Zynova[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Zynova.zip
Size 26.5MB
Sample261002-klsacazflf
SHA256 3d8ece4fa4aea6549f3a9c40d304c3e57bb0a3d841cfc9f800f237e450315e84
MD5 eddf7be9f6569a2bcd890b137e04229b
SHA1 65614dc611b241b4818efd85d56486326e67e8a9
SHA512 9cf233f74e90a870ad3b73dfc3f8317d14a80dfee51c99509b7442cd514e026d1391b9ba32e2ecf7e10484348dcf080dcf343e3721b4231cec736d38f1baaf46
SSDEEP 786432:uV1ToGSubsc/YarC7BKBNvTUSXe4VD3oVW6HOzn:ucmYaCynFdoVbHWn
TLSH
T1C15733AD7400FF1E481C843DAD2FA00BA59CD574F1D2D4098A34566B2CFA4EFAEA7C65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Final Zynova/Bin/Files/ZynovaModule.dll
unpack001/Final Zynova/Bin/Files/emulation.exe
unpack001/Final Zynova/Zynova.exe

File Explorer

Zynova.zip

.zip 26.5MB
Final Zynova/Bin/Files/ZynovaModule.dll

.dll 3.5MB
Final Zynova/Bin/Files/emulation.exe

.exe 75KB
Final Zynova/Zynova.exe

.exe 28.5MB

Zynova.zip

SHA256 3d8ece4fa4aea6549f3a9c40d304c3e57bb0a3d841cfc9f800f237e450315e84
MD5 eddf7be9f6569a2bcd890b137e04229b
SHA1 65614dc611b241b4818efd85d56486326e67e8a9
SHA512 9cf233f74e90a870ad3b73dfc3f8317d14a80dfee51c99509b7442cd514e026d1391b9ba32e2ecf7e10484348dcf080dcf343e3721b4231cec736d38f1baaf46
SSDEEP 786432:uV1ToGSubsc/YarC7BKBNvTUSXe4VD3oVW6HOzn:ucmYaCynFdoVbHWn
TLSH
T1C15733AD7400FF1E481C843DAD2FA00BA59CD574F1D2D4098A34566B2CFA4EFAEA7C65
MD5 SHA1 SHA512 SSDEEP TLSH

Final Zynova/Bin/Files/ZynovaModule.dll

IMPHASH 74c4b45612517b46b2cbe4f047d8248c
SHA256 dab7d1bfaafe1b00a524eba4351676888f8666c2d74ce5ccaa107d49b09b5e79
MD5 d15339415ec76d70b87f9736440fb1ab
SHA1 d59e269fd14cb65ca802f92d42d7480b54922762
SHA512 f02f2f142ee8d6c558b56966e834a0966da3a34e4eb6771909d7422c6751e91629e3c797614d9bdc76f35e30266cbd126e6af7ddbcd8fb0c00924c4af22b609c
SSDEEP 49152:hpKWWWVwWGgs6WPUjP8uP9xlt2UQsTbocE6r8Aeel3MxKhfvSyXH8C8r1pHsfN4Z:qa9Dp46Y63MxKhfvSyXc3
TLSH
T140069F2662E800E9C0A6C1BCD78B5A17E772B4451330ABEB16E486652F63FF15B7F311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2309692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\User\Documents\Module\module\Zynova_Module\build\Module.pdb

ws2_32

inet_pton WSASocketW shutdown htons WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect WSASetLastError WSACreateEvent htonl WSACloseEvent select __WSAFDIsSet sendto recvfrom WSAResetEvent WSAIoctl gethostname getpeername getsockname send ntohs connect getsockopt WSAPoll ioctlsocket getnameinfo WSAGetLastError accept bind closesocket ntohl listen getaddrinfo socket recv freeaddrinfo setsockopt WSACleanup WSAStartup

wldap32

ord27 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143

normaliz

IdnToAscii IdnToUnicode

crypt32

CertOpenSystemStoreW CertFreeCertificateContext CertGetCertificateChain CertCreateCertificateContext CertEnumCertificatesInStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertCloseStore CertFreeCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertFindCertificateInStore CryptStringToBinaryA PFXImportCertStore CryptQueryObject CertGetNameStringA CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CryptBinaryToStringA

kernel32

RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind UnhandledExceptionFilter LocalFree IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead InitOnceBeginInitialize InitOnceComplete GetFileInformationByHandleEx CopyFileW AreFileApisANSI GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetModuleFileNameA GetCurrentProcess GetLocaleInfoEx OutputDebugStringA TerminateProcess GetEnvironmentVariableA GetCurrentThreadId GetModuleHandleA GetModuleHandleExA DisableThreadLibraryCalls GetLocalTime GetCurrentProcessId SetUnhandledExceptionFilter VirtualQuery Sleep ReadFile FindFirstFileW GetFileSizeEx HeapFree GetFullPathNameW FindNextFileW WriteFile RemoveDirectoryW SetFilePointer FindClose CreateFileW GetFileAttributesW SetFileAttributesW MultiByteToWideChar GetTickCount64 GetLastError DeleteFileW CloseHandle HeapAlloc GetProcessHeap WideCharToMultiByte GetVolumeInformationA GetComputerNameA GlobalAlloc GlobalFree GlobalLock GlobalUnlock IsBadReadPtr VirtualFree VirtualAlloc FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA GetStdHandle WriteConsoleA SetConsoleMode ReadConsoleA GetConsoleMode FreeConsole FillConsoleOutputAttribute GetConsoleWindow SetConsoleOutputCP SetConsoleCursorPosition AllocConsole FormatMessageA CreateEventW SetEvent ResetEvent RaiseException LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask GetModuleHandleW FreeLibrary QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject CreateEventA GetSystemDirectoryA SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetFileType PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW CreateFileA ExpandEnvironmentStringsW

user32

SetWindowLongPtrW DefWindowProcW FindWindowA MessageBoxW CallWindowProcW GetDC GetClipboardData GetForegroundWindow MessageBoxA EmptyClipboard CloseClipboard OpenClipboard GetSystemMetrics keybd_event GetWindowThreadProcessId ShowWindow SetWindowPos ReleaseDC mouse_event SetClipboardData GetCursorPos GetWindowLongW AdjustWindowRectEx GetKeyState DestroyWindow MonitorFromWindow EnumDisplayMonitors CreateWindowExW ScreenToClient SetWindowTextW RegisterClassExW WindowFromPoint GetCapture GetMonitorInfoW ClientToScreen IsChild TrackMouseEvent SetLayeredWindowAttributes SetFocus BringWindowToTop LoadCursorW SetCapture SetCursor SetWindowLongW GetClientRect ReleaseCapture SetForegroundWindow IsIconic SetCursorPos

gdi32

GetDeviceCaps

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

CryptCreateHash CryptAcquireContextA GetCurrentHwProfileW CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptGenRandom CryptDecrypt CryptGetHashParam CryptHashData CryptDestroyHash CryptSetKeyParam CryptImportKey CryptReleaseContext

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFolderPathW

ole32

CoTaskMemFree

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ ??1ctype_base@std@@UEAA@XZ _Toupper ??_7ctype_base@std@@6B@ _Tolower _Thrd_join _Cnd_signal ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z _Xtime_get_ticks ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ??_7_Facet_base@std@@6B@ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Thrd_id ?_Random_device@std@@YAIXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exceptions@std@@YAHXZ ??1_Facet_base@std@@UEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xbad_function_call@std@@YAXXZ _Strcoll _Query_perf_counter _Query_perf_frequency _Strxfrm ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ??_7facet@locale@std@@6B@

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptHashData BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptOpenAlgorithmProvider

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_type_info_destroy_list _CxxThrowException __current_exception_context __current_exception memmove memchr memcmp memset memcpy strstr __std_type_info_compare wcsrchr strchr _purecall strrchr __std_exception_copy __std_exception_destroy __C_specific_handler_noexcept

api-ms-win-crt-stdio-l1-1-0

fflush fgets _get_stream_buffer_pointers _open _read _write fopen _fileno _close setbuf _wfopen_s feof fclose __stdio_common_vswprintf _lseeki64 __stdio_common_vswprintf_s fputc _wfopen fseek ftell __stdio_common_vsprintf_s fgetc _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite __acrt_iob_func __stdio_common_vsscanf fputs __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

free calloc malloc realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate strerror __sys_errlist __sys_nerr _errno _initterm_e _initterm exit _cexit abort _invoke_watson _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit

api-ms-win-crt-filesystem-l1-1-0

_stat64 _lock_file _unlink _fstat64 _unlock_file remove _access

api-ms-win-crt-string-l1-1-0

_stricmp strncpy_s isgraph _wcsicmp wcscpy_s strcmp islower isdigit ispunct strcpy_s _wcsnicmp tolower wcscat_s strncmp isalnum isalpha strncpy isspace toupper isblank strspn strcspn strncat strpbrk iscntrl isxdigit isupper _strdup

api-ms-win-crt-math-l1-1-0

fmodf fmod floorf llround pow floor log powf _dsign sin sinf exp ldexp round modf logf cosh cosf sinh cos ceilf ceil atan2f atan2 atan asin acosf acos _dclass sqrt sqrtf tan log10 _fdopen frexp log2 tanh

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

api-ms-win-crt-convert-l1-1-0

wcstombs atof atoi strtod strtoull strtoll strtoul strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s _gmtime64_s _difftime64 strftime _gmtime64 _time64 clock

Final Zynova/Bin/Files/emulation.exe

IMPHASH 174393b7fc8f92113a952266c1fd8639
SHA256 1b0cc37e1f3439fb88d6e350ba3a1b244c04dbcd0a2def4e290de06f01744f4a
MD5 3648d1fa9f55cb7c114c395d39cbdc76
SHA1 d5e6d76874e8f7a222fcb81435dff788042075c4
SHA512 27b54507697c5843ecf7418dfadce0704ec1130cb5beb2e0c5c52936ad261a61e63acc8400b83ecc55d9b12b15b91e63d3b5f7cb3d8c307f86e3965614fb1d5e
SSDEEP 768:1Ahj14eXrnr0prqBbSGJbF4U65vTpSysxvdXikgAu3lmFfsih+bxpZIUMcMIt4YS:aXA/Qy0HOWPChjR4Mj0zPqr3Jm7vg3
TLSH
T1557309258E6A50EAD23AD938C4123C47FF51B8854B95ABCF6B905DD30E52AD4AF3F301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Documents\injector\Build\Bin\Injector.pdb

ntdll

NtQueryObject RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtQueryInformationProcess

kernel32

WideCharToMultiByte GetFileInformationByHandleEx WriteProcessMemory SetConsoleTitleA GetCurrentProcess GetModuleHandleA OpenProcess Sleep GetLastError CloseHandle VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory GetStdHandle SetConsoleMode GetConsoleMode GetLocalTime DuplicateHandle VirtualQueryEx K32EnumProcessModulesEx CreateToolhelp32Snapshot Process32NextW Process32FirstW K32GetModuleBaseNameA VirtualQuery GetModuleFileNameA MultiByteToWideChar LocalFree GetModuleHandleW IsDebuggerPresent FindClose UnhandledExceptionFilter SetUnhandledExceptionFilter SetConsoleOutputCP FindFirstFileW GetFileAttributesExW AreFileApisANSI CreateFileW GetLocaleInfoEx FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess

advapi32

SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorDacl

msvcp140

_Thrd_join _Thrd_id ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception memset __std_terminate __std_exception_copy __std_exception_destroy memmove _CxxThrowException __C_specific_handler memcpy

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _c_exit exit _initterm_e _initterm _get_initial_narrow_environment _exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _invoke_watson _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _cexit abort terminate

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __p__commode _set_fmode __stdio_common_vsprintf __acrt_iob_func __stdio_common_vfprintf fflush

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

Final Zynova/Zynova.exe

IMPHASH 2a9e39b8a35d6a7acb4014f9a2d35f8e
SHA256 3c00ee919b4e30197066e670cbd54ee8a9c9fad43d78e390307a60fad272acfd
MD5 f1eadff53b0de21d7ce7395e84daf94f
SHA1 66dccb6f311aa47f598d6c8977d83aa7eec510bf
SHA512 a52d4dde989f2fafc5dd54c8963b8f8af65670d9f67c3082f7780e9982901679cbffa518daccb61b150d293f871579c2b7d5e392748fbf888dcf8ce6451f22f3
SSDEEP 393216:A2AdEXIWMqDhG0FLdj1mg3UN2Oa2NVH8p99pBW7ys1x+l6UB+ENhC3GLbkKd+/s1:PAr7q9GUjYgPiNVcp9J5rD0ELC3Y1+E
TLSH
T1F36723A675D6B2D887C30A48638E13DB50C1B57645F994343EC71803E920DEF7A8AEB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31864245

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WaitForSingleObjectEx

user32

AppendMenuW

shlwapi

SHCreateMemStream

ole32

CoInitializeEx

comctl32

SetWindowSubclass

shell32

SHOpenFolderAndSelectItems

advapi32

RegGetValueW EventSetInformation

oleaut32

GetErrorInfo

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle

gdi32

DeleteObject

dwmapi

DwmGetWindowAttribute

combase

CoTaskMemAlloc

imm32

ImmGetCompositionStringW

ws2_32

WSAStartup

pdh

PdhCloseQuery

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

pow

api-ms-win-crt-string-l1-1-0

wcscmp

api-ms-win-crt-convert-l1-1-0

_ultow_s

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

__p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

408KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.$+!

Size

Virtual Size

15.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Fsz

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.h<<

Size

28.5MB

Virtual Size

28.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Zynova.zip

Final Zynova/Bin/Files/ZynovaModule.dll

ws2_32

wldap32

normaliz

crypt32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

msvcp140

bcrypt

d3dcompiler_47

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

generic

Final Zynova/Bin/Files/emulation.exe

ntdll

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

Final Zynova/Zynova.exe

kernel32

user32

shlwapi

ole32

comctl32

shell32

advapi32

oleaut32

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

gdi32

dwmapi

combase

imm32

ws2_32

pdh

powrprof

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic