zeta-spoofer[.]vmp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

zeta-spoofer.vmp.exe
Size

14.8MB
MD5

6dfb8d82cdaa3254609ce4abcab5685e
SHA1

4290e706cbc642da80d6de314df09c4b419aabe0
SHA256

8bd7f9915d1743a20a33ed40cba207da96bd18d099605ecee73661ee29a415c5
SHA512

2f6ef5bdeff49b663f2afb83ca8e068cb184e199914bb6de257eff69b3f11bed7c00cab7b8707baa0fb6c86a979e23e29b83048c907a6fef774e81a4fb2fc04c
SSDEEP

393216:7ZOC4HoFZkojQEvec5eXGOVp+7yRkzdy3DLYu:eIF+ojQEv35NOrrsozL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zeta-spoofer.vmp.exe

Files

zeta-spoofer.vmp.exe
.exe windows:6 windows x64 arch:x64

997e0f259674040a8873ef47cbca1b94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetConsoleTitleA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

RegGetValueW

ole32

CoCreateGuid

msvcp140d

?width@ios_base@std@@QEAA_J_J@Z

vcruntime140d

memmove

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

free

Sections

.text
Size: - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.87hzeta
Size: - Virtual size: 9.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.N-[zeta
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.f{9zeta
Size: 14.8MB - Virtual size: 14.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

997e0f259674040a8873ef47cbca1b94

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

Sections

.text Size: - Virtual size: 399KB

.rdata Size: - Virtual size: 214KB

.data Size: - Virtual size: 3KB

.pdata Size: - Virtual size: 23KB

.idata Size: - Virtual size: 7KB

.00cfg Size: - Virtual size: 373B

.87hzeta Size: - Virtual size: 9.4MB

.N-[zeta Size: 3KB - Virtual size: 2KB

.f{9zeta Size: 14.8MB - Virtual size: 14.8MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 399KB

.rdata
Size: - Virtual size: 214KB

.data
Size: - Virtual size: 3KB

.pdata
Size: - Virtual size: 23KB

.idata
Size: - Virtual size: 7KB

.00cfg
Size: - Virtual size: 373B

.87hzeta
Size: - Virtual size: 9.4MB

.N-[zeta
Size: 3KB - Virtual size: 2KB

.f{9zeta
Size: 14.8MB - Virtual size: 14.8MB

.rsrc
Size: 512B - Virtual size: 480B