zapret-ui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
zapret-ui.exe
Size 12.4MB
Sample261027-p2vsmade94
SHA256 8a6055225eadceae53797521ecf80313de00199a6ffb1129fb48310b1679cc9b
MD5 a81c8a396b6b8cc001be545f8f843803
SHA1 f0ec74b7baf5620148b79775b424fd8f101fe2ff
SHA512 149c9e286454aa6f11970705fd5d25dc8d5ab2f65f47716062322cdd7b6e1b4f9cd67aa380771d2f1035b73cca8d3da656e524dfebdcaa92ffb261a3b5f0d0af
SSDEEP 196608:wzCFL3fEmz1NkOoX4ZNXPqGGGGGG3GGGGGGGGOGGGGGGGGGGgUGWGI:wWFL3mX4ZND
TLSH
T128D608117B5B98ACD58BC8B083468AB34E2130DB1A36B9BF45C4463D3F7DBF45B29219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zapret-ui.exe

File Explorer

zapret-ui.exe

.exe 12.4MB

zapret-ui.exe

IMPHASH 98ad67cf5267b4daa0fb79e024d66064
SHA256 8a6055225eadceae53797521ecf80313de00199a6ffb1129fb48310b1679cc9b
MD5 a81c8a396b6b8cc001be545f8f843803
SHA1 f0ec74b7baf5620148b79775b424fd8f101fe2ff
SHA512 149c9e286454aa6f11970705fd5d25dc8d5ab2f65f47716062322cdd7b6e1b4f9cd67aa380771d2f1035b73cca8d3da656e524dfebdcaa92ffb261a3b5f0d0af
SSDEEP 196608:wzCFL3fEmz1NkOoX4ZNXPqGGGGGG3GGGGGGGGOGGGGGGGGGGgUGWGI:wWFL3mX4ZND
TLSH
T128D608117B5B98ACD58BC8B083468AB34E2130DB1A36B9BF45C4463D3F7DBF45B29219
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9188608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zapret_ui.pdb

bcryptprimitives

ProcessPrng

ntdll

NtReadFile NtCancelIoFileEx RtlGetVersion NtDeviceIoControlFile NtCreateFile RtlNtStatusToDosError RtlUnwindEx NtCreateNamedPipeFile RtlVirtualUnwind NtWriteFile RtlCaptureContext NtOpenFile

kernel32

GetExitCodeProcess CompareStringOrdinal GetSystemDirectoryW AcquireSRWLockExclusive GetModuleFileNameW DuplicateHandle WaitForMultipleObjects WakeAllConditionVariable ExitProcess SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsGetValue GetCurrentThreadId FlsFree EncodePointer InitializeSListHead GetSystemTimePreciseAsFileTime FlsSetValue SetUnhandledExceptionFilter SetLastError SwitchToThread lstrlenW IsThreadAFiber WaitForSingleObject SetWaitableTimer HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee SetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleExW QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW GetModuleHandleA GetProcAddress FlsAlloc SetHandleInformation AddVectoredExceptionHandler CreateMutexW FindNextFileW SetFilePointerEx MoveFileExW CopyFileExW DeleteFileW GetTempPathW GetFileAttributesW CreateProcessW CancelIo CreateEventW CreateDirectoryW GetFileInformationByHandleEx MultiByteToWideChar LoadLibraryA GetFileInformationByHandle SetFileTime FindClose FindFirstFileExW GetFullPathNameW SetFileInformationByHandle WriteFileEx ReadFileEx SleepEx ReleaseSRWLockExclusive WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA CreateThread CreateFileW CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus FormatMessageW GetFinalPathNameByHandleW GetModuleHandleW GetQueuedCompletionStatusEx ReleaseMutex GetSystemInfo CreateWaitableTimerExW GetLastError WideCharToMultiByte Sleep QueryPerformanceCounter LoadLibraryW GetCurrentProcessId HeapAlloc GetCurrentProcess LoadLibraryExA CloseHandle DeleteCriticalSection WaitForSingleObjectEx FreeLibrary InitializeCriticalSectionEx RtlLookupFunctionEntry GetWindowsDirectoryW GetProcessId TerminateProcess LoadLibraryExW OutputDebugStringW OpenProcess OutputDebugStringA GlobalFree GlobalUnlock GlobalLock GetUserDefaultUILanguage LCIDToLocaleName GlobalAlloc

shell32

ShellExecuteW DragFinish DragQueryFileW SHAppBarMessage SHCreateItemFromParsingName Shell_NotifyIconGetRect ShellExecuteExW SHGetKnownFolderPath SHGetStockIconInfo Shell_NotifyIconW IsUserAnAdmin

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

SetTimer SetWindowRgn DispatchMessageA GetParent FindWindowExW GetWindow ValidateRect CreateIcon PostThreadMessageW DispatchMessageW TranslateMessage SetFocus DestroyAcceleratorTable RemoveMenu SetParent DestroyMenu GetActiveWindow PostMessageW SystemParametersInfoA CreateAcceleratorTableW SetCursor LoadCursorW LoadImageW MonitorFromRect CloseTouchInputHandle GetTouchInputInfo GetIconInfo DestroyWindow TrackMouseEvent SetCapture PostQuitMessage ScreenToClient GetMessageW SetWindowLongPtrW MsgWaitForMultipleObjectsEx MessageBoxW RegisterTouchWindow UpdateWindow FindWindowW InvalidateRect SetCursorPos GetForegroundWindow FlashWindowEx IsWindowEnabled CloseClipboard EnableWindow IsIconic IsWindowVisible RegisterRawInputDevices ShowWindow SendInput GetWindowLongPtrW RedrawWindow SendMessageW GetMenuItemInfoW FillRect GetMessageA KillTimer GetMenuBarInfo SetClipboardData AdjustWindowRect EnumChildWindows EnumDisplayMonitors RegisterClassExW SetWindowPlacement ChangeDisplaySettingsExW EmptyClipboard OpenClipboard DefWindowProcW SetPropW GetMonitorInfoW MapVirtualKeyW TranslateAcceleratorW GetWindowPlacement AdjustWindowRectEx GetMenu GetWindowLongW SystemParametersInfoW ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState PeekMessageW SetWindowDisplayAffinity MonitorFromPoint ClipCursor GetSystemMetrics GetClipCursor ShowCursor SetWindowTextW SetWindowLongW GetSystemMenu InvalidateRgn SetWindowPos GetWindowTextW GetWindowTextLengthW ReleaseCapture RegisterWindowMessageA GetUpdateRect GetRawInputData ChangeWindowMessageFilterEx RegisterClassW IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos AppendMenuW InsertMenuW SetMenu CreatePopupMenu CreateMenu DestroyIcon CreateWindowExW DrawIconEx GetDC SetMenuItemInfoW EnableMenuItem VkKeyScanW DrawMenuBar CheckMenuItem DrawTextW ReleaseDC GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect

comctl32

DefSubclassProc TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass

gdi32

CreateDIBSection GetDeviceCaps SelectObject GetDIBits CreateCompatibleDC BitBlt CombineRgn CreateRectRgn DeleteDC SetTextColor SetBkMode CreateSolidBrush DeleteObject

ole32

CoInitializeEx OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoUninitialize

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey EventSetInformation EventRegister RegGetValueW EventWriteTransfer EventUnregister SystemFunction036

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

shlwapi

SHCreateMemStream

ws2_32

WSASend shutdown send freeaddrinfo getaddrinfo WSAStartup getsockopt connect bind listen ioctlsocket WSASocketW closesocket recv setsockopt getsockname WSAGetLastError getpeername WSAIoctl

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

__setusermatherr floor roundf trunc pow round

api-ms-win-crt-string-l1-1-0

wcslen strcpy_s wcscmp _wcsicmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

exit _exit _initialize_narrow_environment _initterm_e _configure_narrow_argv terminate _set_app_type _register_onexit_function _crt_atexit _initialize_onexit_table _register_thread_local_exe_atexit_callback __p___argc __p___argv _get_initial_narrow_environment _cexit _c_exit _initterm _seh_filter_exe abort

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode calloc _callnewh