zenith-tweaker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
zenith-tweaker.exe
Size 10.2MB
Sample261110-rm1rfabs7s
SHA256 5c782ae4013ef66abab451505c548560f54efbd4da80e9f7412bf35af2e4192c
MD5 7dc13e1676b3323463ecc0670334c8f7
SHA1 541ac220e8da9ca4e92d84edead6bf4d336417cc
SHA512 73862778fd49c3b404ce91af45cb6feab31f5315c5814028b90b71651e41570553a4cdb5fd16eb5449cffa38367e0c4723c56952294b1cb3bf397e365af3b3f7
SSDEEP 98304:Puqku2IuZNmeYapd4lsk79FdBt8sro2f2+NA6VVLzebjNm+Ej9I:GLKfCs8jshOEX
TLSH
T1B5B67C02B79B99ECD15AC8B0834696735E2174CB0B26B9FF02C455393F6ABE05F2C719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zenith-tweaker.exe

File Explorer

zenith-tweaker.exe

.exe 10.2MB

zenith-tweaker.exe

IMPHASH e4ffb250427d1cb8dec28d6db59d24f3
SHA256 5c782ae4013ef66abab451505c548560f54efbd4da80e9f7412bf35af2e4192c
MD5 7dc13e1676b3323463ecc0670334c8f7
SHA1 541ac220e8da9ca4e92d84edead6bf4d336417cc
SHA512 73862778fd49c3b404ce91af45cb6feab31f5315c5814028b90b71651e41570553a4cdb5fd16eb5449cffa38367e0c4723c56952294b1cb3bf397e365af3b3f7
SSDEEP 98304:Puqku2IuZNmeYapd4lsk79FdBt8sro2f2+NA6VVLzebjNm+Ej9I:GLKfCs8jshOEX
TLSH
T1B5B67C02B79B99ECD15AC8B0834696735E2174CB0B26B9FF02C455393F6ABE05F2C719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6658876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zenith_tweaker.pdb

user32

ClipCursor GetClipCursor AdjustWindowRectEx GetWindowLongW SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow RegisterWindowMessageA SystemParametersInfoA ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetClassInfoExW GetClassNameW FlashWindowEx GetClipboardData IsClipboardFormatAvailable SetClipboardData EmptyClipboard GetForegroundWindow SetWindowTextW SetCursorPos GetWindowTextW GetWindowTextLengthW DestroyIcon CreateIcon RegisterRawInputDevices GetWindowRect ClientToScreen GetActiveWindow ValidateRect GetRawInputData SetWindowDisplayAffinity IsProcessDPIAware ShowCursor GetKeyboardState RegisterTouchWindow SendMessageW GetKeyState InvalidateRgn SetWindowPlacement ChangeDisplaySettingsExW DispatchMessageW TranslateMessage KillTimer SetTimer PeekMessageW GetMessageW CreateIconFromResourceEx MonitorFromPoint SetForegroundWindow SendInput MapVirtualKeyW CreateWindowExW RegisterClassExW DefWindowProcW SetCursor LoadCursorW SetWindowPos MonitorFromWindow GetCursorPos CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent ReleaseCapture SetCapture RegisterClassW EnumWindows OpenClipboard CloseClipboard ReleaseDC UpdateLayeredWindow GetWindowThreadProcessId IsWindowVisible GetAsyncKeyState GetSystemMetrics GetClientRect GetWindowLongPtrW GetDC GetWindowPlacement PostMessageW IsIconic EnumDisplayMonitors GetMonitorInfoW RedrawWindow GetMenu ScreenToClient DestroyWindow SetWindowLongPtrW MonitorFromRect

gdi32

CreateRectRgn DeleteObject SwapBuffers CreateCompatibleDC CreateDIBSection SelectObject GetDeviceCaps DeleteDC DescribePixelFormat ChoosePixelFormat SetPixelFormat

kernel32

FindVolumeClose FindNextVolumeW FindFirstVolumeW DeviceIoControl GetDiskFreeSpaceExW GetVolumePathNamesForVolumeNameW GetVolumeInformationW GetDriveTypeW FindNextFileW SetWaitableTimer CreateWaitableTimerExW MoveFileExW GetFinalPathNameByHandleW TerminateProcess GetTempPathW GetExitCodeProcess WaitForMultipleObjects DuplicateHandle GetModuleFileNameW GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal ReadFile GetOverlappedResult GetCommandLineW CreateEventW ExitProcess CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime CreateFileW FindClose FindFirstFileExW GetFullPathNameW SetFileInformationByHandle SetThreadStackGuarantee SetHandleInformation QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx SleepEx GetEnvironmentVariableW HeapAlloc FlsFree FlsSetValue IsThreadAFiber GetModuleHandleExW FlsAlloc WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle FormatMessageW GetModuleHandleW GetCurrentDirectoryW SetLastError RtlVirtualUnwind ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess LoadLibraryA WaitForSingleObjectEx AddVectoredExceptionHandler CopyFileExW GetLogicalProcessorInformationEx GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent CancelIo DeleteFileW GetProcessHeap HeapFree CloseHandle GlobalMemoryStatusEx GetLastError K32GetPerformanceInfo GetComputerNameExW GetTickCount64 CreateThread SwitchToThread HeapReAlloc GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear GetCurrentThread lstrlenW GetProcAddress WaitForSingleObject GetCurrentThreadId SetFilePointerEx MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock GlobalFree GlobalSize WideCharToMultiByte FreeLibrary SetThreadErrorMode LoadLibraryExW LoadLibraryW Sleep GetModuleHandleA GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmExtendFrameIntoClientArea

shell32

DragQueryFileW SHGetKnownFolderPath DragFinish SHEmptyRecycleBinW

shlwapi

AssocQueryStringW

ole32

OleInitialize RegisterDragDrop CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree RevokeDragDrop

ntdll

NtReadFile NtWriteFile NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

RegDeleteValueW ImpersonateAnonymousToken RevertToSelf SystemFunction036 RegOpenKeyExW RegQueryValueExW RegEnumValueW RegSetValueExW RegCreateKeyExW RegCloseKey

opengl32

wglGetCurrentContext wglMakeCurrent wglGetCurrentDC wglGetProcAddress wglDeleteContext wglShareLists wglCreateContext

imm32

ImmGetCompositionStringW ImmSetCandidateWindow ImmAssociateContextEx ImmSetCompositionWindow ImmGetContext ImmReleaseContext

ws2_32

listen WSAGetLastError closesocket getsockname WSASocketW getsockopt WSAStartup setsockopt WSADuplicateSocketW connect WSASend send getaddrinfo freeaddrinfo getpeername WSARecv recv ioctlsocket select accept bind

oleaut32

GetErrorInfo

pdh

PdhRemoveCounter PdhOpenQueryA PdhGetFormattedCounterValue PdhCloseQuery PdhAddEnglishCounterW PdhCollectQueryData

powrprof

CallNtPowerInformation

uxtheme

SetWindowTheme

vcruntime140

_CxxThrowException __C_specific_handler memmove memset memcmp __CxxFrameHandler3 memcpy __current_exception_context __current_exception

api-ms-win-crt-math-l1-1-0

floorf _hypot roundf powf sinf ceilf truncf floor trunc round expf _hypotf cosf atan2f sin cos __setusermatherr fmod log10 ceil tan pow fmodf atan2 acos cbrtf acosf exp2f

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _crt_atexit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free