zahid_antivirus.zip
- SHA256 799f62a1ccde676df8799392dc92d428d47c8243e5dbe7a1b90ec244c6eedb83
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zahid_antivirus.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
zahid_antivirus.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
900 seconds
General
- Target zahid_antivirus.zip
- Size 349KB
- Sample261030-wdcepsez8k
- SHA256 799f62a1ccde676df8799392dc92d428d47c8243e5dbe7a1b90ec244c6eedb83
- MD5 fa9f0feadfda1fda22cfc015013e3366
- SHA1 26f242dad08e0d85f1d99d543c7b02907ae61f9f
- SHA512 b068daf13170b8d02997b84c8b49521636362672342b960002c0a8c8ad6d5d6c55adfd2a8856853266e7cb24bf491a8dfc5592d7cab5b0ddd8ab715f7b0879d5
- SSDEEP 6144:5RgaYmifhzMtOfqe7AXnY2RxltEPB0WwT5VU99PN579h8jzJZWZzjAhpOzipJN3c:EaTifD7AXdEPOVyv57wP7wz0h0ziJ3ta
- TLSH T1A0742391918222C2E3936D71D6AFDD31A24F224F7E0CE517EDBF26930CD6955C6A1C70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/Zahid Antivirus.exe.deploy unpack001/zahid antivirus/setup.exe
File Explorer
-
zahid_antivirus.zip.zip 349KB
-
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/1326096460_Add.ico.deploy97KB
-
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/Zahid Antivirus.application5KB
-
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/Zahid Antivirus.exe.deploy.exe 200KB
-
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/Zahid Antivirus.exe.manifest8KB
-
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/favicon.ico.deploy39KB
-
zahid antivirus/Zahid Antivirus.application5KB
-
zahid antivirus/setup.exe.exe 584KB
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/1326096460_Add.ico.deploy
- SHA256 e8289b439094771fd85410c90f7f4616c44293e11b9db570f3592c0fa1b52785
- MD5 0d7b68bb1517e07400710ba1fe519d89
- SHA1 68568c52ba5159fe0e73db22c25e91bfc1cfff87
- SHA512 2c2e9a7b9756997009b767b8a6d8f35dba5bbb07d1b3b99cde5aa5c2144ee98acbcb6a87612a361b26f36e5e52b5127c353c3e779951df446a4e84ee983dd3b7
- SSDEEP 768:EHubEwaiNoQFtGA7ZvsWvMXjPdLOnTnP2eXhnQwbsIwMH+ki6oKqaU:/EwaifNBsWvMae
- TLSH T148A31222A69D5916E02C7CF88813D5B192741E8545FCCF92B83CBB2D84317FBEE2521E
- MD5 SHA1 SHA512 SSDEEP TLSH
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/Zahid Antivirus.application
- SHA256 3aaf1fc621705834d876603302da033d4b040ddb0c637e2e1470784598c9ca70
- MD5 5709bf8da523cefa07f2ac5263c1cbd6
- SHA1 9aceed5ab91cd799642edf39234c735e294b5de2
- SHA512 7d73b0db1e3800347f65aec68247c53af05157e3d3a218fdf7d2a1c0af2e2053aa706b78db3c5529180dcb3900d35a587fc936b1f15317e420224afac89462cc
- SSDEEP 96:0WLwO9ZcRPEciOPkLPj+Q0jmOEtanEOkk++Q0jd5FMABDA:fxLPQf3ZJA
- TLSH T16EB1969DC8C8D842E305E670BEE2C4436685277380FC44997EB94C9EEB559E587423FB
- MD5 SHA1 SHA512 SSDEEP TLSH
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/Zahid Antivirus.exe.deploy
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3d186864481ff521fd45fe6bd9e614287015292fc2ec8a4ce52cd23ced4af966
- MD5 562d47cda3a5cad0ac83f854022c5730
- SHA1 74533754c00d134597b26874bc65e36dbbcbf97c
- SHA512 a2682573c5fcf73bae3b00e876a008adf5bba957d47202858685d167798d2efb7a3ef5055a2e5855d4168006950d8a5231c54ddc4551e9510586e279d0ee1a9f
- SSDEEP 1536:hUsVQdr/1Oh9uvHyqf7Q5fzEejum70983F9oCpCv4bLp3c+7dL6JugTqjddbTS+x:hUsufqzEUTDvFzjTS+pahxFTSiobMoL
- TLSH T1D414E5E1A3549B90D42976F0883154B302F6BD6C9E10E55A3DFC3EAE3D72243CE6662D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
20:fb:18:67:ab:fd:67:63:7a:5c:fa:f8:f6:2f:a8:9b:a0:db:2a:dd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=User-PC\\User
Chains
Oct 26, 2026
CN=User-PC\\User
Subject
CN=User-PC\\User
Serial Number
56:b4:d1:35:02:68:24:86:4d:89:43:03:37:f0:b1:85
Issuer
CN=User-PC\\User
Timespan
Jun 15, 2016 - Jun 15, 2017
Minor OS version
0
Major OS version
4
Entry point
168526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\zahid apps\Zahid Antivirus\Seren Antivirus Plus 2012\Seren Antivirus Plus 2012\obj\Debug\Zahid Antivirus.pdb
mscoree
_CorExeMain
Name
.text
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/Zahid Antivirus.exe.manifest
- SHA256 9d4f53ff816fc926508ef24e240c8e20610084f72fc65c481b4e1c7aee1ced14
- MD5 bd10685765240d34924965c8f1ed8d0d
- SHA1 20cf55c5824258ed0410343e03bc9abdf473876a
- SHA512 20ad68af6bebc8a4b9e6d56bbc94d568bd93841307a1d2912a22399cd87e2e6c20632875dc67904746a0559ae75b993c37b491c6e7421d79aad048e5af2e6783
- SSDEEP 96:0WLwOhoyEZqY3lU1O5tunRlmyyr21ldkcskskkONZR+Q0jmOac+nE4S8+Q0jd5Fy:flYVUc5tunIryl+c55VNZe/pZJA
- TLSH T12A12B64AC8E8E811A302E2E07FF2C9135E95677345EC009DBD9D589DEF4998587833F6
- MD5 SHA1 SHA512 SSDEEP TLSH
zahid antivirus/Application Files/Zahid Antivirus_1_0_0_0/favicon.ico.deploy
- SHA256 680e11ce1f3f6600cfa764caf4baad188efe81f147272a8319fde948b2f6839a
- MD5 d4f7c46d3e2a1d49e81248579931f2fd
- SHA1 d3453870bed57d10a5032be3c7532a996ad4f15f
- SHA512 414f228ee4d1064f10f0ea5d29fb7911eb29ab967636cdd260a8cd740fa4b9610e4c70104b323ee9acd27fb56408baec7abad4181b486b692c49dd69e2beb21f
- SSDEEP 384:5KenOp8mE+GG2GY80yEQHoH8Mr/43h8uKiolhKle:keOaeGrr8Voc8mh8uc
- TLSH T1C50319F1D3218691E4D1A631843F6E779073AE3CFE1860AE238D367B6FB63412866D15
- MD5 SHA1 SHA512 SSDEEP TLSH
zahid antivirus/Zahid Antivirus.application
- SHA256 3aaf1fc621705834d876603302da033d4b040ddb0c637e2e1470784598c9ca70
- MD5 5709bf8da523cefa07f2ac5263c1cbd6
- SHA1 9aceed5ab91cd799642edf39234c735e294b5de2
- SHA512 7d73b0db1e3800347f65aec68247c53af05157e3d3a218fdf7d2a1c0af2e2053aa706b78db3c5529180dcb3900d35a587fc936b1f15317e420224afac89462cc
- SSDEEP 96:0WLwO9ZcRPEciOPkLPj+Q0jmOEtanEOkk++Q0jd5FMABDA:fxLPQf3ZJA
- TLSH T16EB1969DC8C8D842E305E670BEE2C4436685277380FC44997EB94C9EEB559E587423FB
- MD5 SHA1 SHA512 SSDEEP TLSH
zahid antivirus/setup.exe
- IMPHASH 81fd276d49dcfb5944ab1253641f139e
- SHA256 23fc5f9b3d88f30f669adc23f1eb5a08e07099d85e5b030b2fe9da4683cb6479
- MD5 a730d968c1f6685e4c20c58999221824
- SHA1 07bb608b28aece9fab822bc84b6371256359558a
- SHA512 3d82fe1739b8344ff400a88b1d1eb16077d7bcaf02f50143adab4bbd27692b42ce170ef151736e5b2fc42454e6758d02eca23fcecf04a0d68336640bf37f17fd
- SSDEEP 12288:qDPdsil5fCMggBIiMVO26kk+FG8eMb01JQntLOCVrUr:qD1s2ts96kTzemV8
- TLSH T1D2D4D52715EC7C76D0729270AFF393E2A76DFC622421C92E22C5060D467E943B9527BE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
f8:68:68:be:5f:f9:6b:e7:97:ea:cd:09:4a:94:fc:bc:69:38:3a:db
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=User-PC\\User
Chains
Oct 26, 2026
CN=User-PC\\User
Subject
CN=User-PC\\User
Serial Number
56:b4:d1:35:02:68:24:86:4d:89:43:03:37:f0:b1:85
Issuer
CN=User-PC\\User
Timespan
Jun 15, 2016 - Jun 15, 2017
Minor OS version
1
Major OS version
5
Entry point
209090
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
setup.pdb
kernel32
GetNativeSystemInfo
EndUpdateResourceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent
CreateEventW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
GetTempFileNameW
ReadFile
OpenProcess
GetCurrentProcess
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
GetModuleFileNameW
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
CopyFileW
GetDateFormatW
GetTimeFormatW
CompareStringW
WideCharToMultiByte
RaiseException
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
Sleep
HeapSetInformation
SetFilePointer
GetDiskFreeSpaceExW
CreateFileW
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenW
MulDiv
GetTickCount
GetExitCodeProcess
LoadLibraryW
GetTempPathW
SwitchToThread
FindNextFileW
UpdateResourceA
BeginUpdateResourceA
FindResourceA
lstrlenA
DeleteFileA
CreateFileA
UpdateResourceW
BeginUpdateResourceW
GetVersion
GetEnvironmentVariableA
HeapReAlloc
HeapSize
WriteConsoleW
ReadConsoleW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetEndOfFile
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetFileType
FindFirstFileW
FindClose
GetProcAddress
FreeLibrary
WaitForSingleObject
GetLastError
CloseHandle
WriteFile
GetStringTypeW
HeapAlloc
HeapFree
GetACP
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
gdi32
GetStockObject
EnumFontFamiliesExW
DeleteObject
CreateFontIndirectW
GetObjectW
GetTextMetricsW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
DeleteDC
CreateCompatibleDC
ole32
CoUninitialize
CoInitialize
secur32
GetComputerObjectNameW
shell32
ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA
user32
SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadIconW
LoadCursorW
SetClassLongW
ScreenToClient
GetWindowRect
GetClientRect
SetWindowTextW
ShowScrollBar
SetForegroundWindow
EnableWindow
GetFocus
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
CreateDialogIndirectParamW
CreateDialogParamW
MoveWindow
ShowWindow
DestroyWindow
SendMessageW
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
ExitWindowsEx
MessageBoxW
ReleaseDC
GetDC
DrawTextW
GetSystemMetrics
GetDialogBaseUnits
MessageBoxA
SetCursor
MsgWaitForMultipleObjects
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
wininet
InternetCrackUrlW
InternetCombineUrlW
msi
ord8
ord78
ord150
ord92
_DecodePointerInternal@4
_EncodePointerInternal@4
Name
.text
Size
356KB
Virtual Size
355KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=242, version=30703,
count=12, id=241, version=30703,
count=154, id=243, version=30703,
count=20, id=259, version=22823,
count=64, id=260, version=22823,
count=64, id=261, version=22823,
count=23, id=203, version=65501,
count=350, id=1, productName=Unmarked objects,
count=1, id=259, version=23007,
count=31, id=261, version=23007,
count=1, id=256, version=23007,
count=1, id=255, version=23007,
count=1, id=258, version=23007,