ZoomWorkspace[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ZoomWorkspace.exe
Size 23.3MB
Sample251107-pptd2avmhy
SHA256 33e59926cd50c0627c217a1173debd27742fd4b93ae8b9db513a33ecf87bc8b8
MD5 1bbc165eefe42119f9ebb4b501f583ca
SHA1 b2d00b7708e11c3aee0fbaab026520e5124a0f44
SHA512 42ca32f3dedfbaf671b3b7c4d9220ebf71377ebd07749c2ad93c78da9e2f79713aac8a651c6032a8bb8b8857cf801c42ffad0ec1f8c38cddb1b6bc5a95bc638c
SSDEEP 393216:HchTd2JfbpEMIXXQEft9EDd8gEgSPjeh+DA9eyOhHy1ibWMxXsU1+RB0KzG:2TkyRXX5Cd8cThp2y1ibDszRB0r
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

ZoomWorkspace.exe

.exe 23.3MB

ZoomWorkspace.exe

IMPHASH 5077e3f17a4376dcf6421ee6917bf4aa
SHA256 33e59926cd50c0627c217a1173debd27742fd4b93ae8b9db513a33ecf87bc8b8
MD5 1bbc165eefe42119f9ebb4b501f583ca
SHA1 b2d00b7708e11c3aee0fbaab026520e5124a0f44
SHA512 42ca32f3dedfbaf671b3b7c4d9220ebf71377ebd07749c2ad93c78da9e2f79713aac8a651c6032a8bb8b8857cf801c42ffad0ec1f8c38cddb1b6bc5a95bc638c
SSDEEP 393216:HchTd2JfbpEMIXXQEft9EDd8gEgSPjeh+DA9eyOhHy1ibWMxXsU1+RB0KzG:2TkyRXX5Cd8cThp2y1ibDszRB0r
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

6a:4e:9b:13:98:17:64:21:1e:ca:e7:89:f6:96:3a:2c:42:1a:03:09

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5984112,CN=GoTo Technologies USA\, LLC,O=GoTo Technologies USA\, LLC,L=Boston,ST=Massachusetts,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 29, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

63:0f:77:ea:22:73:bf:82:c6:19:08:35:b4:6b:72:1c:21:67:fe:54:77:55:ef:8b:a5:08:7c:03:46:da:a0:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 29, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:0c:87:67:bb:2d:4f:ef:c2:d6:17:df:11:ce:1b:89

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2024 - May 12, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:0c:87:67:bb:2d:4f:ef:c2:d6:17:df:11:ce:1b:89

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2024 - May 12, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

896880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\rescue-native-rescueassist\rescue-native-rescueassist\build\RelWithDebInfo\GoToResolveUnattendedUpdater.pdb

ole32

StgOpenStorage

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

ntdll

RtlNtStatusToDosError NtQuerySystemInformation RtlUnwind VerSetConditionMask

kernel32

GetVersionExW FindNextFileW GetCurrentProcess RemoveDirectoryW FindClose Sleep DeleteFileW LoadLibraryW GetProcAddress MoveFileExW FreeLibrary GetCurrentProcessId ReadFile CompareFileTime SetHandleInformation HeapFree TerminateProcess K32GetModuleFileNameExW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId OpenProcess SetFileInformationByHandle HeapAlloc GetCurrentDirectoryW DecodePointer DeleteCriticalSection GetProcessHeap QueryFullProcessImageNameW IsWow64Process GetProcessTimes LoadLibraryExW GetExitCodeProcess GetFileSizeEx LCMapStringA GetStringTypeExA GetUserDefaultLCID LoadLibraryA WaitForMultipleObjects GetThreadLocale LCIDToLocaleName GetStdHandle ProcessIdToSessionId FlushFileBuffers GetFileAttributesW GetDynamicTimeZoneInformation MultiByteToWideChar GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetFileType RaiseException lstrlenW SetEvent SleepEx CreateEventW CreateThread GetExitCodeThread GetVersion LockResource LockFileEx SetEndOfFile UnlockFileEx RemoveVectoredExceptionHandler InitializeCriticalSection SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW SetFilePointerEx FindFirstFileExW GetFileTime GetSystemTimeAsFileTime OutputDebugStringW GetLocalTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount WriteConsoleW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileAttributesW SetUnhandledExceptionFilter CreateDirectoryExW CopyFileExW AreFileApisANSI GetStringTypeW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter ResetEvent GetCPInfo CompareStringEx EncodePointer QueryPerformanceFrequency QueryPerformanceCounter GetLocaleInfoEx WriteFile AddVectoredExceptionHandler SetLastError InitOnceBeginInitialize InitOnceComplete LCMapStringEx lstrcatW GetLastError FormatMessageW GetModuleFileNameW GetCommandLineW SizeofResource CreateDirectoryW GetCommandLineA ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler SetStdHandle GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetConsoleOutputCP HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CreateEventA OpenEventA WaitForSingleObjectEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable GetModuleHandleW LocalAlloc MapViewOfFile CreateFileMappingW GetFileSize UnmapViewOfFile CreateFileW FormatMessageA VerifyVersionInfoW lstrcpyW WideCharToMultiByte CreateProcessW LocalFree SetCurrentDirectoryW FindResourceW LoadResource DeviceIoControl CloseHandle SleepConditionVariableSRW

user32

FindWindowW wsprintfW BringWindowToTop LoadStringA GetWindowThreadProcessId ShowWindow AttachThreadInput

shell32

ShellExecuteW CommandLineToArgvW ShellExecuteExW

oleaut32

VariantClear

advapi32

RegCreateKeyExA SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegDeleteTreeA SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertStringSidToSidW RegDeleteKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW RegDeleteKeyW ChangeServiceConfig2W RegCreateKeyExW DeleteService ControlService StartServiceW QueryServiceConfigW QueryServiceConfig2W OpenServiceW EnumServicesStatusW RegQueryInfoKeyW RegEnumValueW RegQueryValueExW RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA

ws2_32

gethostname WSAStartup WSAGetLastError WSACleanup

crypt32

CryptProtectData CertOpenStore CertGetNameStringW CertFindCertificateInStore CertCloseStore CertFreeCertificateContext CertDeleteCertificateFromStore

comctl32

ord345

shlwapi

PathIsDirectoryW PathIsDirectoryEmptyW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21.9MB

Virtual Size

21.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ZoomWorkspace.exe

ole32

rstrtmgr

ntdll

kernel32

user32

shell32

oleaut32

advapi32

ws2_32

crypt32

comctl32

shlwapi

generic