zra091jn[.]exe | Triage™

resource
zra091jn.exe

zra091jn.exe

IMPHASH 77445ecd19cfc87f86c56d7fbaabcaf4
SHA256 eddbb7f87f6c3fd788f5aa002bf8ff5bf75cbdef2cced815cd412807a655168d
MD5 74849976a09c3aef5fbdfe6efff4c47a
SHA1 f1365824fd13f9ab78f95d9bc22979a878ae204e
SHA512 cc609c13308aab3f6fbd31610f2db6047b95f6e1dbc1a369aced64917e254ccfbcc860aa8ed6c052aabf7601597e057a249c4331773784e69004fdcc3e2399cd
SSDEEP 1572864:nLECKduP5ROD9uFyWC9rDdwANbC7GBjTSQdiGBR52LlxHT9T:nADdayTrnbCawK2bHT
TLSH
T1D9E733FA79431E2BE8D5887721914EB4243634EA8FF6C03F18D84796EE569D44E3321B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken

comctl32

LoadIconMetric

gdi32

CreateFontIndirectW DeleteObject SelectObject

kernel32

AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateProcessW CreateSymbolicLinkW DeleteCriticalSection DeleteFileW EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetCommandLineW GetCurrentProcess GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetFinalPathNameByHandleW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx K32EnumProcessModules K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryExW LocalFree MulDiv MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RemoveDirectoryW SetConsoleCtrlHandler SetDllDirectoryW SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

msvcrt

fwprintf ___lc_codepage_func ___mb_cur_max_func __argc __iob_func __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _filelengthi64 _fileno _fmode _get_osfhandle _getpid _initterm _onexit _snwprintf _stricmp _wputenv_s _vsnwprintf _wcmdln _wcsdup _wcserror _wcsnicmp _wfopen _wfullpath _wstat64 _wtempnam abort calloc clearerr exit fclose feof ferror fflush fgetpos fprintf fputc fputwc fread free fsetpos fwrite iswctype localeconv malloc mbstowcs memcmp memcpy memset realloc setbuf signal strchr strcmp strcpy strerror strlen strncat strncmp strtoul vfprintf wcscat wcschr wcscmp wcslen wcsncmp _wcsdup _strdup _fileno

user32

CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawTextW EndDialog GetClientRect GetDC GetDialogBaseUnits GetMessageW GetWindowLongPtrW InvalidateRect MessageBoxA MessageBoxW MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageW RegisterClassW ReleaseDC SendMessageW SetWindowLongPtrW ShowWindow ShutdownBlockReasonCreate SystemParametersInfoW TranslateMessage

Name

.text

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

64KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bitcoin.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

camera_dialog.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

commands.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

dnssec.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

main_window.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

run_electrum.pyc

SHA256 ad6563c232e8133d0c12f9c2f31f9bf5958ac9acba190d744b138ea05bb26d8c
MD5 54a8d4f0c035cc8d46cc54315fe8708e
SHA1 8745f57dc3c1e5ed84e3f41d436de58e97122228
SHA512 1a62b390b511108ec54f0afaf893fc697b9a308ff3d94957371ed490ffc048a4f78d4c4d518dfe5b59d5f9eba8c7683b60555a7128ee5757bd6e796bdaefac66
SSDEEP 12288:JYBtxBXXF/AOCPw1XgerfMO3awJf2BScLuQJPaQR50AL:JYBRXiOfrf9/GZJPak
TLSH
T122C422C01F929DF2E95C477422BF2E3C0A756FA05EEDC47E2F984AC704897919E1B909
MD5 SHA1 SHA512 SSDEEP TLSH

simple_config.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

text.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

util.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

wallet.pyc

SHA256 82d3422974d33892eac914dfc1dcdb8467bd95427db78fbbab157cd463ec0724
MD5 cefa14b7395b59ec413a6f54318ca6f1
SHA1 ad2054322bda53209dd9d5fb48c30f4e08658555
SHA512 77599c51250da31cc9abe1c08b1a1e7a8b0c28243ff95fcb043e2a753070e5f2b9b2ac7e737b6431df61af3a07f18e2942b0a7eaaa7b9ba333d583aac2b591f6
TLSH
T17BB02400505340C1C01D5434D431F73C31D1C7455055C40300155007141D3000C534D0
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

zra091jn.exe

advapi32

comctl32

gdi32

kernel32

msvcrt

user32

generic

bitcoin.pyc

camera_dialog.pyc

commands.pyc

dnssec.pyc

main_window.pyc

run_electrum.pyc

simple_config.pyc

text.pyc

util.pyc

wallet.pyc