8d81bf9c1451718fd9ac91900d622665512906f7a445256a484db4268f38a849

Sharing

Copy URL

Twitter E-mail

General

Target

8d81bf9c1451718fd9ac91900d622665512906f7a445256a484db4268f38a849
Size

181KB
MD5

c3f0cccef76e94c267cba15785d0b222
SHA1

e7ef3281f07637ad84e8bb3d2052608179c6c2a4
SHA256

8d81bf9c1451718fd9ac91900d622665512906f7a445256a484db4268f38a849
SHA512

ab93bea155e488224ac14c5cf0652b0968a336f456fc3f6c78060dc4fe029bdf95fcb463bf92321984b599fe7ba28eb64c9c1032267ab08a1242dbdeea50e0e5
SSDEEP

3072:Y6X3wIIGNWtpe5xRFE9VbS7jRl0fdXB7eeOkMOc45dpDISjJJlNO4gH5j2C:Y03TIGNWixRChSRlcdEIdakJTO4kD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d81bf9c1451718fd9ac91900d622665512906f7a445256a484db4268f38a849

Files

8d81bf9c1451718fd9ac91900d622665512906f7a445256a484db4268f38a849
.dll windows:5 windows x86 arch:x86

f57aa8227562544af15a6a4bfc24d95b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\zhanlue\haozip\bin\Win32\release\pdb\HaoZipEditor.pdb

Imports

kernel32

OutputDebugStringW
EncodePointer
HeapAlloc
HeapFree
GetProcessHeap
GetFileAttributesW
SetFilePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
UnhandledExceptionFilter
CreateFileW
FindFirstFileW
LocalFree
FormatMessageW
WideCharToMultiByte
GetACP
LoadLibraryExW
GlobalUnlock
GetTickCount
InterlockedIncrement
GetProfileStringW
FlushInstructionCache
FreeLibrary
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetModuleHandleW
GetCurrentProcessId
GlobalLock
GetProcAddress
FindResourceW
LoadResource
LoadLibraryW
GlobalFree
GlobalAlloc
LockResource
lstrcatW
WritePrivateProfileStructW
GetPrivateProfileStringW
MultiByteToWideChar
GetLocaleInfoW
GetTempPathW
InitializeCriticalSection
GetModuleFileNameW
InterlockedDecrement
GetPrivateProfileIntW
GetCurrentProcess
GetLongPathNameW
GetFullPathNameW
WritePrivateProfileStringW
InterlockedExchange
SizeofResource
GetPrivateProfileStructW
lstrcmpiW
GetFileSize
GetCurrentDirectoryW
GetVersionExW
FindClose
lstrcpynW
WriteFile
ReadFile
lstrcmpW
lstrcpyW
lstrlenW
MulDiv
CloseHandle
SetEvent
IsDebuggerPresent
CreateEventW
GetCurrentThreadId
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
SetLastError
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeSListHead
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime

user32

RemoveMenu
GetDlgItemInt
InsertMenuW
GetWindowDC
SetParent
TranslateAcceleratorW
BringWindowToTop
CharNextW
GetMenuStringW
IsRectEmpty
LoadBitmapW
SetMenu
IsWindowEnabled
DrawFocusRect
SetMenuDefaultItem
GetKeyboardLayout
FrameRect
SwitchToThisWindow
wvsprintfW
SetTimer
OffsetRect
LoadStringW
LoadAcceleratorsW
WindowFromPoint
CreatePopupMenu
MessageBeep
EndDialog
ScreenToClient
DeleteMenu
LoadStringA
IsWindowVisible
GetMenu
CheckMenuRadioItem
GetMessagePos
CharLowerW
GetWindowThreadProcessId
GetCursorPos
GetMenuItemInfoW
ModifyMenuW
LoadMenuW
MonitorFromPoint
GetFocus
GetCaretPos
MessageBoxW
GetMenuItemCount
CallNextHookEx
SetWindowTextW
GetSubMenu
GetActiveWindow
ClientToScreen
SetMenuItemInfoW
UnhookWindowsHookEx
DestroyMenu
GetClassNameW
SetWindowsHookExW
AppendMenuW
TrackPopupMenuEx
GetWindowTextW
SystemParametersInfoW
DeferWindowPos
GetKeyState
PostMessageW
GetWindow
CheckRadioButton
MonitorFromWindow
GetScrollInfo
GetScrollPos
IsWindow
BeginDeferWindowPos
IsDialogMessageW
DestroyIcon
GetScrollRange
GetMonitorInfoW
SetDlgItemTextW
MapWindowPoints
GetDlgItemTextW
IsDlgButtonChecked
LoadIconW
LoadCursorW
EndDeferWindowPos
SetCursor
SetRectEmpty
EnableScrollBar
SetScrollRange
DrawTextW
SetRect
CheckDlgButton
SetScrollPos
RegisterWindowMessageW
UpdateWindow
BeginPaint
EndPaint
EnableWindow
GetWindowLongW
GetMessageW
CreateDialogParamW
DefWindowProcW
GetMessageA
CallWindowProcW
DispatchMessageA
GetWindowRect
DestroyWindow
InflateRect
GetDC
SetWindowPos
FillRect
CreateWindowExW
SendMessageW
GetSystemMetrics
RegisterClassExW
ShowWindow
KillTimer
PostQuitMessage
wsprintfW
EnableMenuItem
GetCapture
DispatchMessageW
CopyRect
PeekMessageW
MsgWaitForMultipleObjectsEx
GetSysColor
MoveWindow
SetDlgItemInt
DialogBoxParamW
DrawFrameControl
PtInRect
SetForegroundWindow
LoadImageW
GetWindowTextLengthW
SetFocus
TranslateMessage
SetCapture
SetWindowLongW
GetClientRect
GetDlgItem
GetSysColorBrush
DrawEdge
GetClassInfoExW
IsWindowUnicode
GetParent
ReleaseCapture
InvalidateRect
ReleaseDC
UnregisterClassW
IsIconic
IsMenu

gdi32

StartDocW
CombineRgn
CreateBitmap
RestoreDC
GetObjectW
SelectClipRgn
SetViewportOrgEx
Rectangle
OffsetWindowOrgEx
TextOutW
CreatePatternBrush
DeleteEnhMetaFile
EndPage
GetEnhMetaFileHeader
CreateRectRgnIndirect
ResetDCW
PlayEnhMetaFile
EnumFontsW
CloseEnhMetaFile
EndDoc
AbortDoc
PatBlt
CreateDIBSection
StartPage
SaveDC
SetBrushOrgEx
CreateDCW
GetTextMetricsW
FrameRgn
CreatePolygonRgn
GetDeviceCaps
LineTo
SetBkMode
CreatePen
MoveToEx
CreateFontIndirectW
FillRgn
DPtoLP
GetBkColor
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
DeleteDC
GetTextExtentPoint32W
SetTextColor
GetTextColor
SetBkColor
DeleteObject
CreateEnhMetaFileW
ExtTextOutW
CreateSolidBrush

winspool.drv

ClosePrinter
GetPrinterW
OpenPrinterW

comdlg32

PageSetupDlgW
GetSaveFileNameW
PrintDlgW
ChooseFontW
ChooseColorW
GetOpenFileNameW

advapi32

RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW

shell32

DragAcceptFiles
DragQueryFileW
DragFinish

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize

oleaut32

OleTranslateColor
VarUI4FromStr

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

comctl32

InitCommonControlsEx
ImageList_AddMasked
ImageList_Draw
ImageList_GetImageCount
ImageList_Create
CreateStatusWindowW
ImageList_Destroy
ImageList_LoadImageW

vcruntime140

_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
__CxxFrameHandler3
wcsstr
_purecall
memcpy
__std_terminate
memmove
memset

api-ms-win-crt-heap-l1-1-0

_recalloc
_callnewh
free
malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_resetstkoflw
_invalid_parameter_noinfo_noreturn
_initterm_e
_invalid_parameter_noinfo
_errno
_initterm
_seh_filter_dll
_beginthreadex
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit

api-ms-win-crt-string-l1-1-0

wcscpy
wcslen
wcsncpy
wcscat_s
wcscpy_s
towupper
strncpy_s
wcsncpy_s
wcscmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vswprintf

api-ms-win-crt-utility-l1-1-0

labs

api-ms-win-crt-math-l1-1-0

_except1

Exports

Exports

HaoZip_CloseEditor
HaoZip_GetFormats
HaoZip_GetReadOnly
HaoZip_GetWindowMode
HaoZip_Initialize
HaoZip_SetCodePage
HaoZip_SetConfigDirectory
HaoZip_SetLogoIcon
HaoZip_SetResFileName
HaoZip_ShowEditor
HaoZip_Uninitialize

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f57aa8227562544af15a6a4bfc24d95b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

msvcp140

comctl32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 131KB - Virtual size: 130KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 7KB - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 131KB - Virtual size: 130KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 7KB - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 9KB - Virtual size: 9KB