ZipNest[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ZipNest.exe
Size 4.4MB
Sample261023-kvmffsax6x
SHA256 e34942601a91672eb0c9895b5a7a71dd4d7ef19acee1e2d6ec85834549b850f8
MD5 dbc9793783325436bd953a895df3b8e8
SHA1 e623342c9ba1fcc3a0b7ae36f408000ea0742278
SHA512 33d04a3d09f9023f1ceb52adb31d17ba714708c19f77d460e1ea57209aacc68b88aa82e6ed2e734fc7c5915738bd2a699792ac7187a319cad815a000089a5f57
SSDEEP 49152:joATQ4aoiVQbqCD2C7TpdWYXYFnDBsdYj2xWkEWDHWP1srUH44qHJIU6iRcoX:jxQ4ao6c+OdDmOCOu+aoX
TLSH
T174264A13778A92BCC066C470838E42635B35749E2B36AAEB44C856383F79EF55E3D784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

ZipNest.exe

.exe 4.4MB

ZipNest.exe

IMPHASH 32918c4c47a7df00a99c55b7d4b42bb1
SHA256 e34942601a91672eb0c9895b5a7a71dd4d7ef19acee1e2d6ec85834549b850f8
MD5 dbc9793783325436bd953a895df3b8e8
SHA1 e623342c9ba1fcc3a0b7ae36f408000ea0742278
SHA512 33d04a3d09f9023f1ceb52adb31d17ba714708c19f77d460e1ea57209aacc68b88aa82e6ed2e734fc7c5915738bd2a699792ac7187a319cad815a000089a5f57
SSDEEP 49152:joATQ4aoiVQbqCD2C7TpdWYXYFnDBsdYj2xWkEWDHWP1srUH44qHJIU6iRcoX:jxQ4ao6c+OdDmOCOu+aoX
TLSH
T174264A13778A92BCC066C470838E42635B35749E2B36AAEB44C856383F79EF55E3D784
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

b2:a8:1d:13:9a:01:77:38:2e:d0:64:fa:c4:f5:3f:f1:84:ff:b4:4d:b1:13:fa:26:13:60:c1:1e:6c:8f:93:08

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZhongHaiCheng,O=ZhongHaiCheng,L=赣州市,ST=江西省,C=CN

Chains

Oct 16, 2026

CN=ZhongHaiCheng,O=ZhongHaiCheng,L=赣州市,ST=江西省,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=ZhongHaiCheng,O=ZhongHaiCheng,L=赣州市,ST=江西省,C=CN

Serial Number

74:fb:59:5a:bc:ae:e8:78:4e:04:37:b3:b0:cb:6a:5c

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 3, 2026 - Aug 3, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

2810956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ZipBroker.pdb

kernel32

LocalFree GetExitCodeProcess GetCurrentProcess QueryFullProcessImageNameW SetThreadExecutionState SetLastError GetLastError GlobalMemoryStatusEx GetTickCount64 GetModuleHandleW HeapSize GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage LCMapStringW CompareStringW TerminateProcess VirtualProtect InitializeCriticalSectionEx FlsGetValue GetCommandLineA WriteFile TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter ReadProcessMemory VirtualQueryEx Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateMutexW OpenProcess OpenMutexW CloseHandle UnhandledExceptionFilter FreeEnvironmentStringsW CompareStringOrdinal SetHandleInformation RtlVirtualUnwind GetCurrentProcessId HeapFree ReadFileEx SleepEx GetFullPathNameW ReadFile GetOverlappedResult FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry GetProcessHeap GetSystemTimePreciseAsFileTime FormatMessageW CancelIo SetFileTime GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeLibrary GetProcAddress LoadLibraryExW CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW GetComputerNameExW lstrlenW GetCurrentThreadId WriteFileEx FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex MoveFileExW DeleteFileW GetEnvironmentVariableW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW FlsSetValue IsThreadAFiber GetFileType CreateEventW SetFileInformationByHandle WaitForMultipleObjects GetModuleHandleA GetTempPathW QueryPerformanceFrequency CreateThread FindNextFileW CreateFileW GetStdHandle DuplicateHandle WaitForSingleObject CopyFileExW HeapReAlloc QueryPerformanceCounter GetFileInformationByHandle FindFirstFileExW

user32

PostMessageW IsWindowVisible SetForegroundWindow GetDC GetWindow GetLastInputInfo RegisterClassW DispatchMessageW TranslateMessage GetMessageW ShowCursor SetWindowDisplayAffinity GetForegroundWindow EnumWindows SendMessageW EnumDisplayMonitors SetCursorPos ShowWindow CreateWindowExW ReleaseDC IsWindow GetMonitorInfoW SetProcessDPIAware GetWindowThreadProcessId DefWindowProcW GetAsyncKeyState PostQuitMessage GetKeyState DestroyWindow GetWindowTextW BlockInput SendInput

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 GetUserNameW RegCloseKey RegSetValueExW RegQueryValueExW RegCreateKeyExW RegGetValueW GetTokenInformation OpenProcessToken

ws2_32

getsockname WSADuplicateSocketW select connect WSARecv getpeername send shutdown recv ioctlsocket getsockopt setsockopt WSAGetLastError getaddrinfo closesocket WSAStartup WSACleanup WSASend freeaddrinfo WSASocketW

crypt32

CryptUnprotectData

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtResumeProcess NtSuspendProcess NtQueryInformationProcess NtWriteFile NtOpenFile

gdi32

SelectObject CreateCompatibleBitmap BitBlt GetDIBits DeleteObject DeleteDC GetDeviceCaps CreateCompatibleDC GetStockObject

shell32

ShellExecuteW

bcrypt

BCryptGenRandom

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ZipNest.exe

kernel32

user32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

ws2_32

crypt32

ntdll

gdi32

shell32

bcrypt

generic