wp_game_kzmm[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
wp_game_kzmm.zip
Size 680KB
Sample260702-semqaadx5q
SHA256 2d81698b083f4e3cc0819ce0b76bceb7103243f6a4850d5905095e4177076c7d
MD5 e2774fd4fbd12f7bd61400b1c9b60219
SHA1 d812016b70a5bc9633ab21c73b705c9fba75cb66
SHA512 8d44b82295e3668f84645a3e1a786ff863db22e1b217cebe0d43866f5510b73c41550ea289d430934641dc23c6cb46dd30388b21609ffcc16139fdc14ee8ef97
SSDEEP 12288:wzc84bvcRIHqTwyVO94SRRJbZodbyBlctqfV7EZtPBTuSXgEY:wzhec+S62A7YbngElTcEY
TLSH
T1C7E4331C3D077E5D809E2B39C7F9518AB40E0769EB91AD771149182A3E0EDF4BB81ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/KZMM.EXE

File Explorer

wp_game_kzmm.zip

.zip 680KB
KZMM.EXE

.exe 1.1MB

wp_game_kzmm.zip

SHA256 2d81698b083f4e3cc0819ce0b76bceb7103243f6a4850d5905095e4177076c7d
MD5 e2774fd4fbd12f7bd61400b1c9b60219
SHA1 d812016b70a5bc9633ab21c73b705c9fba75cb66
SHA512 8d44b82295e3668f84645a3e1a786ff863db22e1b217cebe0d43866f5510b73c41550ea289d430934641dc23c6cb46dd30388b21609ffcc16139fdc14ee8ef97
SSDEEP 12288:wzc84bvcRIHqTwyVO94SRRJbZodbyBlctqfV7EZtPBTuSXgEY:wzhec+S62A7YbngElTcEY
TLSH
T1C7E4331C3D077E5D809E2B39C7F9518AB40E0769EB91AD771149182A3E0EDF4BB81ED8
MD5 SHA1 SHA512 SSDEEP TLSH

KZMM.EXE

SHA256 8edcf8097eda4dadcf73cdca0a05a95bce6bd01bd5d29a39dd110af8b321adb4
MD5 3264a7c13394482bffe41a5bd4a84654
SHA1 b93db4ec8583796072a931199ca8d95452ea033a
SHA512 5e26d2810d2d3116707bdf73527cf5f908b90e6ae14a43395eeeea066b98fe393698cac9178c3493865535c20e8d51857ef6ffa222fd3df7b925fc172bc96742
SSDEEP 24576:M9tMtU2E7SHSnbx7PzKnKkKAWm3Jg+isg+i6wKtKxKsZLK:M9tMtTsblzKnKkKI32Z9ZbKtKxKULK
TLSH
T10135BE229A717A33D4120A380BD763FE540E7F1E1BB54A091ABDDC0F7AB69C6356F142
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

420620

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

407KB

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

672KB

Virtual Size

672KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wp_game_kzmm.zip

KZMM.EXE

generic