ac7618e42585c9cea1021e601d46aba01d3628fc8c2a6213c1d17cc7dee9f3c1

Sharing

Copy URL Twitter E-mail

General

Target

ac7618e42585c9cea1021e601d46aba01d3628fc8c2a6213c1d17cc7dee9f3c1
Size

260KB
MD5

70a71d9d8b5956ef852693bc4c9e4384
SHA1

a98e038ab07d56f04cdcc2bbc3cee519de85f7da
SHA256

ac7618e42585c9cea1021e601d46aba01d3628fc8c2a6213c1d17cc7dee9f3c1
SHA512

1897c1417c1858784ab7629830346bddef5230a711b634df64fefa6508663adcd9ad48ddfb18873619b51ed63403bbe1fbb532b71ae5dc61642ca3b7ac892375
SSDEEP

3072:EOzYsiLDzZYgx3aIW5VcWMnbpxI08G+sRrAq93MCD+DYnvtVUvx5JaC3Hd+WdFni:FiCcc8Nn/8G+exuYALJaC3pGON1CqU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac7618e42585c9cea1021e601d46aba01d3628fc8c2a6213c1d17cc7dee9f3c1

Files

ac7618e42585c9cea1021e601d46aba01d3628fc8c2a6213c1d17cc7dee9f3c1
.exe windows:5 windows x86 arch:x86

74cac86039f10bc226a4000767046a19

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\zhanlue\haozip\bin\x64\release\pdb\HaoZipAce32Loader.pdb

Imports

kernel32

GetModuleHandleW
WaitForMultipleObjects
GetCurrentDirectoryW
SetCurrentDirectoryW
ExitProcess
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
LoadLibraryExW
FindFirstFileW
GetLongPathNameW
CreateFileW
GetLastError
GetFileAttributesExW
OpenFileMappingW
UnmapViewOfFile
CloseHandle
MapViewOfFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchangeAdd
GetACP
MultiByteToWideChar
WideCharToMultiByte
FindNextFileW
FindClose
LocalFileTimeToFileTime
DosDateTimeToFileTime
WriteFile
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
MoveFileW
HeapFree
GetCurrentThreadId
HeapAlloc
GetProcessHeap
GetCurrentProcess
OpenEventW
SetEvent
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetStdHandle
LCMapStringW
GetStringTypeW
GetFileType
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW

Sections

.text
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

74cac86039f10bc226a4000767046a19

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Sections

.text Size: 122KB - Virtual size: 122KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 2KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 75KB - Virtual size: 76KB

.text
Size: 122KB - Virtual size: 122KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 75KB - Virtual size: 76KB