Zuls bloom reducer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Zuls bloom reducer.exe
Size 1.2MB
Sample260818-eby29afc27
SHA256 60d4636116441d9faa374e0ba728e3de14bfcb75ff86b12f5687e649765b699e
MD5 ce4a3ca471833c404d7e0de0ecb83986
SHA1 e1dff9668de0183aa503f8c0b7be9aa5c81dcf35
SHA512 14dd347e46a58b746867fea5960e841764f50817f9375ee0ff2ac9f67ecb3504bdc5f9e41c06607994b6189b1d057a12bebe8037bd17efac4bf4dc64f75b570b
SSDEEP 24576:RVavLoNBTA/aqztcrIEoul9WPAbJxOWA5hLjOKQZuoc1/8j4kzUuq+m:RVavLoTTA/aqztcrIEoul9WPAbJxOWw4
TLSH
T1DC458D1733AAC0E8DE6F90F2C5A57323D672741407289ADB14E0DE2DDF93A925B3A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Zuls bloom reducer.exe

File Explorer

Zuls bloom reducer.exe

.exe 1.2MB

Zuls bloom reducer.exe

IMPHASH b66b962f1654841b6655c9e59651771a
SHA256 60d4636116441d9faa374e0ba728e3de14bfcb75ff86b12f5687e649765b699e
MD5 ce4a3ca471833c404d7e0de0ecb83986
SHA1 e1dff9668de0183aa503f8c0b7be9aa5c81dcf35
SHA512 14dd347e46a58b746867fea5960e841764f50817f9375ee0ff2ac9f67ecb3504bdc5f9e41c06607994b6189b1d057a12bebe8037bd17efac4bf4dc64f75b570b
SSDEEP 24576:RVavLoNBTA/aqztcrIEoul9WPAbJxOWA5hLjOKQZuoc1/8j4kzUuq+m:RVavLoTTA/aqztcrIEoul9WPAbJxOWw4
TLSH
T1DC458D1733AAC0E8DE6F90F2C5A57323D672741407289ADB14E0DE2DDF93A925B3A351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

838384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

gethostbyname inet_addr WSACleanup gethostname WSAStartup

winmm

mixerGetLineInfoW mixerGetDevCapsW mixerOpen mciSendStringW joyGetPosEx mixerGetLineControlsW mixerGetControlDetailsW mixerSetControlDetails waveOutGetVolume mixerClose waveOutSetVolume joyGetDevCapsW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

comctl32

ImageList_Create CreateStatusWindowW ImageList_ReplaceIcon ImageList_GetIconSize ImageList_Destroy ImageList_AddMasked

psapi

GetProcessImageFileNameW GetModuleBaseNameW GetModuleFileNameExW

wininet

InternetOpenW InternetOpenUrlW InternetCloseHandle InternetReadFileExA InternetReadFile

kernel32

GetModuleFileNameW GetSystemTimeAsFileTime FindResourceW SizeofResource LoadResource LockResource GetFullPathNameW GetShortPathNameW FindFirstFileW FindNextFileW FindClose FileTimeToLocalFileTime SetEnvironmentVariableW Beep MoveFileW OutputDebugStringW CreateProcessW GetFileAttributesW WideCharToMultiByte MultiByteToWideChar GetExitCodeProcess WriteProcessMemory ReadProcessMemory GetCurrentProcessId OpenProcess TerminateProcess SetPriorityClass SetLastError GetEnvironmentVariableW GetLocalTime GetDateFormatW GetTimeFormatW GetDiskFreeSpaceExW SetVolumeLabelW CreateFileW DeviceIoControl GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceW GetCurrentDirectoryW CreateDirectoryW ReadFile WriteFile DeleteFileW SetFileAttributesW LocalFileTimeToFileTime SetFileTime DeleteCriticalSection GetSystemTime GetSystemDefaultUILanguage GetComputerNameW GetSystemWindowsDirectoryW GetTempPathW EnterCriticalSection LeaveCriticalSection VirtualProtect QueryDosDeviceW CompareStringW RemoveDirectoryW CopyFileW GetCurrentProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetPrivateProfileStringW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW WritePrivateProfileStringW WritePrivateProfileSectionW SetEndOfFile GetACP GetFileType GetStdHandle SetFilePointerEx SystemTimeToFileTime FileTimeToSystemTime GetFileSize IsWow64Process VirtualAllocEx VirtualFreeEx EnumResourceNamesW LoadLibraryExW GlobalSize HeapReAlloc EncodePointer HeapFree DecodePointer ExitProcess HeapAlloc IsValidCodePage FlsGetValue FlsSetValue FlsFree FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry GetCPInfo GetVersionExW GetModuleHandleW FreeLibrary GetProcAddress LoadLibraryW GetLastError CreateMutexW CloseHandle GetExitCodeThread SetThreadPriority CreateThread GetStringTypeExW lstrcmpiW GetCurrentThreadId GlobalUnlock GlobalFree GlobalAlloc GlobalLock SetErrorMode InitializeCriticalSection SetCurrentDirectoryW Sleep GetTickCount MulDiv RtlCaptureContext HeapSetInformation GetVersion HeapCreate InitializeCriticalSectionAndSpinCount HeapSize HeapQueryInformation GetCommandLineW GetStartupInfoW RtlUnwindEx SetHandleCount GetStringTypeW RaiseException RtlPcToFileHeader LCMapStringW GetConsoleCP GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetOEMCP FlushFileBuffers SetFilePointer WriteConsoleW SetStdHandle GetFileSizeEx GetProcessHeap

user32

GetDlgItem SetDlgItemTextW MessageBeep GetCursorInfo GetLastInputInfo GetSystemMenu GetMenuItemCount GetMenuItemID GetSubMenu GetMenuStringW ExitWindowsEx SetMenu FlashWindow GetPropW SetPropW RemovePropW MapWindowPoints RedrawWindow SetWindowLongPtrW SetParent GetClassInfoExW DefDlgProcW GetAncestor UpdateWindow GetMessagePos GetClassLongPtrW CallWindowProcW CheckRadioButton IntersectRect GetUpdateRect PtInRect CreateDialogIndirectParamW GetWindowLongPtrW CreateAcceleratorTableW DestroyAcceleratorTable InsertMenuItemW SetMenuDefaultItem RemoveMenu SetMenuItemInfoW IsMenu GetMenuItemInfoW CreateMenu CreatePopupMenu SetMenuInfo AppendMenuW DestroyMenu TrackPopupMenuEx CopyImage CreateIconIndirect CreateIconFromResourceEx EnumClipboardFormats GetWindow BringWindowToTop MessageBoxW GetTopWindow GetQueueStatus SendDlgItemMessageW LoadAcceleratorsW EnableMenuItem GetMenu CreateWindowExW RegisterClassExW LoadCursorW DestroyIcon IsCharAlphaW EnableWindow VkKeyScanExW MapVirtualKeyExW GetKeyboardLayoutNameW ActivateKeyboardLayout GetGUIThreadInfo GetWindowTextW mouse_event WindowFromPoint GetSystemMetrics keybd_event SetKeyboardState GetKeyboardState GetCursorPos GetAsyncKeyState AttachThreadInput SendInput UnregisterHotKey RegisterHotKey PostQuitMessage SendMessageTimeoutW UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW IsCharAlphaNumericW IsCharUpperW IsCharLowerW ToUnicodeEx GetKeyboardLayout CallNextHookEx CharLowerW ReleaseDC GetDC OpenClipboard GetClipboardData GetClipboardFormatNameW CloseClipboard SetClipboardData EmptyClipboard PostMessageW FindWindowW EndDialog IsWindow DispatchMessageW TranslateMessage ShowWindow CountClipboardFormats SetWindowLongW ScreenToClient IsDialogMessageW DialogBoxParamW SetForegroundWindow DefWindowProcW FillRect DrawIconEx GetSysColorBrush GetSysColor RegisterWindowMessageW EnumDisplayMonitors IsIconic IsZoomed EnumWindows SetClipboardViewer GetWindowTextLengthW SendMessageW IsWindowEnabled GetWindowLongW GetKeyState TranslateAcceleratorW KillTimer PeekMessageW GetFocus GetClassNameW GetWindowThreadProcessId GetForegroundWindow InvalidateRect SetLayeredWindowAttributes SetWindowPos SetWindowRgn SetFocus SetActiveWindow ClientToScreen EnumChildWindows MoveWindow GetWindowRect GetMonitorInfoW MonitorFromPoint GetClientRect SystemParametersInfoW AdjustWindowRectEx DrawTextW SetRect GetIconInfo SetWindowTextW IsWindowVisible BlockInput GetMessageW SetTimer GetParent GetDlgCtrlID CharUpperW IsClipboardFormatAvailable CheckMenuItem LoadImageW MapVirtualKeyW ChangeClipboardChain DestroyWindow

gdi32

GetPixel GetClipRgn GetCharABCWidthsW SetBkMode CreatePatternBrush SetBrushOrgEx EnumFontFamiliesExW CreateDIBSection GdiFlush SetBkColor ExcludeClipRect SetTextColor GetClipBox BitBlt CreateCompatibleBitmap GetSystemPaletteEntries GetDIBits CreateCompatibleDC CreatePolygonRgn CreateRectRgn CreateRoundRectRgn CreateEllipticRgn DeleteDC GetObjectW GetTextMetricsW GetTextFaceW SelectObject GetStockObject CreateDCW CreateSolidBrush CreateFontW FillRgn GetDeviceCaps DeleteObject

comdlg32

CommDlgExtendedError GetSaveFileNameW GetOpenFileNameW

advapi32

RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerW GetUserNameW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegConnectRegistryW RegDeleteValueW

shell32

DragQueryPoint SHEmptyRecycleBinW SHFileOperationW SHGetPathFromIDListW SHBrowseForFolderW SHGetDesktopFolder SHGetMalloc SHGetFolderPathW ShellExecuteExW Shell_NotifyIconW DragFinish DragQueryFileW ExtractIconW

ole32

OleInitialize OleUninitialize CoCreateInstance CoInitialize CoUninitialize CLSIDFromString CLSIDFromProgID CoGetObject StringFromGUID2 CreateStreamOnHGlobal

oleaut32

SafeArrayGetLBound GetActiveObject SysStringLen OleLoadPicture SafeArrayUnaccessData SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnlock SafeArrayPtrOfIndex SafeArrayLock SafeArrayGetDim SafeArrayDestroy SafeArrayGetUBound VariantCopyInd SafeArrayCopy SysAllocString VariantChangeType VariantClear SafeArrayCreate SysFreeString

Name

.text

Size

884KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Zuls bloom reducer.exe

wsock32

winmm

version

comctl32

psapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic