ZClient[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ZClient.exe
Size 442KB
Sample260730-ptfnqsap2s
SHA256 e328e4aacda57f19f04a5e658ee7c93794983db9d6a636dcd289234bc8c0fd2b
MD5 d7194ffea83919fa3f515172837875eb
SHA1 c0df600fc28bcb5d3ac24a60be77515b7114150f
SHA512 6365ae426217a2f7d94ce2278b3730e8350e873e7908cf5f66406d039d14dc2ab6ef31b8427d14b0d57013f578851fe5ca4e38ef4f0d0c13661f713d54e01a23
SSDEEP 6144:H+tJDznSqlGORxxtY/9SYV5JT/SJE/++hUcSLhdOtJUDp3YqEDPmtPS:H+L5jR29ZJT/SJE/++8leZIPS
TLSH
T1C6A43B99FB4355F0E22745B18DDFE7BB862476018522FFF7EF4ECA52B4322122902295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ZClient.exe

File Explorer

ZClient.exe

.exe 442KB

ZClient.exe

IMPHASH 909454c8cdf215e1c61eaf5d677d4d7e
SHA256 e328e4aacda57f19f04a5e658ee7c93794983db9d6a636dcd289234bc8c0fd2b
MD5 d7194ffea83919fa3f515172837875eb
SHA1 c0df600fc28bcb5d3ac24a60be77515b7114150f
SHA512 6365ae426217a2f7d94ce2278b3730e8350e873e7908cf5f66406d039d14dc2ab6ef31b8427d14b0d57013f578851fe5ca4e38ef4f0d0c13661f713d54e01a23
SSDEEP 6144:H+tJDznSqlGORxxtY/9SYV5JT/SJE/++hUcSLhdOtJUDp3YqEDPmtPS:H+L5jR29ZJT/SJE/++8leZIPS
TLSH
T1C6A43B99FB4355F0E22745B18DDFE7BB862476018522FFF7EF4ECA52B4322122902295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExA RegSetValueExW

comctl32

InitCommonControlsEx

kernel32

CloseHandle CreateEventA CreateFileW CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FormatMessageA FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileSize GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__getmainargs __initenv __mb_cur_max __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _endthreadex _errno _initterm _iob _onexit _setjmp3 _vsnprintf _wfopen _wgetenv abort atoi calloc exit fclose fprintf fputc fputs fread free fseek ftell fwrite getenv localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc remove rename setlocale signal strchr strcmp strerror strlen strncmp strtoul vfprintf wcscat wcscpy wcslen wcsrchr wcsstr _strdup _read _access

shell32

SHGetFolderPathAndSubDirW

user32

DialogBoxParamA DialogBoxParamW EndDialog MessageBoxW SendDlgItemMessageA SendDlgItemMessageW

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

ws2_32

WSACleanup WSAStartup closesocket connect gethostbyname htons recv select send socket

Name

.text

Size

268KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ZClient.exe

advapi32

comctl32

kernel32

msvcrt

shell32

user32

version

winhttp

ws2_32

generic