Release.zip
- SHA256 9155edf8ac4b53bc61303a04da92cb0c94be195285e9fb45f7df607860de0338
Static task
static1
1 signatures
General
- Target Release.zip
- Size 4.3MB
- Sample261011-te38pscg34
- SHA256 9155edf8ac4b53bc61303a04da92cb0c94be195285e9fb45f7df607860de0338
- MD5 23721b3a8bfd25edb8c8be9bad10f678
- SHA1 76a1732b363afd4e4b2fa1e44bf38ddcfdfe3056
- SHA512 5e91e47b99eea7ceb5b726d82bf99fe28729cd39c0af351e5ac68dd26aad14bb606b8d82850724bee91911635a909e9fe7b91828a7781a99d2e21d4e74f05b7b
- SSDEEP 98304:Ns8ml5+r/bh7sekUiF3Y5sz9SOBw+iBucQTSaREtHZCOti0eGO:NUQh7seDk3vUWw/SEt5hi0ef
- TLSH T1D2263333B0E87ABF5CF81BEB07501AE63DD625FC0AD9A8344A52575101E33B793B509A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/ZyroExternal.exe unpack001/Release/ZyroExternalHelper.dll unpack001/Release/bypass.dll
File Explorer
-
Release.zip.zip 4.3MB
-
Release/ZyroExternal.exe.exe 1.1MB
-
Release/ZyroExternal.pdb10.3MB
-
Release/ZyroExternalHelper.dll.dll 222KB
-
Release/ZyroExternalHelper.pdb4.7MB
-
Release/bypass.dll.dll 108KB
Release/ZyroExternal.exe
- IMPHASH b38af871bb18210e2d5cc76c97623c5a
- SHA256 e48300027b87ccf15d1322ca4b6fc1c5fdf41a40e256745bbf12e182fef1704a
- MD5 d5e3bcfd897b36c7031b1c0d69e77e17
- SHA1 3d31f8621d523616b45b9b080d12789fcabb56f4
- SHA512 770cacdaff866134e1d45cc8febfc83f9bfc6208f984b6f33501394f6b14b0103244a452032875b6aabb20fef9eb0918b8518a6c9fb6a361e1c2cfb9ca18a6a8
- SSDEEP 24576:zBc7SVWknV0exdy7bz+nM5durHlNIi3WnkuO:dMkeW5M5oHlL3Wnl
- TLSH T16745AE45B2F900E8E47B9174DAB4A11BEA7278541B309ADF13D0065D2F737E05BBBB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
616976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\zyro\Downloads\NeoExternal source.OGFNzip\ZyroExternal - Source\Build\Release\ZyroExternal.pdb
d3d11
D3D11CreateDevice
dcomp
DCompositionCreateDevice
d3dcompiler_47
D3DCompile
advapi32
StartServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
ChangeServiceConfigW
GetTokenInformation
OpenProcessToken
OpenServiceW
CloseServiceHandle
user32
GetClientRect
SetProcessDPIAware
GetForegroundWindow
GetAsyncKeyState
MessageBoxA
SetActiveWindow
IsWindow
GetKeyState
GetMessageExtraInfo
GetCapture
TrackMouseEvent
GetKeyboardLayout
LoadCursorW
SetCapture
SetCursor
IsWindowUnicode
ReleaseCapture
SetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
ScreenToClient
GetCursorPos
DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowPos
MonitorFromWindow
IsWindowVisible
SetWindowLongPtrW
CreateWindowExW
UnregisterClassW
GetWindowLongPtrW
RegisterClassExW
ShowWindow
DispatchMessageW
GetMonitorInfoW
ClientToScreen
PeekMessageW
AttachThreadInput
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
TranslateMessage
ClipCursor
PostQuitMessage
GetDesktopWindow
EnumDisplaySettingsW
UpdateWindow
SetForegroundWindow
ShowCursor
GetWindowThreadProcessId
GetWindow
EnumWindows
shell32
SHGetKnownFolderPath
ShellExecuteW
kernel32
FindFirstFileExW
FindClose
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
OutputDebugStringW
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCommandLineW
GetCommandLineA
TerminateProcess
ExitProcess
IsProcessorFeaturePresent
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
GetStartupInfoW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
GetCurrentProcess
GetModuleFileNameW
WaitForSingleObject
CreateEventW
GetTickCount64
GetLastError
SetEvent
LoadLibraryA
CloseHandle
SetCurrentDirectoryW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
WriteFile
CreateFileW
ReadFile
SizeofResource
GetFileSizeEx
LockResource
DeleteFileW
LoadResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
GetLocalTime
FlushFileBuffers
GetFullPathNameW
GetTempPathW
GetFileAttributesW
OpenProcess
GetExitCodeThread
UnmapViewOfFile
QueryPerformanceFrequency
RtlUnwind
DeviceIoControl
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
Module32FirstW
ReadProcessMemory
Module32NextW
GetExitCodeProcess
GetCurrentThreadId
WaitForSingleObjectEx
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoA
IsDBCSLeadByte
FreeLibrary
GetCurrentProcessId
GetCPInfo
SetStdHandle
GetProcessHeap
HeapSize
SetEndOfFile
QueryPerformanceCounter
GetStringTypeW
LCMapStringEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
ole32
CoTaskMemFree
imm32
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
Name
.text
Size
815KB
Virtual Size
814KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
255KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=30795,
count=187, id=261, version=30795,
count=25, id=260, version=30795,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=91, id=261, version=35721,
count=1, id=262, version=30795,
count=23, id=257, version=30795,
count=238, id=1, productName=Unmarked objects,
count=30, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
Release/ZyroExternal.pdb
- SHA256 df18fc27a0b5da401bcfa41cc60420f7dd8416a18475b419101d5093ccf406b0
- MD5 85e2cf75fd483c49ecd513579b4a83d1
- SHA1 48b15bc71aea3df559c8173ba39336183fc457a5
- SHA512 61a7150f4505f4c90bcdde2cd337456e03e1bf7bf7f1e4f58c36e8ea6dc22fd3b5c8d6e84e81550628f2f16f0f4021c6567bf052a48bea0bf236903b3938f985
- SSDEEP 98304:qxAD63zRaL/ljrjWcB2eBrPqtgv2k63VgP0+csG2krvB9BVBUBTBBBRB9B5BuBtx:z/PqtgiVgP0+csG2krnK/R
- TLSH T18AB66B61FA885D23C42F163AB29B0B5CA3D499038BDF6BCB894D935D5CCA344DF1E681
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/ZyroExternalHelper.dll
- IMPHASH 14416fb455de47a8ee163ea99b65cfef
- SHA256 27126d78663d75bf83dbd835b06c5a6b511c3127726d5d785328d42476b6755b
- MD5 d06274f1b3cc03dc3f6d835f4749d643
- SHA1 a267b91c456b3596fb44b24172ce9bf752814804
- SHA512 a6d255294bf31ac68ca3943cf119502cbc6a4ca18a8a8a350f7f928f61d167476011e72df724f76643022ca0456af23d60c225ff2d15bd7c7a337c9932fe7425
- SSDEEP 3072:oITWsNCq57/lRitCLsq/sA/CLt1luBbF1pM1he/IWIFJXM7TNj3:oITWsNCe/ltUAut1sBb7SiAWH
- TLSH T1AB248E19B6A518BEED378578C9534901EB727C120760EACF53E00E968F2B7E4963FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
47024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\zyro\Downloads\NeoExternal source.OGFNzip\ZyroExternal - Source\Build\Release\ZyroExternalHelper.pdb
kernel32
GetModuleFileNameW
UnmapViewOfFile
Sleep
GetTickCount64
DisableThreadLibraryCalls
CloseHandle
CreateThread
CreateFileMappingW
MapViewOfFile
GetCommandLineW
GetEnvironmentVariableW
GetTempPathW
GetCurrentProcessId
GetModuleHandleW
VirtualQuery
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
LCMapStringW
GetProcessHeap
SetStdHandle
GetStringTypeW
ReadFile
ReadConsoleW
CreateFileW
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
RtlUnwind
Name
.text
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=147, id=261, version=30795,
count=14, id=260, version=30795,
count=10, id=259, version=35721,
count=15, id=260, version=35721,
count=36, id=261, version=35721,
count=3, id=257, version=30795,
count=96, id=1, productName=Unmarked objects,
count=7, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,
Release/ZyroExternalHelper.pdb
- SHA256 1897294c60c40ac2abfd97e575bcaf31d8588b16e920eb0ef64679ee5a1d74d4
- MD5 042b2d2118eca52d643c3a81dc4f8634
- SHA1 cb6ce0a8a6662d9002f5c69a5016246dac93f034
- SHA512 eeaffd6738995bc33f16c21ceb29a2126fe4bde5c59cc88a550675a556b7cfbeb308828fc9a54d7818b3dfab2c3e059e94d6d56911528a65060e50ae37a0f90a
- SSDEEP 98304:XpUI4WxSQNI3ve6ifmBgB1BzBgBuBCB6BmBiB5BXBDW2B0PYBnwCBnwcBo7DBo7K:X+
- TLSH T142369D53FA898D13C46F4635614B0B7D93D0C9435BCE3BDB8944A2A99CEF3889F6E181
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/bypass.dll
- IMPHASH 1b5b5b4032908bbd119ef7f7d2031445
- SHA256 331f4bb372a641516350262df2af2b9ac5cffd385dbc0255c92085ab5dafa169
- MD5 3008a9d0146cecfe81a7574637b9c097
- SHA1 78e0765421c324508d6e03814435c78dd93b3c59
- SHA512 c9ba12d716817621341f2234c8d3aa993aa4392ae6ce199cddf45b313e527aeeef6886670882666d2974b9723d5c2b1600241e4498e6b32d51df914d09302339
- SSDEEP 3072:TBJIBhKGSqCnQKjnR/e74TfdQjiHOs73BcU+LOBL4:T/IBFdCnQKjnQ74LdQjcOs7RclKBL
- TLSH T1C0B30113E94106CDD4540A700713A9A13BE9FDA58BB293C73BBA626E3DB47CC4E32D16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateProcessW
CreateThread
GetTempPathW
GetTickCount
WriteFile
DllMain
_DllMainCRTStartup
__xl_a
__xl_z
_tls_end
_tls_index
_tls_start
_tls_used
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ