zira-miszsn[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
zira-miszsn.exe
Size 3.7MB
Sample260713-pg53vsaz21
SHA256 99dc1ea286648ec882d71ab5071e3072c702e5170770843177807179c63f4593
MD5 80588ad7bcc4c92c0b9e005178cf8414
SHA1 8caf6a3d3175bb375650179e74ec405169f7fb27
SHA512 590398de2ad0071f1f790c85a20ac2dc847964d827e4df155a745b52294bbd2fbf8b491f8f2ba8ba75807fd74504fdd391348e1328a94225708fe7a805be12ef
SSDEEP 49152:K6K1K+gBUcOSrSCVb6KbS7RWxHzwiIH5NZSV4P0coLPdAptvDy1d+HzKbC6Hsq1q:huQzG0YQVA0/LPmry1dhLTjUCc
TLSH
T19B06011DE38D52E8D213D134CBA65232EBB4B85A0761B9EB165EC7192FB79D01F3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zira-miszsn.exe

File Explorer

zira-miszsn.exe

.exe 3.7MB

zira-miszsn.exe

IMPHASH d7a140ad86093e229082e6f8b7493b94
SHA256 99dc1ea286648ec882d71ab5071e3072c702e5170770843177807179c63f4593
MD5 80588ad7bcc4c92c0b9e005178cf8414
SHA1 8caf6a3d3175bb375650179e74ec405169f7fb27
SHA512 590398de2ad0071f1f790c85a20ac2dc847964d827e4df155a745b52294bbd2fbf8b491f8f2ba8ba75807fd74504fdd391348e1328a94225708fe7a805be12ef
SSDEEP 49152:K6K1K+gBUcOSrSCVb6KbS7RWxHzwiIH5NZSV4P0coLPdAptvDy1d+HzKbC6Hsq1q:huQzG0YQVA0/LPmry1dhLTjUCc
TLSH
T19B06011DE38D52E8D213D134CBA65232EBB4B85A0761B9EB165EC7192FB79D01F3A310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

680180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CreateEventExW DuplicateHandle FormatMessageW FreeLibrary GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetModuleFileNameW GetProcAddress GetStdHandle GetThreadPriority LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException SetEvent SetLastError SetThreadErrorMode Sleep SleepEx VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent GetSystemTimeAsFileTime FlushProcessWriteBuffers InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoUninitialize CoWaitForMultipleHandles CoGetApartmentType CoInitializeEx

api-ms-win-crt-heap-l1-1-0

malloc calloc _set_new_mode _callnewh free

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s _stricmp strlen strcpy strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _crt_atexit terminate abort _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _register_onexit_function __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

680KB

Virtual Size

679KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gfx

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

zira-miszsn.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic