Tzi_Microsoft_Tool.zip
- SHA256 09851f0fed8f737a478552f0cd8ccf96c2c72645cf3919fb64b7290927673d29
Static task
static1
1 signatures
General
- Target Tzi_Microsoft_Tool.zip
- Size 12.6MB
- Sample261024-2n14psxvfv
- SHA256 09851f0fed8f737a478552f0cd8ccf96c2c72645cf3919fb64b7290927673d29
- MD5 347f97b324d506b065a675f833c35f37
- SHA1 91e5cd35498c8640d0994962663a6bf5d3fba71b
- SHA512 ade7f3b1d4660d691becfae643b322c77cb2262b01ffa083725c8a160c7ac52749d4d0ac5e4562cc9761786aeb33f253fa9ad36d87de2339dfc8be4c73c016d2
- SSDEEP 393216:3RkSh0Pj2VSe7n3TO788Mq/IDju3v69fouEoCuAYQt5u:3mW4j28inSo8MqO0v0wAAG
- TLSH T1E3D633DFA1214BA2FB6AD7AC1765CE21D948373130F70022481A1D71E5C78CDD6BDAEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tzi_Microsoft_Tool.exe
File Explorer
-
Tzi_Microsoft_Tool.zip.zip 12.6MB
-
Tzi_Microsoft_Tool.exe.exe 13.7MB
-
config/bip39_english.txt12KB
-
config/config.ini1KB
-
config/notification.ini969B
-
config/sukimc.ini77B
-
proxy.txt14B
Tzi_Microsoft_Tool.exe
- IMPHASH 2e951aa680d4df6dacc4d42e0df20565
- SHA256 7edb4efa056e07186ff9df1ad214a4da3b6e5015358d78363ef20ec7eb2bb933
- MD5 1a17459d18bb6e8922c41f162d3641c7
- SHA1 426e7a8dbd11905d183f12c032005ea5b85908cd
- SHA512 03417df183458f90e57c07dcefe3c265f030d26824bfe9070e07dc122b053131254a1d1db7c0eaeeb315d5e8522f3d8f69364c0101d3ff5d693c5fbe3159eeee
- SSDEEP 393216:zor4hFxohwudMc10iVDtAtf70wIc4piYU/Move:Mr4hsFdL10iBih7DIc4pD4MZ
- TLSH T1D6E623EAAC065FD2F01538B0CCB618D65695B920CF458AF3A45C6005AE7F5C9EE37C2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37527760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
closesocket
advapi32
OpenProcessToken
ole32
CoInitializeEx
shell32
SHGetFolderPathW
shlwapi
PathFindFileNameW
user32
TranslateMessage
version
VerQueryValueW
crypt32
CertFindCertificateInStore
kernel32
RtlUnwindEx
comdlg32
GetSaveFileNameW
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
dwmapi
DwmSetWindowAttribute
iphlpapi
FreeMibTable
Name
.text
Size
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
668KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
323KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.1qg96
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.6tvo
Size
Virtual Size
10.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.qliv
Size
13.7MB
Virtual Size
13.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=30795,
count=196, id=261, version=30795,
count=19, id=260, version=35207,
count=12, id=259, version=35207,
count=108, id=261, version=35207,
count=21, id=260, version=30795,
count=2, id=257, version=30154,
count=369, id=1, productName=Unmarked objects,
count=29, id=257, version=30795,
count=18, id=261, version=35225,
count=48, productName=Unmarked objects (old),
count=966, id=260, version=35225,
count=1, id=261, version=35222,
count=7, id=260, version=35222,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,
config/bip39_english.txt
- SHA256 2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda
- MD5 f23506956964fa69c98fa3fb5c8823b5
- SHA1 b2d5241ae027a0e40f06a33d909809a190f210fe
- SHA512 416c71ba30018ea292bb36cdc23c9329673485a8d8933266a9d9a7cc72153b8baed3d430f52eab4f5d3addf6583611b3777a50454599f1e42716f5f879621123
- SSDEEP 192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
- TLSH T1E6421A78A360353BFACB5A8FDC983F51DA444E336E0264E4F66D5645184BC86CB28D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
config/config.ini
- SHA256 6ede5455b5b86966c1c48ae7f2ce874b966d225f02d3340e2ef394654ba7d7f5
- MD5 36487bbda11f6bbf264785e0e8ad2efb
- SHA1 82e7ede02e7bccb5e138833de3bc2591b957a5a0
- SHA512 b530249730d6d44ed3007dbcdea63df88c9a36b494111939c0cf73f89166561752b773365f1be064371e1a3146eb46efaf9d45eff7b93c8ecc8a6b06a43efd66
- TLSH T16531BB34DE96E46EE2763A54DC87FD1330AABB935A0FEA14F3945005F84FBC2816B018
- MD5 SHA1 SHA512 TLSH
config/notification.ini
- SHA256 d2ef02f22f0d071fdb571575879a820f4874e1886d75587658d98963e5e76568
- MD5 f547c3dcaac290b463f596791d3ed119
- SHA1 e66edc33ec5d88c2e6bbd9d611ec9581701759da
- SHA512 b28ac403b5240e07994fd58e88b7efe12aa0704194e0404aac2b48ef6c472f61069b3b13240e55f35dc69748fda998b17805c990e6fb00def533274771cefebe
- TLSH T11111A3221F187ABFA19E7E022D77F783115178A4422FA536F27014F97941740EF48A4D
- MD5 SHA1 SHA512 TLSH
config/sukimc.ini
- SHA256 647bc18bb6f4661ee98d0087531e7f7849efa0b2be118247f2e81c27bfead591
- MD5 8f119fac55706e172a1206287b8665d7
- SHA1 02db52b30fc866a532a00174377284b013db7ce3
- SHA512 685b7883f75ae03fd6ce85b0703e9d48ef5a63bce5b06808dc0b830837f6bc06af7efa4f9ad63b486ab77cf786643255b4f66144e68f64ebfd0d1ab8536ecfbf
- TLSH T1F2A0041D5D554C5C4C155055DCD7D45701117D15451F1547F751DCD4F041C75D715741
- MD5 SHA1 SHA512 TLSH
proxy.txt
- SHA256 dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
- MD5 44fb3a27ed30ae5193ebd879ca2cf039
- SHA1 70bacfa8e44a0929dddd31d0b9d78164e8cbfba5
- SHA512 29ca1df582d8a73d5f9e0d91911093ad4932eb0a5c848c3168ebc34e6172f864979f5123d51256e425bafde34820ddd144ba94df8a5e0b6a70f0994baa454081
- MD5 SHA1 SHA512