zorara[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

zorara.exe
Size

269KB
MD5

f22e594482f2b9f11bbba95e9f63ed2c
SHA1

eaceb2b5d8edb265916b6ae52eb7a20147d79292
SHA256

8e8a3fc7eb16382fdf79374c01afaa52c7c3aeead5026e9802e2054cedc7f70a
SHA512

81ea955f5e48254043a9dd2d41e035c3564d70ca21b2f9e600eb10bbaafcbae7291887548d35c22a7cf57ddd4e7415b77f9d030b19dc067329f30eebcf631b39
SSDEEP

6144:dQgvmh3BifEiOD1OmJIEcW9xh92KTZl8L/0RsM7hpIUg:dtvu38OD1VIEcW91hlK0sM1pI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zorara.exe

Files

zorara.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\p1\source\repos\Ramge2\Ramge2\Ramge2\obj\Debug\zorara.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 266KB - Virtual size: 266KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ