3a5444b13adebba987d703b8bb2a9c8f13585374506ec621d458f233762e2ce7
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Mar-15 07:29:23 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\jenkins\workspace\zoomci\Windows\release\Bin\Release\NewZoomWebLauncher.pdb
|
| Comments | Zoom Opener |
| CompanyName | Zoom Video Communications, Inc. |
| FileDescription | Zoom Opener |
| FileVersion | 5,6,0,526 |
| InternalName | Zoom Opener |
| LegalCopyright | © Zoom Video Communications, Inc. All rights reserved. |
| LegalTrademarks | Zoom Opener |
| OriginalFilename | Zoom Opener |
| ProductName | Zoom Opener |
| ProductVersion | 5,6,0,526 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Zoom Video Communications
Issuer: DigiCert EV Code Signing CA (SHA2) |
| Safe | VirusTotal score: 0/68 (Scanned on 2021-03-31 21:54:51) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2021-Mar-15 07:29:23 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x10000 |
| SizeOfInitializedData | 0xb200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00007920 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x11000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1d000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x2d822 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
.reloc
Imports
| CRYPT32.dll |
CryptDecodeObjectEx
CryptStringToBinaryA CryptImportPublicKeyInfo CertGetNameStringA |
|---|---|
| WINTRUST.dll |
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrust |
| SHLWAPI.dll |
PathIsRelativeA
StrCmpNIA #155 StrStrA PathAppendA |
| KERNEL32.dll |
GetLastError
GetFileAttributesA CreateFileA LoadLibraryA HeapAlloc VerSetConditionMask GetProcessHeap RaiseException LocalFree GetModuleFileNameA FindFirstFileA SetLastError FindClose CreateMutexA WaitForSingleObject GetCurrentThreadId Sleep GetTempPathA CopyFileA OpenMutexA MoveFileExA DeleteFileA FreeLibrary CreateProcessA GetTempFileNameA FileTimeToSystemTime GetSystemTime GetFileTime ExpandEnvironmentStringsA CreateDirectoryA SetUnhandledExceptionFilter GetTickCount ExitProcess HeapLock HeapWalk HeapUnlock ReleaseSemaphore CreateSemaphoreA GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitThread TerminateThread CreateThread DeleteCriticalSection CompareFileTime WriteFile SetFilePointer SetEndOfFile SystemTimeToFileTime FlushFileBuffers ReleaseMutex GetLocalTime GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery IsDebuggerPresent UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent TlsGetValue TlsSetValue GetSystemTimeAsFileTime LoadLibraryExW LCMapStringW WideCharToMultiByte IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetModuleHandleW GetModuleHandleExW QueryPerformanceCounter RtlUnwind LoadLibraryExA HeapFree VerifyVersionInfoA GetProcessTimes GetCurrentProcessId GetProcAddress GetWindowsDirectoryA CloseHandle Process32Next MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetModuleHandleA QueryDosDeviceA K32GetProcessImageFileNameA GetCurrentProcess Process32First GetVersion |
| USER32.dll |
LoadStringA
IsIconic SetForegroundWindow RegisterClassExA LoadIconA SetFocus GetForegroundWindow AttachThreadInput FrameRect GetWindowLongA MapWindowPoints DrawTextA GetSystemMetrics SetActiveWindow SetWindowPos InflateRect LoadCursorA SetPropA GetClassInfoA GetWindowRect GetClientRect UpdateWindow InvalidateRect BeginPaint EndPaint PostThreadMessageA GetMessageA DispatchMessageA SetTimer TranslateMessage PeekMessageA KillTimer SendMessageA PostQuitMessage PostMessageA GetWindowThreadProcessId FindWindowA DestroyWindow RegisterClassA UnregisterClassA IsWindowVisible FillRect IntersectRect GetDesktopWindow ShowWindow IsWindow SetWindowLongA MoveWindow ShowWindowAsync GetPropA DefWindowProcA CreateWindowExA |
| GDI32.dll |
DeleteObject
SelectObject GetStockObject SetTextColor SetBkMode CreateFontIndirectA GetObjectA CreateSolidBrush |
| ADVAPI32.dll |
CryptVerifySignatureA
CryptHashData CryptDestroyHash CryptReleaseContext AllocateAndInitializeSid FreeSid CheckTokenMembership RegCloseKey RegQueryValueExA RegOpenKeyExA GetUserNameA CryptDestroyKey CryptCreateHash CryptAcquireContextA OpenProcessToken DuplicateTokenEx |
| SHELL32.dll |
SHGetFolderPathA
ShellExecuteA |
| ole32.dll |
CoUninitialize
CoInitialize CoCreateInstance |
| OLEAUT32.dll |
SysAllocStringLen
SysFreeString VariantClear VariantInit SysAllocString |
Delayed Imports
1
2
7
32
33
2 (#2)
1 (#2)
String Table contents
| zlaunchermain |
| Retry |
| Please contact Zoom Support for help. |
| An unknown error has occurred |
| Join from browser |
| Installing Zoom... |
| Please do not close this window |
| Network Connection failed |
| Please check your network and try again. |
| Yes |
| No |
| Are you sure you want to close this window? Installation will be canceled. |
| Your disk is full |
| Free up storage and try again |
| zlauncheraskleave |
| Get support |
| Installing Zoom requires TLS 1.1&&1.2 |
| Open Internet Options > Advanced to enable. Then click Retry to continue. |
| Open Internet Options |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 5.6.0.526 |
| ProductVersion | 5.6.0.526 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| Comments | Zoom Opener |
| CompanyName | Zoom Video Communications, Inc. |
| FileDescription | Zoom Opener |
| FileVersion (#2) | 5,6,0,526 |
| InternalName | Zoom Opener |
| LegalCopyright | © Zoom Video Communications, Inc. All rights reserved. |
| LegalTrademarks | Zoom Opener |
| OriginalFilename | Zoom Opener |
| ProductName | Zoom Opener |
| ProductVersion (#2) | 5,6,0,526 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-15 07:29:23 |
| Version | 0.0 |
| SizeofData | 103 |
| AddressOfRawData | 0x1684c |
| PointerToRawData | 0x15c4c |
| Referenced File | C:\jenkins\workspace\zoomci\Windows\release\Bin\Release\NewZoomWebLauncher.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-15 07:29:23 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x168b4 |
| PointerToRawData | 0x15cb4 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-15 07:29:23 |
| Version | 0.0 |
| SizeofData | 528 |
| AddressOfRawData | 0x168c8 |
| PointerToRawData | 0x15cc8 |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-15 07:29:23 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
Load Configuration
| Size | 0xbc |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x418654 |
| SEHandlerTable | 0x416840 |
| SEHandlerCount | 3 |
| GuardCFCheckFunctionPointer | 4264756 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
RICH Header
| XOR Key | 0x427935fd |
|---|---|
| Unmarked objects | 0 |
| 262 (26715) | 1 |
| Imports (26715) | 23 |
| Total imports | 224 |
| C++ objects (VS 2015/2017/2019 runtime 29118) | 9 |
| C objects (VS 2015/2017/2019 runtime 29118) | 12 |
| ASM objects (VS 2015/2017/2019 runtime 29118) | 10 |
| C++ objects (26715) | 69 |
| C objects (26715) | 2 |
| 265 (VS2019 Update 8 (16.8.4) compiler 29336) | 33 |
| Resource objects (VS2019 Update 8 (16.8.4) compiler 29336) | 1 |
| Linker (VS2019 Update 8 (16.8.4) compiler 29336) | 1 |
Errors
Leave a comment
No comments yet.