wglMakeCurrent
wglDeleteContext
wglGetCurrentDC

gdi32

DescribePixelFormat
CreateRectRgn
SetPixelFormat
DeleteObject
GetDeviceCaps
ChoosePixelFormat
SwapBuffers

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmAssociateContextEx
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmGetCompositionStringW

ole32

OleInitialize
CoInitializeEx
CoUninitialize
RegisterDragDrop
CoTaskMemFree
RevokeDragDrop
CoCreateInstance

shlwapi

AssocQueryStringW

shell32

CommandLineToArgvW
DragFinish
DragQueryFileW
SHCreateItemFromParsingName

ws2_32

setsockopt
select
connect
ioctlsocket
freeaddrinfo
getaddrinfo
WSAGetLastError
WSAStartup
WSACleanup
WSASocketW
closesocket
send
WSADuplicateSocketW
getsockname
getpeername
WSASend
WSARecv
recv
getsockopt

uxtheme

SetWindowTheme

vcruntime140

__current_exception_context
memcmp
__current_exception
__CxxFrameHandler3
memcpy
memset
__C_specific_handler
memmove
_CxxThrowException

api-ms-win-crt-math-l1-1-0

fmodf
floorf
acos
roundf
ceilf
ceil
cosh
sinf
tan
sin
atan
trunc
_hypot
sinh
log2
log10
_hypotf
powf
atan2f
truncf
fmod
pow
log
expf
round
asin
cos
acosf
log1p
cosf
cbrtf
floor
exp2f
tanh
exp2
__setusermatherr

api-ms-win-crt-string-l1-1-0

strlen
wcslen

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-runtime-l1-1-0

_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_register_onexit_function
_initialize_onexit_table
terminate
_crt_atexit
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 586KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1e12271e1d9631422e3b8f681bb2e04

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

kernel32

ntdll

user32

oleaut32

uiautomationcore

opengl32

gdi32

dwmapi

imm32

ole32

shlwapi

shell32

ws2_32

uxtheme

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 7.0MB - Virtual size: 7.0MB

.rdata Size: 3.5MB - Virtual size: 3.5MB

.data Size: 4KB - Virtual size: 586KB

.pdata Size: 200KB - Virtual size: 200KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 7.0MB - Virtual size: 7.0MB

.rdata
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 4KB - Virtual size: 586KB

.pdata
Size: 200KB - Virtual size: 200KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 31KB - Virtual size: 30KB