zsc_apply[.]exe | Triage™

General

Target
zsc_apply.exe
Size 160KB
Sample260730-tkdv1abh98
SHA256 2bd3db9b1ac29dc8e19df5309cbd1af8d4794c64b994a0fec47cd84fe09638e4
MD5 021a284ace5d23385d3ef21a340fc85b
SHA1 829ff4080c3eaeedad870c436f527bf8b8c44ac3
SHA512 bbb5bd35d88bc83d9f8e81ad6c09a8d19ddb61cc2b7f1a571c08655d9e14e7fb8f5f1ac8265e72a7c02beecadcfec2932ab1601ec0b267fff6cfebbce3c0962f
SSDEEP 3072:OYWQhBIPmKOzXeY+LQJj+JZMhNqP2oXcMLYm0m:DtgjOsSaPMhlm0
TLSH
T172F38E57B3E520F9E1B78238C9510646E772B83207619BEF03A447756F236E19D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zsc_apply.exe

File Explorer

zsc_apply.exe

.exe 160KB

zsc_apply.exe

IMPHASH 1a5ccef8dc4d0e34527885678cec6a70
SHA256 2bd3db9b1ac29dc8e19df5309cbd1af8d4794c64b994a0fec47cd84fe09638e4
MD5 021a284ace5d23385d3ef21a340fc85b
SHA1 829ff4080c3eaeedad870c436f527bf8b8c44ac3
SHA512 bbb5bd35d88bc83d9f8e81ad6c09a8d19ddb61cc2b7f1a571c08655d9e14e7fb8f5f1ac8265e72a7c02beecadcfec2932ab1601ec0b267fff6cfebbce3c0962f
SSDEEP 3072:OYWQhBIPmKOzXeY+LQJj+JZMhNqP2oXcMLYm0m:DtgjOsSaPMhlm0
TLSH
T172F38E57B3E520F9E1B78238C9510646E772B83207619BEF03A447756F236E19D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

lol

Minor OS version

0

Major OS version

6

Entry point

8896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

kernel32

EncodePointer SetEndOfFile WriteConsoleW HeapReAlloc HeapSize CreateFileW ReadConsoleW CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileSizeEx ReadFile WriteFile CloseHandle GetLastError WaitForSingleObject CreateMutexA Sleep OpenProcess CopyFileA MoveFileExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RtlUnwind RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx GetFileType FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

zsc_apply.exe

bcrypt

kernel32

generic