z[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

z.exe
Size

22.5MB
MD5

022c1bd832b05b800a2647c49ad0bd6e
SHA1

81142d8bffceaa5efb297ad0786ea290c431ded4
SHA256

1ac9370e49aa276849c2f25ab93af38efbc47670e3e8cfa0d96822dfb637e6e0
SHA512

31463d89cbddbbcf5692c8457a07879a0a820856e438a68936dd9a62e631e6ca5609295bb0bcb552227768d121667f512cba590dd74706289961cd5e2d1c5ac0
SSDEEP

393216:hmcOdREEnu9PajcVqye/L2rY/wFz1iG1A9LZkDYLLyfJsdjVgzTbAC:h8dR7noPAND2skkG+qDcWf0jVg8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
z.exe

Files

z.exe
.exe windows:6 windows x64 arch:x64

3407c76f821e48ea21588301b6ca54e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress

bcryptprimitives

ProcessPrng

api-ms-win-crt-heap-l1-1-0

_aligned_free

api-ms-win-crt-private-l1-1-0

__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-string-l1-1-0

isxdigit

advapi32

AdjustTokenPrivileges

kernel32

AcquireSRWLockExclusive
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

ntdll

NtClose

crypt32

CertCloseStore

ws2_32

WSAGetLastError

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-time-l1-1-0

__daylight

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-convert-l1-1-0

mbrtowc

Exports

Exports

_GCC_specific_handler
_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_Find_FDE
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
unw_get_fpreg
unw_get_proc_info
unw_get_proc_name
unw_get_reg
unw_getcontext
unw_init_local
unw_is_fpreg
unw_is_signal_frame
unw_local_addr_space
unw_regname
unw_resume
unw_set_fpreg
unw_set_reg
unw_step

Sections

.text
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: - Virtual size: 61B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.U0,
Size: - Virtual size: 13.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.!!'
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.o{-
Size: 22.5MB - Virtual size: 22.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3407c76f821e48ea21588301b6ca54e7

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

advapi32

kernel32

ntdll

crypt32

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 4.0MB

.rdata Size: - Virtual size: 1.2MB

.buildid Size: - Virtual size: 61B

.data Size: - Virtual size: 50KB

.pdata Size: - Virtual size: 42KB

.tls Size: - Virtual size: 8KB

.U0, Size: - Virtual size: 13.2MB

.!!' Size: 12KB - Virtual size: 12KB

.o{- Size: 22.5MB - Virtual size: 22.5MB

.reloc Size: 512B - Virtual size: 216B

.text
Size: - Virtual size: 4.0MB

.rdata
Size: - Virtual size: 1.2MB

.buildid
Size: - Virtual size: 61B

.data
Size: - Virtual size: 50KB

.pdata
Size: - Virtual size: 42KB

.tls
Size: - Virtual size: 8KB

.U0,
Size: - Virtual size: 13.2MB

.!!'
Size: 12KB - Virtual size: 12KB

.o{-
Size: 22.5MB - Virtual size: 22.5MB

.reloc
Size: 512B - Virtual size: 216B