Zebra Obfuscator[.]exe | Triage

Resubmissions

22-05-2024 19:57

240522-ypkassee44 3

Sharing

General

Target

Zebra Obfuscator.exe
Size

174KB
MD5

54bf50927e0af8a664c53e98bb494697
SHA1

4470613e048ce1ee412166ff2536d0964563e9a6
SHA256

380b8233ff261f67156ed127d938aff04cb279ead6cfe6a76702d9ea3701660f
SHA512

bca2432879b2b1c892142ac4bb1297e995b86ba03776c72122805cc953f4de0bd22ea9f0c1ff36fdc5609de889f4c9d928a6aa9a1c6cbf9d91ac2fc004a11de5
SSDEEP

3072:VDlOIOA4QfuzHoNlbn2/z29tJqDumuek29tJqDumueI:VRnOAzfuM2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Zebra Obfuscator.exe

Files

Zebra Obfuscator.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

Gr6K1
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Gr6K1
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

X5481A34
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ