{������c80�`q^XQ��&�%����jf��)j2t����8xT�S�5&��9�!j���q���#�4�2({t=`h�ND�/5�rQ�q��vM\���x���e�������^������I-��U�G�_ߑ�t���X�y�o}_~����~D2�Rc�r�O߽������1�g��(?�0A���/���pc�������K����8����C�� ��wTu$+?�@�E`>2 � Ҷ?�e��,A(���+��.U�r�a>r�EX)�Ki�0R��Ӵ''��I��}Z�q�0�S�;��x��o�/�����Ϗ���e� R5@x���,j�KtA@�$z�|���ִ��%���n�\���*H���ɮ]Z^P�����#_(�����ս��I<�sLH��g�G�3V$�R5��O��oC� ��<W�c�'=-Z1�!��~X��p�$������*u�;t�#U�u��[28�+���V �XDc�?IqR�����۱e��� ho�fI��6�v�����4V�}C�����Lt�8�T&��qm+�� '�w��$��6n )IE�G��P 4N�i�WQ�N���SE��gL���� f��b�� mn��M���KeH����^�~f*��CY��c'�8��n�����#i�T*��A���O9:���x ���P-#۴O��Ļ ��8�$.����G�ۯO��2P��t�ؕ��FPg��{�U��T+�)T���������,0)K�S�~_�Wcf�R�2 L���Y�Dz)$�{��t�NK��Y��|i$�hZs(m�j�dN[�P�����ߑ!�x����p����+���{G�eFp!���ߕ��b/����0��nkc�8Ө�ߖ�kt��`�Ć�$,��<���&�4M+�h$h���݈R:�2pV��v{V��s~ _��O9�L���\�������n��v�C�����BS*/Ә�<�i��X. wJ���Y�7�:�0��>Ls�4�<��N�:��\�����x��Sg$`w���,]&�lkͻ��;M��.~Eӓ(���r3����L�c(�猾��i̎� t�̘��1�0.���\KQ�Y����@��3���� >REn���:# LM�>���e�"������gl�:a%B�M3��2�D��v����`(8����`�*i�GYu΄������-�`қgZ`D=K�컬4� ���Q�؎4~X�2��T�y�xV]�T0+�0�#��}��8�wL�^b�t���O+���<]�"�ѧ��-�|5 ���>X#����!@�on^�P�b�s���m�.zH>���zo��\ e��4����45Ъ�Ő���s���O�ͧ�]�jās��$�N��y���]"X�e2W_܅��~�G'¿fS�����/_����#)�S���hN�@�"#�&��S��b�\^5�������#3{8Z���>���kNsg3���ܐw�i?iF܉z%ͷ��M#����9�^�cAbr9^$��{����ܠ�C4\��sC-'PP05x�){*lK�uV��0��0��kS�F��\�a���Z��� I�j�k��t�RH�;0?�g@��*�*U�?�:5p��$�q��]?Et��L?af�G�K-���o�őغ��!����v+��/+���蟚��;�Ŝ��;2b�i�g���.����`�S���������9R��$j(Xx�ru��>�pN�L�/���Q�Kv\��w�o���`<�w� .�7@.��}ڽQ�4�:#�sĻ6�3��k����EC�f���L��ZR���}3 �{a��A� TX�Zv���dJ1c�k#��d��dZ �1]�ΪDϸ݂2�]��ˊ�%@�.3��)�y�d͆ķ��=�+�9%,��"k��7��Mٺƒ�`Ba�:k��:� ��Vee�C�j�a����'k/��i-�.��~��~�:�������.�5��^�ӵ��Cl�4������a�s�K�"⧼��k�۱�$Z���F�Y��D��D�5B'��,����Bn�2G(Ŗ�c�s��'��(�߬Z=&�m^��E�C',m`,rq��U=|�#w$���迄���J���8K���O�|^�� ԮMw ﻜ�%��c�.�`(�&,�E���E�#���%����m]4�]��L��#��i���_�r�!&���14��l0YN��Q�c�mRIj����H'C�A�фC����V�gO�_ ��)_�v��v���@U;��?@m<t�N6Z�!ʚ"� &ڞJS�>�@��VS3�a�=tT�qy�c̯����ǖ�QAY�e�N���������\I� �r���(�������nrvC�%I�v�O^���&�]�0�,xsJl��c��NI8 ?��{L(�>� �����>?GU((V��h��ʻq�l ��^>�u*S����M�.s�Б(�U��4����t�B�$��[���Ͻ�|`P ¿�=�4��[�A�� �%�^Ϛ7��Q,�i�2�ٜh1�|����O)r�}����>�p{�bc��+�<Ι;��9�p"ٲB�����P��v��|,N���LW�"�~��dUD��zx�na)��y���E#��`G��^t)VsD^��Q&L���� ��"ٺ+M��w���;��o]m���&�^$�j�����G�Z1�������������F֕��teZ!�E�=yl��k�s�+�|�P ����!�-�5:���Uc��e��R��7�:*���Ԛc��|����)�� @����S��QGJ�Q�DFW"3���h�(��Z���)�VIh;,l��']'GdW~T�y�,��|f��̎��6\�w�ja� 1& aUЦ�Yd�.�)��8�����ɠ���Ww���+�O���b�L�:Szjn<�;_z0����;���(� 3�E�kT�-���Q�A7 �2�� %MQ�)����1�Ҫ�QysO�Β��(?!�����9Ҭ�}n��ˏU1�qx@��zG�=�a^X��?
Static task
static1
Behavioral task
behavioral1
Sample
Zoom.exe
Resource
win7-20240508-en
General
-
Target
Zoom.exe
-
Size
9.0MB
-
MD5
93aac1e7498ef6fd80cb65c0e8c03f91
-
SHA1
514256412c765be426b18bf80d83135d2ec072e4
-
SHA256
8b715378879d882102b68d5292b7b0728fcd4c5fe1d594ba50e2ec83ec021230
-
SHA512
7788a66185a76be6b4eba878067745c3270ecabb302a5943f4eb963f26275715f91f6448becf5efd78411c4f1a08fd20a54da2933eb63d02b46cdbdc37fac919
-
SSDEEP
196608:MQZ5DnnjwWLu2kkRO+9KtOXTfBOCZOTpJ6axzJhJyQ2Bi+:tZ5DnjzLuk9M2OlrzJhJhh+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Zoom.exe
Files
-
Zoom.exe.exe windows:6 windows x64 arch:x64
177039069d522e485bf6e42fa5134e0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FormatMessageA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
RtlVirtualUnwind
urlmon
URLDownloadToFileA
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 431KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.(jG Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.GO< Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!Qw Size: 8.9MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ