Zynova[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Zynova.exe
Size 12.1MB
Sample261011-hhsetsxtdz
SHA256 65d45c7058705febe973446abc7e31904f2b684930ee876ce83c0c7ad4ec20ce
MD5 cec7eb03455d004f1aadce98617cddab
SHA1 454ff2f2e14b6609d254c96e7a44e2a28378d372
SHA512 9f79668a3b358f555c5cf82801595815e86595c45a52912321f3779c9040b5480d9b1203463f739a0fa6951f411801e2e171139056da9f31b42cd3346eecb394
SSDEEP 196608:wMm/ce1bNkJDkg8IVl5hXFwZZy5ZN02a:zc1bNkJDkg8IVl5h1ZN02a
TLSH
T1ACD6F8647B5A99A8D05BC47483878AA2093130DF0B39B9FF4484963C3F79BF56F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Zynova.exe

File Explorer

Zynova.exe

.exe 12.1MB

Zynova.exe

IMPHASH 0f4fcc2437810b5a9f25e2f936a96482
SHA256 65d45c7058705febe973446abc7e31904f2b684930ee876ce83c0c7ad4ec20ce
MD5 cec7eb03455d004f1aadce98617cddab
SHA1 454ff2f2e14b6609d254c96e7a44e2a28378d372
SHA512 9f79668a3b358f555c5cf82801595815e86595c45a52912321f3779c9040b5480d9b1203463f739a0fa6951f411801e2e171139056da9f31b42cd3346eecb394
SSDEEP 196608:wMm/ce1bNkJDkg8IVl5hXFwZZy5ZN02a:zc1bNkJDkg8IVl5h1ZN02a
TLSH
T1ACD6F8647B5A99A8D05BC47483878AA2093130DF0B39B9FF4484963C3F79BF56F38259
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8379536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zynova.pdb

kernel32

ExitProcess FindClose FindFirstFileExW ReleaseSRWLockExclusive GetCommandLineW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW SwitchToThread WideCharToMultiByte WaitForSingleObjectEx HeapFree CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx SetFileTime CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateMutexA WriteFileEx SleepEx ReadFileEx CreateThread QueryPerformanceCounter HeapReAlloc ReleaseMutex GetStdHandle SetFileInformationByHandle SetLastError FreeEnvironmentStringsW CompareStringOrdinal GetProcessHeap GetFinalPathNameByHandleW ReadProcessMemory MultiByteToWideChar WriteConsoleW OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW FreeLibrary K32GetPerformanceInfo GetConsoleOutputCP GetEnvironmentVariableW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetThreadContext AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException GetFullPathNameW CreateWaitableTimerExW GetModuleHandleA Sleep SetWaitableTimer FlsFree GetOverlappedResult SetEnvironmentVariableW FlsAlloc LoadLibraryW ReadFile GetModuleHandleExW GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort FlsSetValue LoadLibraryA IsThreadAFiber WaitForMultipleObjects SetHandleInformation LocalFree GetProcAddress EncodePointer HeapAlloc GetLastError LoadLibraryExA FormatMessageW GetTempPathW lstrlenW QueryPerformanceFrequency TerminateProcess OpenProcess GetCurrentProcessId GetCurrentThread CheckRemoteDebuggerPresent DuplicateHandle GetCurrentProcess IsDebuggerPresent GetCurrentThreadId LCIDToLocaleName FlsGetValue GetUserDefaultUILanguage InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW FindNextFileW WaitForSingleObject CreateEventW CloseHandle RtlUnwindEx DeviceIoControl InitializeCriticalSectionEx GetProcessIoCounters GetSystemTimes GetExitCodeProcess VirtualQueryEx GetProcessTimes GetSystemInfo GetFileAttributesW CreateFileW GetFileInformationByHandle GetConsoleMode GetEnvironmentStringsW GlobalMemoryStatusEx DeleteCriticalSection

user32

AppendMenuW SetMenuItemInfoW CheckMenuItem GetMenuItemInfoW TrackPopupMenu CreatePopupMenu SetCursor CreateMenu DrawMenuBar SetMenu CreateAcceleratorTableW DestroyAcceleratorTable CreateIcon GetAsyncKeyState GetKeyboardState GetKeyState MapVirtualKeyExW PostQuitMessage ToUnicodeEx SystemParametersInfoA SetPropW GetRawInputData GetKeyboardLayout SendInput SetForegroundWindow SetWindowTextW GetMenu DestroyMenu EnumDisplayMonitors MonitorFromPoint ClipCursor GetClipCursor ShowCursor SystemParametersInfoW GetCursorPos EnableMenuItem GetSystemMenu ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetMenuBarInfo RegisterRawInputDevices RegisterWindowMessageA GetWindow SetParent MapWindowPoints OffsetRect GetWindowDC DrawTextW SetFocus ShowWindow GetWindowRect DrawIconEx GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn ReleaseDC GetDC IsProcessDPIAware EnableWindow IsWindowEnabled DestroyIcon GetIconInfo InsertMenuW SetWindowPlacement LoadImageW VkKeyScanW CreateWindowExW GetWindowPlacement ChangeDisplaySettingsExW GetMonitorInfoW MonitorFromWindow AdjustWindowRectEx GetSystemMetrics DefWindowProcW MonitorFromRect PostThreadMessageW CloseTouchInputHandle PeekMessageW LoadCursorW GetTouchInputInfo TrackMouseEvent FillRect ScreenToClient FlashWindowEx RegisterClassExW GetUpdateRect MapVirtualKeyW ValidateRect DispatchMessageW TranslateMessage RegisterTouchWindow GetActiveWindow UpdateWindow InvalidateRect InvalidateRgn ClientToScreen RedrawWindow GetMessageW SendMessageW GetForegroundWindow SetCursorPos SetWindowPos PostMessageW DestroyWindow IsIconic SetWindowLongPtrW GetClientRect AdjustWindowRect GetMessageA SetWindowDisplayAffinity SetLayeredWindowAttributes SetWindowLongW GetWindowLongW EnumWindows RemoveMenu TranslateAcceleratorW GetWindowTextW GetWindowTextLengthW IsWindowVisible EnumChildWindows DispatchMessageA

ole32

OleInitialize RegisterDragDrop RevokeDragDrop CoInitializeEx CoUninitialize CoInitialize CoCreateInstance

shlwapi

SHCreateMemStream

comctl32

TaskDialogIndirect DefSubclassProc SetWindowSubclass RemoveWindowSubclass

shell32

ShellExecuteExW SHOpenFolderAndSelectItems DragFinish ShellExecuteW CommandLineToArgvW SHAppBarMessage SHGetKnownFolderPath ILCreateFromPathW ILFree DragQueryFileW SHGetStockIconInfo

advapi32

CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile NtQuerySystemInformation NtReadFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile NtQueryInformationProcess NtCreateNamedPipeFile RtlGetVersion

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

gdi32

GetDIBits CreateCompatibleDC CombineRgn CreateRectRgn DeleteDC GetDeviceCaps DeleteObject SetTextColor SetBkMode CreateSolidBrush BitBlt CreateDIBSection SelectObject

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

combase

CoTaskMemAlloc CoTaskMemFree CoCreateFreeThreadedMarshaler

imm32

ImmReleaseContext ImmGetCompositionStringW ImmGetContext

ws2_32

WSAStartup WSACleanup freeaddrinfo getaddrinfo setsockopt WSAGetLastError closesocket getsockname WSASend ioctlsocket connect getsockopt recv send WSASocketW bind shutdown getpeername WSAIoctl

secur32

AcceptSecurityContext DeleteSecurityContext EncryptMessage DecryptMessage FreeContextBuffer ApplyControlToken AcquireCredentialsHandleA FreeCredentialsHandle QueryContextAttributesW InitializeSecurityContextW

crypt32

CertCloseStore CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateStore CertAddCertificateContextToStore CertOpenStore CertDuplicateCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertGetCertificateChain

bcrypt

BCryptGenRandom

pdh

PdhGetFormattedCounterValue PdhCollectQueryData PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter PdhOpenQueryA

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

pow roundf __setusermatherr round floor trunc

api-ms-win-crt-string-l1-1-0

wcscmp wcslen strcpy_s _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

_exit _register_thread_local_exe_atexit_callback _initterm_e __p___argc __p___argv abort _initialize_onexit_table _register_onexit_function _get_initial_narrow_environment _initialize_narrow_environment _crt_atexit _cexit _configure_narrow_argv _initterm terminate _set_app_type _seh_filter_exe _c_exit exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale