zeta-spoofer_se[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

zeta-spoofer_se.exe
Size

1.9MB
MD5

b54efcde665501540466005b4e8f1387
SHA1

ec25b2425898ed76a24e52a84793ac1529b9cef9
SHA256

05d0070b1a0304acd74491bddcec9ad8bb455a566217c5afef71b20c947198f4
SHA512

117b3f6fe3f6120429e81b053f78680aee5305a2b535fd46fd2f52f35914d38a24511c59e3f1b25f2a3e3cf59d32ea8ca297042e744ae810dd191e8089af4c30
SSDEEP

49152:cGCOes5D7R2tIod7EhfgIW0uou0Cf8Ba+z/qaSm6V:cHs5DLDWVkcAqajK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zeta-spoofer_se.exe

Files

zeta-spoofer_se.exe
.exe windows:6 windows x64 arch:x64

636cb3b3bb52e8737f96128a791074ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\xxalexxxddd\Documents\GitHub\zeta-spoofer\build\zeta-spoofer.pdb

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW

ole32

CoCreateGuid

kernel32

CloseHandle
CreateEventW
CreateFileA
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetLocaleInfoEx
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetThreadLocale
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryExA
LocalFree
QueryPerformanceCounter
ReadFile
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleTitleA
SetEvent
SetFilePointer
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObjectEx
WriteFile

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0facet@locale@std@@IEAA@_K@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1facet@locale@std@@MEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?uncaught_exceptions@std@@YAHXZ

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
__std_terminate
memcpy
memmove
memset

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
_set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dsign
_dtest
_fdsign
_fdtest
_ldsign
_ldtest

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_get_initial_narrow_environment
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
terminate

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
calloc
free
malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-string-l1-1-0

strlen
strncpy
toupper
wcslen

api-ms-win-crt-environment-l1-1-0

getenv

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

user32

GetWindow

shell32

SHGetFolderPathW

Sections

.text
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zeta
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zeta
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

636cb3b3bb52e8737f96128a791074ad

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ole32

kernel32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

iphlpapi

msvcrt

psapi

user32

shell32

Sections

.text Size: 412KB - Virtual size: 412KB

.zeta Size: 1.5MB - Virtual size: 1.5MB

.idata Size: 5KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 4KB

.zeta Size: 4KB - Virtual size: 4KB

.text
Size: 412KB - Virtual size: 412KB

.zeta
Size: 1.5MB - Virtual size: 1.5MB

.idata
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 4KB

.zeta
Size: 4KB - Virtual size: 4KB