KAIZO[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
KAIZO.exe
Size 39.5MB
Sample261030-v41dsaez2q
SHA256 a1f0c28c3996a04e1825443ba87b35a84aa5d96d5a7572ae0f11e2c7f74cdb8c
MD5 89d4b0bcc976388b656d4bb3f152ba20
SHA1 163dfdeefc708c030fe0463fb5298c4c8bae7997
SHA512 0e0abaa6908b5c529e71a1da6fcb770b7e6e7cfb78fbd110b7b7c1ab283de66b6f6ad4221a7c9e6cc4bb5a32bf5133ae73797566986c965ec532ab1c13fe09fc
SSDEEP 786432:ROLYhcrrilOLmddclNJNfSpzABiWMWYOL8qFffL+:ROLsNOLFlZSG4WMOL8qF6
TLSH
T16A9702437781C651CF52B9396516DB97D232BC84A7019EC32E8E1E2F5EAA2F16C3D708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KAIZO.exe

File Explorer

KAIZO.exe

.exe 39.5MB

KAIZO.exe

IMPHASH a2c9bbe59597d942b8c0937af335fcc8
SHA256 a1f0c28c3996a04e1825443ba87b35a84aa5d96d5a7572ae0f11e2c7f74cdb8c
MD5 89d4b0bcc976388b656d4bb3f152ba20
SHA1 163dfdeefc708c030fe0463fb5298c4c8bae7997
SHA512 0e0abaa6908b5c529e71a1da6fcb770b7e6e7cfb78fbd110b7b7c1ab283de66b6f6ad4221a7c9e6cc4bb5a32bf5133ae73797566986c965ec532ab1c13fe09fc
SSDEEP 786432:ROLYhcrrilOLmddclNJNfSpzABiWMWYOL8qFffL+:ROLsNOLFlZSG4WMOL8qF6
TLSH
T16A9702437781C651CF52B9396516DB97D232BC84A7019EC32E8E1E2F5EAA2F16C3D708
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1116088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\لي لودر\Loader Kaizo Fbi\examples\example_win32_directx11\Build6\x64\Release\KAIZO.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection Sleep VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx MoveFileExW WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx HeapAlloc InitOnceBeginInitialize SleepConditionVariableSRW GetCurrentThreadId HeapDestroy AddVectoredExceptionHandler CreateFileW GetComputerNameA IsDebuggerPresent IsWow64Process GetTickCount SetThreadContext WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent VirtualFreeEx CreateRemoteThread GetModuleHandleW GlobalMemoryStatusEx GetCurrentProcessId GetFileSize LocalFree VirtualAllocEx GetThreadContext LockResource GetVersionExA GetCurrentThread CreateFileA Process32NextW GetFileAttributesA GetLastError GetTickCount64 CreateToolhelp32Snapshot SetFileAttributesW OpenProcess GetVolumeInformationA FindClose GetEnvironmentVariableA FindResourceA GetTempPathW FindNextFileA GetModuleFileNameW TerminateProcess GetCurrentProcess FindFirstFileA WriteProcessMemory SizeofResource ReadFile GetStartupInfoW LoadResource QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress CreateThread GetSystemInfo MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetModuleHandleA GetLocaleInfoA LoadLibraryA HeapReAlloc FreeConsole CloseHandle InitOnceComplete Process32FirstW QueryPerformanceFrequency

user32

IsWindowUnicode ReleaseCapture SetCursorPos ShowWindow MessageBoxA DefWindowProcW DispatchMessageA ReleaseDC DestroyWindow GetClientRect GetClipboardData SetCursor SetCapture GetForegroundWindow SetClipboardData GetKeyboardLayout CloseClipboard OpenClipboard GetCursorPos GetWindowRect ClientToScreen GetCapture ScreenToClient GetDC LoadCursorA GetMessageExtraInfo GetKeyState UpdateWindow PostQuitMessage PeekMessageA LoadIconA TranslateMessage RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW GetWindowLongA MoveWindow SetLayeredWindowAttributes TrackMouseEvent EmptyClipboard SetWindowLongA

gdi32

DeleteObject DeleteDC BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits

advapi32

GetUserNameA RegCloseKey OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoUninitialize CoCreateInstance CoInitializeEx

msvcp140

_Thrd_detach _Xtime_get_ticks _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z _Query_perf_counter ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Syserror_map@std@@YAPEBDH@Z ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptStringToBinaryA CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CryptUnprotectData

bcrypt

BCryptDestroyKey BCryptGenRandom BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt

wininet

InternetCloseHandle InternetConnectA InternetReadFile InternetOpenA HttpSendRequestA HttpOpenRequestA InternetCrackUrlA HttpAddRequestHeadersA

shlwapi

PathFindFileNameW ord12

ws2_32

socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSAIoctl __WSAFDIsSet htonl ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send accept getsockopt select listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket WSASetLastError gethostname

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_exception_destroy __std_terminate _CxxThrowException memchr memcmp memset strchr strrchr wcschr strstr __C_specific_handler __current_exception __current_exception_context memmove memcpy

api-ms-win-crt-stdio-l1-1-0

fgets fread _pclose _wopen __stdio_common_vsprintf _wfopen fwrite _set_fmode _popen feof __stdio_common_vsscanf _fseeki64 __p__commode fclose _read _write fsetpos ungetc _fileno _close fputc _get_stream_buffer_pointers ftell __stdio_common_vswprintf_s _wfopen_s setvbuf __acrt_iob_func fgetpos fputs fflush __stdio_common_vfprintf fseek fgetc _lseeki64 __stdio_common_vfwprintf

api-ms-win-crt-runtime-l1-1-0

system _invalid_parameter_noinfo terminate _resetstkoflw _beginthreadex __sys_errlist __sys_nerr _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _wassert abort exit _errno _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _invoke_watson

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

tolower strcpy_s strncpy_s _wcsdup strcspn _wcsicmp strncpy strncmp wcsncpy _strdup strpbrk wcsncmp wcspbrk strcmp strspn

api-ms-win-crt-heap-l1-1-0

malloc calloc _set_new_mode free _callnewh realloc

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoull strtoul atoi wcstombs

api-ms-win-crt-time-l1-1-0

_localtime64_s _localtime64 _time64 strftime _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlink _wstat64 _unlock_file

api-ms-win-crt-math-l1-1-0

powf fmaxf _fdopen _dsign sqrtf cosf fmodf sinf ceilf __setusermatherr acosf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv