I� �`ix9?��٤����v�� �|w���qW �v��%v6ZE�.�}����P�.�Y ��`���/�M��)P���}��+V��V��F( �����J��&�`�m�b�Eu?*�y��N�]�ّ-��П�ȉ��H�=�dL�w��]+��Ȟ���U~L��`�u��h'w7$������w��ޏ����W`!G��]��l��4��˹D�e5xo����58 ������8��6[��#k�t�:�pђ�+&� �r���~�d��j�����䩾]�[��6S��!�G6�]� �9'���JQ�q5 �f�t��GK���S�~�-2���(�����vٛf|�� T�����9�n�d(LZ�7�c.��<�`��XXiHIυ��h�{���~��j��>�-Bw���#*�Ý�[0��`J�&ޅz�φ�A���艩�ݽ�|�hؠ���C[G�`���>�#��xZ�B�;ˢ���d��z莼 >]o���j��1����8�|vU�,�Z �o��@v�-��'����ځ�}�(��x`��Ca"Ӏ\��%P����+��䧦?MPK7|�p������⇨���6�1U��XV�N��jX|��&��}�5�mB��Y{��"��h��r�����'��������$r{ ���m>����:�%=C�D��gR'�gS����n�fQ���ĝ��s0ԘE�Xuk�k��]7A���px��@CM�� Rx-�Qxƶ~3��7(�|�LE�_���U�4�ϣQ�b f�P'�M�j�{é�cI���F)����&=\�I����&��Z�?����cA��U��W4�� -������ W�K�A��k����Lb�j�O���<TOZ�Z���o�U�,�{qG��������q�&q�q�l�B��np�7��B>i�P����S�[a�_%���#�~��]����D�T�ª�Bу2�M__?tI�S��A8�7/����[I�� ~�P;Iu���̰*��ľ�8/LI�1&�J�+@���͝�;o$�SH�46|p56l)��%|�!dl�4�{�[��)������ԁc=�u��B-D��WK�H��F�-���6�����R�c�'*�wV��t�j����~�����������cإ����y���@.2M5�^U4>�2U�L�ތP CKN{sm��P4U+rx�$� bj��J*FfFB���,y���5N�(5�z\�[�Ʉ�۩ꗶEm�b��黋1�u��!@�&a�� �L�& n\j��1xt�]sc�V�aHh���]*u m��*6���ͨ%|]- �W>ع��R�e�����%��v�w��Gm�@�h)�G��V%D|=�����W�,�r+��LUm��&J����r3c*`�v�8�.z��`}t�Y����a5���O�?�rV��e�O�Z�1 �Ι�ԓ� J�̲#@�ߙt�%I`i�ċe��ܭ��oU�0�2��V9O �7mI ���U�Te�fI+�,�5�h�������@�(�`3�u88T^�Y`w���Psm�� Wh��2��jW�[�)I�M�����7��^I7Z�� S�^A��XX�]B!��j�D��cm��9!tK�K٩@U��G��Ez̩=@N���=P�������t7D�]NiHD�[������S����g2]]/��)�-�K=���0�[3�W��H8���VV,�qQ� Իk�1������r��6��y����Kw����!�Gy��z�-~6 ����u���{�����'��f1+C�������*�B|H���-��Z�B饶�)��u�A{�>4O2)(Zӝ�U^+ŏ2��k�NOǡ�k�.�qz0X���ϓ��#���Chn$���5��f][d�_�5n�l���yE3����u��rW�"HgK�p.�#Q8��t��� �U�b�pd��"�H���q=�}`�-�D�5V|�(�LKͰJρIF��{��N:��n%n5���;\���3%x��+̨wFк��F�Ǣ��å�W^A���7�n�� ޣ��R��G���ʢP��?Lh���;��Ӗ1yԌA��tb�^��P�қ?���h?��Vs�A�_- �ǽoX~�:xx��6����Wb�W��;����~U���.Б��H]��)��ko��ڍ}Y��n��I�S�d9j�VK1�D(?���0�[䙰<�7�"U��6}㇌`�E����9yR�-��иf"ه����^T�^zŃVhy�2Zɛ��AT���hPlk�����4��@�F� JUn�ѵ$R!��g֦1�8��M!��+��|�� #��ޱ��8x��^��%^�?��D� -[q]b��cOō����Ml�-��"�B��0!���["�o�� ��ϡ�dn��l=�l;���f��Q�4����ELSj4k��K��z:�~lg�����ц2�}��I�*GIPM��P7�� Ư��)^��;n1@�ĕ;��N�$'Հ�{mdi� �� |�TjN@�Gқ��!���T���z�I-��Ī���(����nK&��0?�p����� v�*�8���E�N�N���N�6T�G������al��<=���1W<2m�i��bl�֦E4���Y�AҮ5��en%|Ir���7-%���Rܶf`���8�����T�������� y<�h ^Ǟ�a��Mx�/�>�*G�F���6Ʒ$� �t��(M�zod�C�F�3�+�}���+��)��ϴ1u����3�抓����l�.��T����Y�������8�u�8.�X���A%��I�[(�����V� �,�&Du������m<�"9)���nq��iI ���B�_�c�[�<���y�����䐗�?���q(�n�fm�#��[�TO�?���k�˨��!�����a���G��^�F����X-):y"4z���m��Ժ�l�R���lLB�C㾍�6�(}�і~%���UjB���2��A���(>�E��i�-�ҋ��ͼќ[�؞&o�� �J�C!�����?�Q|���R�����ȹgr��:�m��a*��½��0��� �[�=�C��Zڌ�RX�����#=��)R����XP�F��$��F��-uv�$����h�>H��,��B.��y��s)�<Z{RoY˴�$\)�a��(�2k&�VKݽ���?~��5.�@����mCb�eԃ�\���z�\� j)���-��.��0U��G�҃��C ��a{�����k ����{�@��L�C��4�p��b������2���ᗹ��O$��l#�YlfǼp���u��y���oi�:��32!I{�C�������F��$�[#F���!�$q�����j]�R����|[)C��)�o�g�sm��:x�pp�2��'�I+�`s��B 'tjQ> iNu=K�E���(�X�l��"�̘�%lxQ��8 ��qx���|皤м��U�P,�8�˕�A��1߹�b.���7�%��z�<��dm{�o�T��6<���r�����A�����(��xs�D~�B]�nj���x�\�H�`(��|-��f��6Q_�!�z�(�d�_�fi���Ul>%F�z�����?�=$���4�m���ʗ����T�M�"S�`AE$��X�ַQ���Y����Qd�T
Static task
static1
Behavioral task
behavioral1
Sample
zeta-spoofer-protected.exe
Resource
win11-20240709-en
General
-
Target
zeta-spoofer-protected.exe
-
Size
3.5MB
-
MD5
bcc01284ac8f5778ddc160a0e507e1ca
-
SHA1
2aa4df6e157592996dcb40e73301fdd44e085ce1
-
SHA256
1e5770dd53bace069481c643f990e1e8115e15133de537af3bf30ea1e4be1294
-
SHA512
438343a4fc0a1fc37706024132c31e5f11fbb1e1f9942fe2b5e614f1df437c885c3d13dcb7f5fca791d4fce52e870343fc12fcbbde82a5c01399900109cd5974
-
SSDEEP
98304:7bshwxCCsY7CJNwQM8J553B3NVu3Jw2HmBdbbB5U/qe:PsUsYGwQZdU3GOm7bBm/qe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource zeta-spoofer-protected.exe
Files
-
zeta-spoofer-protected.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 60KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE