Static task
static1
Behavioral task
behavioral1
Sample
ZtAInstaller.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ZtAInstaller.exe
Resource
win10v2004-20240704-en
General
-
Target
ZtAInstaller.exe
-
Size
348KB
-
MD5
770799087974ad61de3d764b0d830d1c
-
SHA1
e6dac5ff0a2527b29408bb05a83787e7f300e91a
-
SHA256
31dda4b65548fd44faf5c08a3c024696dd14e09d711950d0797d69c478edcc5b
-
SHA512
4edbd8195e5b08c9a1c6cd8df12959ff354183f39f519b61b1c00e7a714f7b31c2f8c8ad14c0c325a2ba5d63df8e2cdf1f181304059da2632ae5fa4a8f584c4d
-
SSDEEP
6144:O+r+rdNPww4+AP7Jf/qPngK34irJ/H9zxW7SrcBQgwl25QronJnIiFnLANm6dAoV:OY+rLD4LP7JfqgKTBgu2qUdJLALh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ZtAInstaller.exe
Files
-
ZtAInstaller.exe.exe windows:4 windows x86 arch:x86
Password: Test@12345
5445afd9a96685be3bc81cb275be9670
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
comctl32
ord17
user32
DestroyWindow
shell32
ShellExecuteExA
oleaut32
VariantClear
Sections
.rdata Size: 54KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE