Tzi_Microsoft_Tool[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Tzi_Microsoft_Tool.exe
Size 10.1MB
Sample261024-2pjk2ssw2m
SHA256 60301e1e5c1973bd96f5c812564f228a8f14d10776cabee7ac0877f629523261
MD5 07b9f4930fed9268e261b16ad2ea812f
SHA1 903f2c8b234d2e3c8d10fb9dc94ee43628080e6b
SHA512 f426b8038a9086ffbe65fd1bc4c9989d65ddbcb871de84ef303e20467ec371e4f5ea0f27e9782a64c5e5489536fe1ab27f634a2f61e020e3654326fba96c3c36
SSDEEP 196608:6agfF/ER8oC9pxmJm2gKUoIDm5x879fiweBeH+h4Hwk4IqkwXfak:6akYmqTHqm5xNwxehSwk4IOl
TLSH
T1B3B6128AF9A00AD5F20164B6A4B748A7D1D07083CFAE55EF68049746BD2F5E8CDF3538
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Tzi_Microsoft_Tool.exe

File Explorer

Tzi_Microsoft_Tool.exe

.exe 10.1MB

Tzi_Microsoft_Tool.exe

IMPHASH 2e951aa680d4df6dacc4d42e0df20565
SHA256 60301e1e5c1973bd96f5c812564f228a8f14d10776cabee7ac0877f629523261
MD5 07b9f4930fed9268e261b16ad2ea812f
SHA1 903f2c8b234d2e3c8d10fb9dc94ee43628080e6b
SHA512 f426b8038a9086ffbe65fd1bc4c9989d65ddbcb871de84ef303e20467ec371e4f5ea0f27e9782a64c5e5489536fe1ab27f634a2f61e020e3654326fba96c3c36
SSDEEP 196608:6agfF/ER8oC9pxmJm2gKUoIDm5x879fiweBeH+h4Hwk4IqkwXfak:6akYmqTHqm5xNwxehSwk4IOl
TLSH
T1B3B6128AF9A00AD5F20164B6A4B748A7D1D07083CFAE55EF68049746BD2F5E8CDF3538
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27459952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

8.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

672KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mu5

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cpx

Size

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.io2p

Size

10.0MB

Virtual Size

10.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Tzi_Microsoft_Tool.exe

ws2_32

advapi32

ole32

shell32

shlwapi

user32

version

crypt32

kernel32

comdlg32

urlmon

wininet

dwmapi

iphlpapi

generic