Deep Malware Analysis of ZOON.exe | md5: 5d1bad8512f72230933f7efb4ee3a4e6 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | PDB Path | .Net | SOS: 0.27 | Fody/Costura Packer | SOS: 0.19 | SOS: 0.23 | RAT | AgentTesla | SOS: 0.49

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	5d1bad8512f72230933f7efb4ee3a4e6
Sha1	9a554d7e2d52b669692f92c70c83a0004d72ee00
Sha256	bca136981286da8824cbaf1c3ada86c3de34fc81efb11d990bf8c0cfde33438a
Sha384	1fa5a5b6ece89d01b8a27705103e61ba44773994344cba652283f942c780abc866ff00044788f0f98344f248c49953c0
Sha512	c9cf518dfb75cd5b26d10e4349d949f062ae3616227536b7366abe1ef017b40db60f62463a3d166db7fcc4e7795d35657aefc40fa188f3c33c5d30c9d38956f2
SSDeep	49152:GAjys7tNQJ/W2n3GZrmUTEDVYWw1atOdTt0w+W7SCz7:RjysHjjSUTmYatOdTB
TLSH	8BA5E126A25D04E5E92B713500D66B8BD177740A2322ABCF73D606482FEE7D075BF34A

PeID

MASM/TASM - sig4 (h)Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 1secondary ignored: 5

bin 4img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:dll>img

Shape pe:exe>pe:dll>img

malicious 3 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: C:\Users\imed4\Desktop\ZOON\ZOON\obj\x64\Release\ZOON.pdb
Module Name	ZOON.exe
Full Name	ZOON.exe
EntryPoint	System.Void ZOON.Program::Main()
Scope Name	ZOON.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	ZOON
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	818
Main Method	System.Void ZOON.Program::Main()
Main IL Instruction Count	6
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void ZOON.Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`