zti95t3o[.]exe | Triage™

General

Target
zti95t3o.exe
Size 284.8MB
Sample260727-rbbceatfpe
SHA256 9406fc7d57836a6bf1b27463d6b3c060db8bf3c6e3cd2870932fa3308ff7c916
MD5 4f0349ef729b0b10614a9eeec1c4a9a4
SHA1 b237a98bb819b50205b4ecedea0f5fd05c1ce8d2
SHA512 eff597dd5851f4fa65ccc467ca08c7b1de0364967e6dbd2dd88383955b8fd87de094be26705b28a92264ee3d0bc3cb6e33f9baea907642908017b568742ad888
SSDEEP 6291456:aRYJSfkWsV7NNrfLtU0yY3bA0Xq1RQx4Ej/5TZkRPlrMx3tvWcDG3l8u:14kjhHBU0dXSW/5uRhMxsp3lx
TLSH
T1F4E8330ADC13D5B7E8C026794F17B990A939AE5B1FF1F5818F80AE7CB1A8D94180F257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zti95t3o.exe

File Explorer

zti95t3o.exe

.exe 284.8MB

zti95t3o.exe

IMPHASH 31ca592936efe9a11c5de29b43a9cf75
SHA256 9406fc7d57836a6bf1b27463d6b3c060db8bf3c6e3cd2870932fa3308ff7c916
MD5 4f0349ef729b0b10614a9eeec1c4a9a4
SHA1 b237a98bb819b50205b4ecedea0f5fd05c1ce8d2
SHA512 eff597dd5851f4fa65ccc467ca08c7b1de0364967e6dbd2dd88383955b8fd87de094be26705b28a92264ee3d0bc3cb6e33f9baea907642908017b568742ad888
SSDEEP 6291456:aRYJSfkWsV7NNrfLtU0yY3bA0Xq1RQx4Ej/5TZkRPlrMx3tvWcDG3l8u:14kjhHBU0dXSW/5uRhMxsp3lx
TLSH
T1F4E8330ADC13D5B7E8C026794F17B990A939AE5B1FF1F5818F80AE7CB1A8D94180F257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

282738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

starter.pdb

ntdll

RtlUnwind RtlInitUnicodeString RtlDowncaseUnicodeString RtlNtStatusToDosError NtQuerySystemInformation NtLoadDriver RtlAdjustPrivilege

kernel32

LeaveCriticalSection VirtualQuery GetSystemInfo SetEndOfFile WriteConsoleW HeapSize FlushFileBuffers GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW HeapReAlloc GetFileType ReadFile GetACP GetStdHandle GetModuleHandleExW ExitProcess RaiseException CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateFileW CloseHandle DeviceIoControl QueryPerformanceCounter SetLastError GetProcAddress GetModuleHandleW UnmapViewOfFile RemoveDirectoryW GetTickCount GetUserDefaultLangID CreateProcessW GetExitCodeProcess SetEnvironmentVariableW WaitForSingleObject GetLastError LoadLibraryW GetCurrentProcess GetNativeSystemInfo MapViewOfFile CreateFileMappingW GetFileSizeEx TerminateProcess Sleep HeapAlloc GetProcessHeap HeapFree MultiByteToWideChar GetWindowsDirectoryW GetTempPathW GetModuleFileNameW FindFirstFileW FindClose FindNextFileW GetFileAttributesW CreateDirectoryW SetFileAttributesW DeleteFileW MoveFileExW WriteFile GetVersionExW CreateFileMappingA GetFileSize GetModuleHandleA WideCharToMultiByte EnterCriticalSection LoadLibraryExA TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEvent WaitForSingleObjectEx SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore

Sharing