setup_z8[.]0[.]12[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
setup_z8.0.12.exe
Size 31.2MB
Sample260902-pg92taxtfy
SHA256 9e588c115a1fa46793eb4df38413ec468ef0a165eaffdfcdc6787905ed8cd1bb
MD5 f55c1b0e170c60339994967e57bc1b6a
SHA1 bc90e563cc98b77a1ddb19cb4437298b2a158c90
SHA512 8da8c572eb9ea763484d8489b00bdb64910f467da0563c3b254a6d64ab20b522ecb810b42c47f467badd9188aa31f420f4b5972ae68d34a884266e0da4688565
SSDEEP 98304:3i9U9dbM4EJ3yZLxG8caZfnjIhKnp5l6t4l8xMv4cb:y2vbMxJ35aZfnOElY4lz5
TLSH
T18B776012B346898BE476A278484B8F94E321EDB19AB1937773B4731E1FFE34C5E96104
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup_z8.0.12.exe

File Explorer

setup_z8.0.12.exe

.exe 31.2MB

setup_z8.0.12.exe

IMPHASH 693b9983e2dfb464a405b7abaf658e8e
SHA256 9e588c115a1fa46793eb4df38413ec468ef0a165eaffdfcdc6787905ed8cd1bb
MD5 f55c1b0e170c60339994967e57bc1b6a
SHA1 bc90e563cc98b77a1ddb19cb4437298b2a158c90
SHA512 8da8c572eb9ea763484d8489b00bdb64910f467da0563c3b254a6d64ab20b522ecb810b42c47f467badd9188aa31f420f4b5972ae68d34a884266e0da4688565
SSDEEP 98304:3i9U9dbM4EJ3yZLxG8caZfnjIhKnp5l6t4l8xMv4cb:y2vbMxJ35aZfnOElY4lz5
TLSH
T18B776012B346898BE476A278484B8F94E321EDB19AB1937773B4731E1FFE34C5E96104
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

204884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

FormatMessageW RemoveDirectoryW DeleteFileW GetFullPathNameW GetFileSize GetFileAttributesW CreateFileW GetLongPathNameW CloseHandle GetVersionExW CreateProcessW WaitForSingleObject GetExitCodeProcess GetStartupInfoW GetDriveTypeW GetLogicalDrives MultiByteToWideChar ReadFile GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetModuleHandleW ExitProcess SetEvent TerminateProcess ExitThread SetLastError SetConsoleCtrlHandler CreateEventW OpenFile MapViewOfFile UnmapViewOfFile GetCurrentProcess GetLogicalDriveStringsW CreateFileMappingW QueryDosDeviceW GetTempFileNameW ExpandEnvironmentStringsW SetFilePointer SystemTimeToFileTime CreateDirectoryW SetFileTime WriteFile LocalFileTimeToFileTime CreatePipe HeapReAlloc GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetFilePointerEx ReadConsoleW FlushFileBuffers GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleMode GetConsoleCP IsDebuggerPresent GetModuleFileNameW HeapSize AreFileApisANSI GetModuleHandleExW IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter WideCharToMultiByte GetLastError SetConsoleTitleW GetStdHandle WriteConsoleW AllocConsole GetCommandLineW GetProcAddress LoadLibraryW GetSystemDirectoryW LoadLibraryExW OutputDebugStringW SetEndOfFile GetTempPathW RtlVirtualUnwind RtlCaptureContext GetCurrentThreadId GetOEMCP GetACP IsProcessorFeaturePresent GetCPInfo GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep SetStdHandle GetFileType InitializeCriticalSectionAndSpinCount HeapFree CreateThread ResumeThread HeapAlloc RtlPcToFileHeader RaiseException VirtualAlloc RtlUnwindEx

wininet

InternetCloseHandle FtpGetFileSize HttpQueryInfoW InternetConnectW InternetReadFile FtpOpenFileW InternetCrackUrlW InternetOpenUrlW InternetOpenW

comctl32

InitCommonControlsEx

psapi

GetMappedFileNameW

user32

LoadCursorW wsprintfW LoadIconW DefWindowProcW GetKeyState RegisterClassExW PostQuitMessage SetActiveWindow KillTimer SetForegroundWindow DialogBoxParamW EndDialog LoadStringW CreateWindowExW MessageBoxW SetDlgItemTextW SendMessageW SetWindowTextW SetTimer ShowWindow

gdi32

GetStockObject

advapi32

CryptDestroyHash CryptCreateHash CryptReleaseContext CryptAcquireContextW CryptGetHashParam RegConnectRegistryW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW CryptHashData

shell32

CommandLineToArgvW