CptInstall - Zoom Test[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CptInstall - Zoom Test.exe
Size 405KB
Sample260730-sy8f4a1cld
SHA256 04d7b3b379178f57adf663f0bfabda6698be6b06d35b56f16d72cc22ebd48658
MD5 1b0d9e1fac4f11dc737920779d87a389
SHA1 2eea2a02b954961231bf69660202ca39cdbb1568
SHA512 e66fed0c64a358ef3d4319c2bcccd19c1946cf557a1b28becfa56348b544f7d200d694138f4cb6b17c948a6b9de04bba7579d66f9172223270446d9d67577e85
SSDEEP 6144:+ADj3PKhN/5TpGWiTLeEgsIY57BrrM4n64ieY1PTErKXM5Za:+ADj3Pu4LeWIYpX64irZIba
TLSH
T187947D1AFBE404F9E1A7D138C9A69506E7B57C6D0320D7CF13E84A661F236A05E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

CptInstall - Zoom Test.exe

.exe 405KB

CptInstall - Zoom Test.exe

IMPHASH 70f442534681f75cd21fdb451a3ea2c7
SHA256 04d7b3b379178f57adf663f0bfabda6698be6b06d35b56f16d72cc22ebd48658
MD5 1b0d9e1fac4f11dc737920779d87a389
SHA1 2eea2a02b954961231bf69660202ca39cdbb1568
SHA512 e66fed0c64a358ef3d4319c2bcccd19c1946cf557a1b28becfa56348b544f7d200d694138f4cb6b17c948a6b9de04bba7579d66f9172223270446d9d67577e85
SSDEEP 6144:+ADj3PKhN/5TpGWiTLeEgsIY57BrrM4n64ieY1PTErKXM5Za:+ADj3Pu4LeWIYpX64irZIba
TLSH
T187947D1AFBE404F9E1A7D138C9A69506E7B57C6D0320D7CF13E84A661F236A05E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

91:fe:05:f0:9d:82:9a:bd:e6:f6:1c:7b:0f:c7:08:8a:76:d8:40:70:32:c4:df:e7:97:3e:8f:b2:bd:be:17:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 18, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2021 - Jul 27, 2036

Subject

Serial Number

05:ce:16:4d:62:2a:58:e4:7a:01:a2:3d:fd:ec:64:c7

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2026 - Sep 21, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

133536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\Client.den\Client\Windows\release\bin\x64\Release\CptInstall.pdb

kernel32

GetModuleHandleA GetModuleHandleW LoadLibraryExW LocalAlloc CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocalTime WideCharToMultiByte GetModuleHandleExW InitializeCriticalSectionAndSpinCount ResumeThread FileTimeToLocalFileTime lstrcmpA lstrcpyW FileTimeToSystemTime MultiByteToWideChar GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile OpenFileMappingW FlushViewOfFile GetPrivateProfileIntW GetPrivateProfileStringW GetVersionExW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId SetEvent CreateEventW TerminateThread GetExitCodeThread WriteConsoleW SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue GetSystemDirectoryW GetSystemInfo TerminateProcess LeaveCriticalSection EnterCriticalSection HeapSize HeapReAlloc OpenProcess Sleep CopyFileW LoadLibraryW GetProcAddress CreateDirectoryW FreeLibrary CreateProcessW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle CreateFileW GetExitCodeProcess MoveFileW GetTempFileNameW GetProcessHeap GetCurrentProcessId DeleteCriticalSection MoveFileExW LocalFree DecodePointer HeapAlloc RaiseException CloseHandle DeleteFileW GetLastError ProcessIdToSessionId GetFileAttributesW WaitForSingleObject FindClose InitializeCriticalSectionEx GetTempPathW GetModuleFileNameW RemoveDirectoryW GetCurrentProcess FindNextFileW GetCommandLineW SetLastError HeapFree FindFirstFileW WritePrivateProfileStringW FlsGetValue FlsAlloc SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType WriteFile GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread ReadFile GetFileAttributesExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry EncodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW IsDebuggerPresent OutputDebugStringW RtlCaptureContext

user32

GetSystemMetrics

advapi32

SetEntriesInAclW StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW DeleteService CreateServiceW ControlService ChangeServiceConfig2W GetTokenInformation OpenServiceW OpenSCManagerW CloseServiceHandle SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey DuplicateTokenEx OpenProcessToken

shell32

ShellExecuteExW SHCreateDirectoryExW SHGetKnownFolderPath SHGetSpecialFolderPathW CommandLineToArgvW SHGetFolderPathW

ole32

CoTaskMemFree

shlwapi

PathFileExistsW PathAppendW PathAddBackslashW PathFindFileNameW PathIsRelativeW PathRemoveFileSpecW

psapi

GetProcessImageFileNameA

rpcrt4

RpcBindingFromStringBindingW NdrClientCall3 RpcServerUnregisterIfEx RpcStringBindingComposeW RpcStringFreeW RpcBindingFree

Name

.text

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CptInstall - Zoom Test.exe

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

rpcrt4

generic