Static task
static1
Behavioral task
behavioral1
Sample
zmstage.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
zmstage.exe
Resource
win11-20240802-en
General
-
Target
zmstage.exe.v
-
Size
3.8MB
-
MD5
5591e976503011d6a88e45d2f8f5824b
-
SHA1
194eb3070b5c70986e253d4024d871b1461be2b8
-
SHA256
0dd42a3d5bd880e9a4cb3f482c3366b7f71421b1570c29111c3bd892f2d4fb4d
-
SHA512
23db19ec6a0a43175a800442243b472d3b24818c548528a1e83831d97393c02646f67735881bff1c3cf368f50542ef2bf4aee2ea1c594ab1240d948a3cd3ce05
-
SSDEEP
49152:/Ov1QCpM5XL1ZpWe8ZckWZiMES5oZyQrXm3ZwsUFSD2VB8CXc:/i1QCuxLCZbLyQmJarVB87
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource zmstage.exe.v
Files
-
zmstage.exe.v.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 106KB - Virtual size: 327KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 281B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 204KB - Virtual size: 204KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/32 Size: 44KB - Virtual size: 43KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/46 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/63 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/80 Size: 512B - Virtual size: 42B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/99 Size: 335KB - Virtual size: 335KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/112 Size: 191KB - Virtual size: 191KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/124 Size: 66KB - Virtual size: 66KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 214KB - Virtual size: 214KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ