10092026_1436_06092026__ZKRS#953800837526[.]vhd[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
10092026_1436_06092026__ZKRS#953800837526.vhd.zip
Size 5.2MB
Sample260910-ryp43shc98
SHA256 e172d3c0e95df744b9c031e20969249acc4ebb5372cdaca49daaacea5062483c
MD5 0d4f928bfcb4f3dcf322361a1e30124b
SHA1 6147b1e3f3066ecd64ef2e9d282201c7b6dd4bb8
SHA512 c4ac9bf22877ea90e2ffce17eb3c13507de8aeeb3ae693c38d4cef05f2ee43681a4446dc456256a51d0a06cce08f07f9f356820f9c545d655b17f38a632b5391
SSDEEP 98304:K+RueghYAijdyUIcNi9Wv0NxAxXcVgQvI76Q7nrAgjhOxkFayW:K+Rueg05I5Wv0NxVV1I2wjhOXV
TLSH
T1D5463351F41152CCFD28DCBD981776E1E0F1B847E82829E693B4485BA49713BC3BEA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
static1/unpack001/_ZKRS#953800837526.vhd	embeds_openssl
static1/unpack002/D.83040704.EXE	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/LUA51.dll

File Explorer

10092026_1436_06092026__ZKRS#953800837526.vhd.zip

.zip 5.2MB
_ZKRS#953800837526.vhd

.vhd 22.1MB
D.83040704.EXE

.exe 3.8MB
LUA51.dll

.dll 5.3MB
System Volume Information/WPSettings.dat

12B

10092026_1436_06092026__ZKRS#953800837526.vhd.zip

SHA256 e172d3c0e95df744b9c031e20969249acc4ebb5372cdaca49daaacea5062483c
MD5 0d4f928bfcb4f3dcf322361a1e30124b
SHA1 6147b1e3f3066ecd64ef2e9d282201c7b6dd4bb8
SHA512 c4ac9bf22877ea90e2ffce17eb3c13507de8aeeb3ae693c38d4cef05f2ee43681a4446dc456256a51d0a06cce08f07f9f356820f9c545d655b17f38a632b5391
SSDEEP 98304:K+RueghYAijdyUIcNi9Wv0NxAxXcVgQvI76Q7nrAgjhOxkFayW:K+Rueg05I5Wv0NxVV1I2wjhOXV
TLSH
T1D5463351F41152CCFD28DCBD981776E1E0F1B847E82829E693B4485BA49713BC3BEA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

D.83040704.EXE

IMPHASH 93d208446995c4f219daf7c26c86e3a9
SHA256 4090a0b9014c607ba076841b2c2d957e031a7612f6ae46151dd41517d53cfdc8
MD5 eb02dd65c981a8c626934e5b96b43302
SHA1 004c1571fa1e75fd13b54ddc75fd07a2aa967087
SHA512 064c1001adeb825d1760b4ae0f9b22296fe9961bd038c974a6e771000352d402eb274f8dcda48d98417208a9660e65b895b48d54009e1dc30b88ad82d28820f9
SSDEEP 49152:fTuYooyIQvMCbSwkQEk/exEnnHL75LErl0GPjyziET9/7buChgpXd62:fTuIygwiZGnHL75L/cv
TLSH
T1A506BE01FF428171F8E30A7A92FF577E4E39A9104714D4D3E3D419AA89316D1BB3A39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

Password

infected

Digest

10:c3:ac:90:6a:27:a6:93:86:42:3b:aa:ae:77:27:19:0a:59:f0:ba:c6:07:b4:2e:01:a7:46:93:45:87:6e:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 7, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2728772

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\968883\out\Release\Script\Script.pdb

lua51

lua_type lua_getfield lua_setfield lua_settop lua_isstring lua_pushstring luaL_openlibs luaL_register luaL_unref luaL_ref lua_tolstring lua_next luaL_checknumber lua_newthread lua_tointeger lua_xmove luaL_loadstring luaL_optlstring lua_isnumber luaL_newmetatable luaL_optinteger luaL_checkudata luaL_argerror luaL_checkoption lua_setmetatable lua_typename lua_rawset lua_checkstack lua_pushnumber luaL_checkstack lua_touserdata lua_tonumber lua_newuserdata luaL_checkinteger lua_createtable luaL_error lua_pushlightuserdata luaL_checklstring lua_pushinteger lua_close luaL_newstate lua_pushboolean lua_pushnil lua_pushvalue lua_rawgeti lua_pushlstring lua_objlen luaL_loadfile lua_rawseti lua_toboolean lua_call lua_pcall lua_insert lua_pushcclosure lua_gettop

crypt32

CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertCreateCertificateChainEngine CertEnumCertificatesInStore CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertFindCertificateInStore CertFreeCertificateContext CertCloseStore CertFreeCertificateChainEngine CertOpenStore CertGetNameStringW CryptStringToBinaryW

ws2_32

ntohl WSAIoctl WSAEventSelect WSAEnumNetworkEvents gethostname WSACloseEvent sendto recvfrom getpeername shutdown socket setsockopt listen connect closesocket bind accept send recv getservbyname getservbyport gethostbyaddr WSACleanup __WSAFDIsSet select WSAGetLastError htonl htons inet_addr inet_ntoa WSACreateEvent WSASetLastError ioctlsocket getsockname getsockopt ntohs gethostbyname WSAStartup

wldap32

ord117 ord41 ord208 ord73 ord216 ord14 ord46 ord219 ord145 ord301 ord26 ord147 ord133 ord27 ord127 ord167 ord142 ord79

mpr

WNetGetConnectionW

normaliz

IdnToAscii IdnToUnicode

kernel32

GetCPInfo LCMapStringEx IsDebuggerPresent HeapLock HeapUnlock GetStringTypeW HeapWalk UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind CreateFileW GetFullPathNameW CloseHandle RaiseException GetLastError SetLastError HeapAlloc HeapReAlloc HeapFree DeviceIoControl EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObject WaitForSingleObjectEx CreateMutexW CreateEventA CreateEventW Sleep GetProcessTimes TerminateProcess GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW VirtualFree FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW ExitThread GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetUserDefaultLCID HeapDestroy HeapSize GetProcessHeap DeleteCriticalSection GetModuleFileNameW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetPrivateProfileStringW OutputDebugStringW WriteFile GetFileSizeEx ReadFile LocalFree SetFileAttributesW DeleteFileW lstrlenW MoveFileExW GetTimeZoneInformation PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateIoCompletionPort GetCurrentThreadId FileTimeToLocalFileTime FileTimeToSystemTime GetCurrentProcessId OpenProcess CreateProcessW LoadLibraryW GetModuleHandleA GetExitCodeProcess CreatePipe GetCurrentProcess ReleaseMutex OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile OpenMutexW SetFilePointerEx GetThreadLocale SetThreadLocale SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime CreateDirectoryW InitializeCriticalSection SetEndOfFile GlobalAlloc FindFirstFileW FindNextFileW FindClose GetWindowsDirectoryW GetDriveTypeW GetLogicalDriveStringsW GetDiskFreeSpaceExW CreateToolhelp32Snapshot Process32FirstW Process32NextW lstrcmpiW VirtualAllocEx WriteProcessMemory VirtualFreeEx ReadProcessMemory Module32NextW OpenThread GetModuleHandleExW ResumeThread GetTempPathW SystemTimeToTzSpecificLocalTime GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA GetDynamicTimeZoneInformation GetConsoleMode GetFileAttributesA CreateFileA GetProcessWorkingSetSize SetHandleInformation GetShortPathNameW CreateNamedPipeW WaitForMultipleObjects SetEnvironmentVariableW SetThreadPriority SuspendThread BuildCommDCBW GetThreadPriority GetCommState CreateThread K32EnumProcesses ReadDirectoryChangesW GlobalLock CopyFileW GlobalUnlock SetCommState MoveFileW ConnectNamedPipe FormatMessageW GetCommandLineW SetStdHandle lstrcmpW GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA LoadLibraryA FormatMessageA GetEnvironmentVariableW GetACP TryEnterCriticalSection ReleaseSemaphore CreateSemaphoreA FreeLibraryAndExitThread SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetEnvironmentVariableA PeekNamedPipe VerSetConditionMask VerifyVersionInfoW RegisterWaitForSingleObject UnregisterWait ExpandEnvironmentStringsA GetQueuedCompletionStatusEx SetFileCompletionNotificationModes ExitProcess SetConsoleCtrlHandler GetFileInformationByHandle WriteConsoleW GetConsoleOutputCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetDateFormatW GetSystemTime

user32

GetUserObjectInformationW GetProcessWindowStation CharNextW GetWindowLongW DefWindowProcW CallWindowProcW CreateWindowExW SetWindowLongW ShowWindowAsync PostMessageW DestroyWindow SendMessageW SetWindowTextW MessageBeep TileWindows OpenClipboard VkKeyScanW CloseClipboard EmptyClipboard MoveWindow GetClipboardData SetClipboardData GetDesktopWindow GetWindowModuleFileNameW GetParent SendInput GetWindowTextW SetWindowPos MessageBoxW EnumChildWindows GetWindowRect IsWindowVisible EnumWindows GetClassNameW SetForegroundWindow GetForegroundWindow ShowWindow FindWindowW WaitForInputIdle GetWindowThreadProcessId

advapi32

RegEnumKeyExA RegNotifyChangeKeyValue SystemFunction036 CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegQueryInfoKeyW RegFlushKey RegEnumKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl

shell32

CommandLineToArgvW ShellExecuteW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize CoTaskMemAlloc CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

SHSetValueW PathRemoveFileSpecW SHGetValueW SHDeleteValueW PathFileExistsW PathCombineW PathFindFileNameW SHDeleteKeyW

psapi

EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

comctl32

InitCommonControlsEx

iphlpapi

GetAdaptersAddresses GetBestRoute2 FreeMibTable GetUnicastIpAddressTable if_nametoindex if_indextoname CancelMibChangeNotify2 NotifyIpInterfaceChange

bcrypt

BCryptGenRandom

generic

count=18, id=259, version=29395,

count=220, id=261, version=29395,

count=4, id=261, version=30148,

count=12, id=253, version=28518,

count=19, id=260, version=30034,

count=27, id=259, version=30034,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=10, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=106, id=261, version=30034,

count=2, id=253, version=23601,

count=29, id=260, version=29395,

count=2, id=262, version=29395,

count=9, id=261, version=30147,

count=46, id=257, version=29395,

count=223, id=260, version=30159,

count=732, id=260, version=30154,

count=23, productName=Unmarked objects (old),

count=3, id=257, version=30159,

count=724, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=63, id=265, version=30147,

count=1, id=256, version=30147,

count=1, id=255, version=30147,

count=1, id=151,

count=1, id=258, version=30147,

LUA51.dll

IMPHASH 41406f4e87d8dd95f4eaeaa73a3fc4c6
SHA256 3049bd70fbcab71d68696ce6331e7da860f98dea6f9b63afa67fafeb17bc980f
MD5 5fd5f8bdde0553ee2a853fbb991f351b
SHA1 929055002e4926f14629ffd98b47686f22bca66f
SHA512 93d10933c1ea317d246e1d1b8a5626a8c9299e31c8e3f6fb6a909d50fb67522edb0c7bac1ecea66ecb7288a4f0d42fe4dc3a6e2c01afe07465fa103d2547f9ab
SSDEEP 98304:CJPwTsC14klK0g04bzucg2znygnFmHpeenC8zEN4OiZrq1DfPHNADtV6v+M:CRRIXKD04U2ygnFmHpDnhEN4O7NADtVb
TLSH
T16A46C0313DDC3176D00E8130CE7DA2F9FAAE7D642B65009B1580BA1BFD317A25A1B95B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

71616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\src\vctools\VC7Libs\Ship\ATLMFC\Src\MFC\NvPluginWatchdog.NVX.Installer\Release\NvPluginWatchdog.NVX.Installer.pdb

ws2_32

shutdown WSACloseEvent WSACreateEvent WSASetLastError WSAEventSelect WSAResetEvent htons recv connect socket send WSAStartup select gethostbyname closesocket WSAIoctl WSACleanup WSAGetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents setsockopt

kernel32

GetStringTypeExW FileTimeToLocalFileTime GlobalFree VerSetConditionMask GetFileAttributesExW GetFileSizeEx LocalFileTimeToFileTime SystemTimeToTzSpecificLocalTime FindResourceExW RtlUnwind InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread UnhandledExceptionFilter TerminateProcess GetSystemInfo VirtualQuery QueryPerformanceFrequency GetCommandLineA GetCommandLineW HeapQueryInformation SetStdHandle GetFileType GetStdHandle LCMapStringW IsValidLocale EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW IsValidCodePage GetFullPathNameW GetACP GetOEMCP GetTimeZoneInformation VerifyVersionInfoW RaiseException OutputDebugStringW IsDebuggerPresent WriteFile GetFileSize GetModuleHandleExW DeleteFileW GetTempPathW CreateThread SystemTimeToFileTime GetLocalTime ResumeThread CreateMutexW WriteProcessMemory LocalFree CreateDirectoryW Process32NextW Process32FirstW CreateToolhelp32Snapshot DeviceIoControl GetTickCount GetCurrentProcessId ExitProcess UnmapViewOfFile VirtualProtect MapViewOfFile CreateFileMappingW CreateFileW GetSystemDirectoryW GetCurrentProcess GetModuleHandleW CreateProcessW lstrcpyW MultiByteToWideChar CopyFileW lstrcatW GetModuleFileNameW GetFileAttributesW GetEnvironmentVariableW FindResourceW LoadResource LockResource SizeofResource GetProcAddress LoadLibraryW CreateWaitableTimerW SetWaitableTimer TryEnterCriticalSection WideCharToMultiByte ResetEvent CreateEventW lstrlenW CancelIo SetLastError GlobalSize SwitchToThread GetCurrentThreadId CreateEventA CloseHandle SetEvent FormatMessageW Sleep WaitForSingleObject LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection HeapCreate GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx VirtualAlloc VirtualFree HeapFree GlobalGetAtomNameW GlobalReAlloc SetThreadPriority GetCurrentDirectoryW GetDiskFreeSpaceW GetFileTime lstrcmpA SetEndOfFile GlobalAlloc MulDiv GlobalLock GlobalUnlock FileTimeToSystemTime CompareStringW GlobalFindAtomW GlobalAddAtomW GetTempFileNameW SetFileTime ReplaceFileW GetUserDefaultLCID ReadFile LockFile GetVolumeInformationW GetShortPathNameW FlushFileBuffers FindFirstFileW FindClose SetFilePointer GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc lstrcmpW GlobalDeleteAtom LoadLibraryA LoadLibraryExW GetModuleHandleA FreeLibrary OutputDebugStringA InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW LCMapStringEx LocalAlloc GlobalHandle TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetThreadLocale SearchPathW WritePrivateProfileStringW GetPrivateProfileStringW GetTickCount64 GetProfileIntW GetWindowsDirectoryW FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetPrivateProfileIntW CompareStringA GetVersionExW GetCurrentThread EncodePointer MoveFileW UnlockFile DuplicateHandle lstrcmpiW

user32

CopyIcon GetDoubleClickTime CreateAcceleratorTableW GetKeyboardState DestroyCursor SubtractRect EnumChildWindows GetDCEx GetComboBoxInfo GetNextDlgGroupItem CharNextW InvalidateRgn GetKeyboardLayout IsIconic ClientToScreen RedrawWindow GetSystemMetrics LoadImageW RegisterClassW LoadCursorW LoadIconW DefWindowProcW PostThreadMessageW EnumWindows SetWindowPos SetWindowLongW GetWindowLongW GetWindowThreadProcessId GetFocus IsChild CharUpperBuffW GetSysColor GetWindowRect UpdateWindow InvalidateRect ScreenToClient SendMessageW GetSubMenu LoadMenuW SetRectEmpty GetParent InflateRect FillRect GetClientRect LoadBitmapW EnableWindow MsgWaitForMultipleObjects DispatchMessageW PeekMessageW TranslateMessage GetWindowRgn MapVirtualKeyExW IsCharLowerW GetTabbedTextExtentW MessageBoxW CallNextHookEx RegisterWindowMessageW GetMessagePos GetMessageTime PostMessageW CallWindowProcW GetClassInfoW GetClassInfoExW CreateWindowExW IsWindow IsMenu DestroyWindow GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindowVisible GetDlgItem GetDlgCtrlID SetFocus GetKeyState GetCapture GetMenu SetMenu GetMenuItemID GetMenuItemCount TrackPopupMenu SetActiveWindow GetForegroundWindow SetForegroundWindow BeginPaint EndPaint ValidateRect ScrollWindow SetScrollPos GetScrollPos SetScrollRange GetScrollRange ShowScrollBar SetPropW GetPropW RemovePropW GetWindowTextW GetWindowTextLengthW AdjustWindowRectEx MapWindowPoints CopyRect EqualRect PtInRect GetClassLongW GetClassNameW GetTopWindow GetLastActivePopup GetWindow SetWindowsHookExW UnhookWindowsHookEx DrawIcon SetScrollInfo GetScrollInfo WinHelpW MonitorFromWindow GetMonitorInfoW ShowWindow MoveWindow SetDlgItemTextW CheckDlgButton IsWindowEnabled SetWindowTextW IsDialogMessageW CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW GetKeyNameTextW MapVirtualKeyW GetDC ReleaseDC DrawTextW DrawTextExW GrayStringW TabbedTextOutW GetWindowDC GetMenuStringW GetMenuState InsertMenuW AppendMenuW RemoveMenu SetLayeredWindowAttributes GetSysColorBrush SystemParametersInfoW EnumDisplayMonitors DrawEdge DrawFrameControl DrawStateW SetWindowRgn DrawFocusRect OffsetRect IsRectEmpty DrawIconEx IntersectRect IsZoomed SetParent BringWindowToTop GetActiveWindow ReleaseCapture LoadAcceleratorsW TranslateAcceleratorW CreatePopupMenu DestroyMenu InsertMenuItemW SetCursor GetDesktopWindow DestroyIcon UnpackDDElParam ReuseDDElParam DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel TrackMouseEvent CharUpperW GetAsyncKeyState SetCapture SetTimer KillTimer GetSystemMenu DeleteMenu MessageBeep GetCursorPos WindowFromPoint NotifyWinEvent GetMenuDefaultItem SetMenuDefaultItem OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CopyImage GetUpdateRect LockWindowUpdate SetRect UnionRect GetMenuItemInfoW RegisterClipboardFormatW SetClassLongW GetMessageW DestroyAcceleratorTable UpdateLayeredWindow EnableScrollBar MonitorFromPoint CreateMenu SendNotifyMessageW CopyAcceleratorTableW InSendMessage WindowFromDC IsClipboardFormatAvailable ClipCursor GetIconInfo ModifyMenuW SetCursorPos PostQuitMessage WaitMessage SetWindowContextHelpId MapDialogRect CreateDialogIndirectParamW EndDialog GetNextDlgTabItem ShowOwnedPopups FrameRect HideCaret InvertRect SendDlgItemMessageA RealChildWindowFromPoint ToUnicodeEx

advapi32

RegDeleteTreeW RegSetValueW GetFileSecurityW SetFileSecurityW RegCreateKeyExW RegDeleteKeyW RegEnumKeyW RegQueryValueW RegEnumKeyExW RegEnumValueW RegCloseKey RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW FreeSid CheckTokenMembership AllocateAndInitializeSid GetTokenInformation OpenProcessToken DeleteService ControlService QueryServiceStatusEx StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW

shell32

ShellExecuteExW SHGetFolderPathW SHAddToRecentDocs SHBrowseForFolderW DragQueryFileW DragFinish ExtractIconW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage ShellExecuteW SHGetMalloc

oleaut32

SysFreeString SysStringByteLen SysStringLen SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime VariantChangeType VariantInit SysAllocString VariantClear SysAllocStringLen VariantCopy VarBstrFromDate LoadTypeLi OleCreateFontIndirect

shlwapi

PathStripToRootW PathIsUNCW PathFindFileNameW StrFormatKBSizeW PathFindExtensionW PathRemoveFileSpecW PathStripPathW PathFileExistsW

winmm

PlaySoundW timeGetTime

gdi32

GetCharWidthW OffsetRgn GetRgnBox DeleteMetaFile CreateMetaFileW CloseMetaFile SetAbortProc AbortDoc EndPage StartPage EndDoc RoundRect Rectangle SetBrushOrgEx GetWindowOrgEx SetDIBColorTable StretchBlt SetPixel RealizePalette GetDIBits CreateRoundRectRgn CreateDIBSection DPtoLP SetRectRgn GetMapMode Polyline Polygon CreatePolygonRgn GetTextColor GetBkColor Ellipse CreateEllipticRgn CombineRgn GetTextMetricsW GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap CreateCompatibleBitmap CreateDCW CopyMetaFileW ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx ExtFloodFill SetViewportExtEx ExtTextOutW TextOutW MoveToEx StartDocW SetTextAlign SetStretchBltMode SetROP2 SetPolyFillMode SetLayout SetMapMode SetBkMode SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetDeviceCaps GetCurrentPositionEx GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt PatBlt CreateRectRgnIndirect CreateBitmap SetPaletteEntries GetViewportOrgEx LPtoDP GetTextAlign EnumFontFamiliesExW FillRgn FrameRgn GetBoundsRect PtInRegion GetNearestPaletteIndex GetSystemPaletteEntries GetROP2 GetBkMode GetNearestColor GetPolyFillMode GetStretchBltMode GetTextFaceW SetPixelV UnrealizeObject CreatePalette GetPaletteEntries SetViewportOrgEx GetLayout SetTextColor SetBkColor DeleteObject GetStockObject CreateFontIndirectW DeleteDC GetTextExtentPoint32W GetObjectW

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW GetJobW

comctl32

ImageList_Draw ImageList_AddMasked InitCommonControlsEx

uxtheme

GetThemePartSize DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetThemeSysColor GetWindowTheme IsAppThemed DrawThemeText IsThemeBackgroundPartiallyTransparent

oledlg

OleUIEditLinksW OleUIInsertObjectW OleUIConvertW OleUIBusyW OleUIAddVerbMenuW

gdiplus

GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipDeleteGraphics GdipSetInterpolationMode GdipDrawImageRectI GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDrawImageI GdiplusShutdown

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

ole32

CoUninitialize CoCreateGuid CoCreateInstance CoInitialize CoRegisterClassObject CoRevokeClassObject CoFreeUnusedLibraries OleInitialize OleUninitialize CLSIDFromString CLSIDFromProgID OleCreateLinkToFile RegisterDragDrop CreateDataAdviseHolder CreateOleAdviseHolder OleFlushClipboard OleIsCurrentClipboard DoDragDrop OleGetClipboard CoGetClassObject CoRegisterMessageFilter CoInitializeEx RevokeDragDrop CoLockObjectExternal IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleCreateFromFile OleIsRunning CreateFileMoniker StgIsStorageFile StgOpenStorage StgCreateDocfile OleRegEnumVerbs OleRegGetMiscStatus CoDisconnectObject OleSetMenuDescriptor OleGetIconOfClass OleLockRunning OleSetContainedObject OleSaveToStream OleSave OleLoad GetClassFile StringFromCLSID CoTaskMemAlloc CoTaskMemFree ReadClassStg WriteClassStg CoTreatAsClass CreateBindCtx WriteFmtUserTypeStg ReadFmtUserTypeStg OleCreateStaticFromData OleCreate CreateItemMoniker CreateGenericComposite CreateILockBytesOnHGlobal GetHGlobalFromILockBytes WriteClassStm StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes OleRun CreateStreamOnHGlobal SetConvertStg OleRegGetUserType ReleaseStgMedium OleDuplicateData GetRunningObjectTable

GetEngineState NvMessageBusBroadcastStartEngine NvMessageBusBroadcastStopEngine _swprintf_l _vswprintf_l fprintf fprintf_l fprintf_p fprintf_p_l fprintf_s fprintf_s_l fscanf fscanf_l fscanf_s fscanf_s_l fwprintf fwprintf_l fwprintf_p fwprintf_p_l fwprintf_s fwprintf_s_l fwscanf fwscanf_l fwscanf_s fwscanf_s_l luaJIT_profile_dumpstack luaJIT_profile_start luaJIT_profile_stop luaJIT_setmode luaJIT_version_2_1_1748459687 luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_error luaL_execresult luaL_fileresult luaL_findtable luaL_getmetafield luaL_gsub luaL_loadbuffer luaL_loadbufferx luaL_loadfile luaL_loadfilex luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffer luaL_pushmodule luaL_pushresult luaL_ref luaL_register luaL_setfuncs luaL_setmetatable luaL_testudata luaL_traceback luaL_typerror luaL_unref luaL_where lua_atpanic lua_call lua_checkstack lua_close lua_concat lua_copy lua_cpcall lua_createtable lua_dump lua_equal lua_error lua_gc lua_getallocf lua_getfenv lua_getfield lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_isyieldable lua_lessthan lua_load lua_loadx lua_newstate lua_newthread lua_newuserdata lua_next lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawset lua_rawseti lua_remove lua_replace lua_resume lua_setallocf lua_setfenv lua_setfield lua_sethook lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_status lua_toboolean lua_tocfunction lua_tointeger lua_tointegerx lua_tolstring lua_tonumber lua_tonumberx lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_upvalueid lua_upvaluejoin lua_version lua_xmove lua_yield luaopen_base luaopen_bit luaopen_debug luaopen_ffi luaopen_io luaopen_jit luaopen_math luaopen_os luaopen_package luaopen_string luaopen_string_buffer luaopen_table printf printf_l printf_p printf_p_l printf_s printf_s_l scanf scanf_l scanf_s scanf_s_l scprintf scprintf_l scprintf_p scprintf_p_l scwprintf scwprintf_l scwprintf_p scwprintf_p_l snprintf snprintf snprintf_c snprintf_c_l snprintf_l snprintf_s snprintf_s_l snscanf snscanf_l snscanf_s snscanf_s_l snwprintf snwprintf_l snwprintf_s snwprintf_s_l snwscanf snwscanf_l snwscanf_s snwscanf_s_l sprintf sprintf_l sprintf_p sprintf_p_l sprintf_s sprintf_s_l sscanf sscanf_l sscanf_s sscanf_s_l swprintf swprintf swprintf_c swprintf_c_l swprintf_l swprintf_p swprintf_p_l swprintf_s swprintf_s_l swscanf swscanf_l swscanf_s swscanf_s_l vfprintf vfprintf_l vfprintf_p vfprintf_p_l vfprintf_s vfprintf_s_l vfscanf vfscanf_l vfscanf_s vfscanf_s_l vfwprintf vfwprintf_l vfwprintf_p vfwprintf_p_l vfwprintf_s vfwprintf_s_l vfwscanf vfwscanf_l vfwscanf_s vfwscanf_s_l vprintf vprintf_l vprintf_p vprintf_p_l vprintf_s vprintf_s_l vscanf vscanf_l vscanf_s vscanf_s_l vscprintf vscprintf_l vscprintf_p vscprintf_p_l vscwprintf vscwprintf_l vscwprintf_p vscwprintf_p_l vsnprintf vsnprintf vsnprintf_c vsnprintf_c_l vsnprintf_l vsnprintf_s vsnprintf_s vsnprintf_s_l vsnwprintf vsnwprintf_l vsnwprintf_s vsnwprintf_s_l vsnwscanf_l vsnwscanf_s_l vsprintf vsprintf_l vsprintf_p vsprintf_p_l vsprintf_s vsprintf_s_l vsscanf vsscanf_l vsscanf_s vsscanf_s_l vswprintf vswprintf vswprintf_c vswprintf_c_l vswprintf_l vswprintf_p vswprintf_p_l vswprintf_s vswprintf_s_l vswscanf vswscanf_l vswscanf_s vswscanf_s_l vwprintf vwprintf_l vwprintf_p vwprintf_p_l vwprintf_s vwprintf_s_l vwscanf vwscanf_l vwscanf_s vwscanf_s_l wprintf wprintf_l wprintf_p wprintf_p_l wprintf_s wprintf_s_l wscanf wscanf_l wscanf_s wscanf_s_l

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.s_text

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

416KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.s_rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.s_data

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CMD0

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

10092026_1436_06092026__ZKRS#953800837526.vhd.zip

_ZKRS#953800837526.vhd

D.83040704.EXE

lua51

crypt32

ws2_32

wldap32

mpr

normaliz

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

comctl32

iphlpapi

bcrypt

generic

LUA51.dll

ws2_32

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

winmm

gdi32

msimg32

winspool.drv

comctl32

uxtheme

oledlg

gdiplus

oleacc

imm32

ole32

generic

System Volume Information/WPSettings.dat