fzipw[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fzipw.exe
Size 1.5MB
Sample260804-krmbaagd22
SHA256 25eb5ae409bc6c2a52dd9353e36717e073bcd9cd233851a51b87213e90d20d2f
MD5 72ab49d7447481ed89d4b405a729eec9
SHA1 578b19f8d9ffbaf68f8440e76508958f5f6b24b3
SHA512 a1f75738003f8f671e598b206a5ba7fec210ddfbf6240fb747bf5e1700a7a3de5c0dfc7cdc82690094f6687b6e93ca7a005cc614fcce7f871ead35b9b4ebc83b
SSDEEP 24576:u17EPuyJJ/hqxcns+vxaoV3bdlAijqjU6TIUZawHmKwqxh4QenS:GSlhqxXexaYdiijf6TIUswJVxUn
TLSH
T167754B43F66690FCC16AC074830A6633BE32788947257AFB56E04B713E66FD06A3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fzipw.exe

File Explorer

fzipw.exe

.exe 1.5MB

fzipw.exe

IMPHASH 2c0f29b279af81d6310335fdcc52da5a
SHA256 25eb5ae409bc6c2a52dd9353e36717e073bcd9cd233851a51b87213e90d20d2f
MD5 72ab49d7447481ed89d4b405a729eec9
SHA1 578b19f8d9ffbaf68f8440e76508958f5f6b24b3
SHA512 a1f75738003f8f671e598b206a5ba7fec210ddfbf6240fb747bf5e1700a7a3de5c0dfc7cdc82690094f6687b6e93ca7a005cc614fcce7f871ead35b9b4ebc83b
SSDEEP 24576:u17EPuyJJ/hqxcns+vxaoV3bdlAijqjU6TIUZawHmKwqxh4QenS:GSlhqxXexaYdiijf6TIUswJVxUn
TLSH
T167754B43F66690FCC16AC074830A6633BE32788947257AFB56E04B713E66FD06A3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1240976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fzipw.pdb

bcryptprimitives

ProcessPrng

kernel32

GetLastError SetConsoleMode GenerateConsoleCtrlEvent SetLastError GetLocalTime GetSystemTime SetConsoleOutputCP FindClose GetFileInformationByHandle GetConsoleProcessList GetConsoleWindow SetFilePointerEx HeapSize SetFileAttributesW SetFileTime CreateFileW DuplicateHandle WriteFile WriteConsoleW ReadFile ReadConsoleW GetConsoleOutputCP CreateDirectoryW GetFullPathNameW FindFirstFileExW SetFileInformationByHandle GetFileInformationByHandleEx DeleteFileW GetFinalPathNameByHandleW GetFileType FindNextFileW LCMapStringW CompareStringW GetStdHandle CloseHandle GetConsoleMode GetSystemInfo AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc CreateWaitableTimerExW Sleep SetWaitableTimer WaitForSingleObject GetCommandLineW GetModuleFileNameW TzSpecificLocalTimeToSystemTime SystemTimeToTzSpecificLocalTime CreateThread QueryPerformanceCounter WideCharToMultiByte LoadLibraryExW UnmapViewOfFile CreateFileMappingW MapViewOfFile GetCurrentProcess VirtualProtect SwitchToThread GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind MultiByteToWideChar HeapAlloc GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleHandleA QueryPerformanceFrequency ExitProcess GetSystemTimeAsFileTime FreeLibrary SetStdHandle FlushFileBuffers InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader TerminateProcess GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

IsWindowVisible IsIconic

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fzipw.exe

bcryptprimitives

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

user32

generic