6f175f4337e7a48d2a44c72f106b43b7fb96a4699bec13d70f12b0e5e7fd9231

Sharing

Copy URL Twitter E-mail

General

Target

6f175f4337e7a48d2a44c72f106b43b7fb96a4699bec13d70f12b0e5e7fd9231
Size

167KB
MD5

8f46395f68c22c77555d36eb0289c35a
SHA1

a45058ca890be9989f51e6d75c3c8cdca2f650f6
SHA256

6f175f4337e7a48d2a44c72f106b43b7fb96a4699bec13d70f12b0e5e7fd9231
SHA512

02360334cf9949ca5c92917800729d534d0bfb785c3344c265ae593235d39f695d2be6a687006447019db82fce02799812b11c42ddaa819ab662d7cea81be82b
SSDEEP

3072:5xNVmwdeWpOfu/RWmTwvzz/8znpk2+FwaJSTrB:+wKmwvng+5U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f175f4337e7a48d2a44c72f106b43b7fb96a4699bec13d70f12b0e5e7fd9231

Files

6f175f4337e7a48d2a44c72f106b43b7fb96a4699bec13d70f12b0e5e7fd9231
.exe windows:5 windows x64 arch:x64

c7181029e82d3a4bf81a21a3b3901555

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\zhanlue\haozip\bin\x64\release\pdb\HaoZipReplace.pdb

Imports

kernel32

LoadLibraryW
GetProcAddress
FreeLibrary
GetFileAttributesW
GetModuleHandleW
GetVersionExW
CreateFileW
GetFileAttributesExW
HeapFree
GetCurrentThreadId
OpenProcess
HeapAlloc
LocalFree
GetProcessHeap
lstrcmpiW
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetEnvironmentVariableW
LoadLibraryA
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
CreateDirectoryW
GetFullPathNameW
lstrlenW
CloseHandle
DeleteFileW
GetCurrentDirectoryW
GetCurrentProcess
lstrcatW
lstrcpyW
GetFileSizeEx
GetCurrentProcessId
CreateMutexW
ReleaseMutex
FormatMessageW
RtlVirtualUnwind
GetLastError
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetPrivateProfileStringW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsW

user32

LoadIconW
GetDesktopWindow

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation

ole32

CoTaskMemFree

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_exception_destroy
__std_exception_copy
memset
_purecall
wcsstr
_CxxThrowException
wcschr
__C_specific_handler
__std_terminate
memcpy
memmove
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

terminate
_crt_atexit
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_register_onexit_function
exit
_get_wide_winmain_command_line
_set_app_type
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initterm_e
_invalid_parameter_noinfo_noreturn
_exit
_initterm

api-ms-win-crt-string-l1-1-0

towupper
_wcsicmp
towlower
_stricmp
wcsncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
free

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7181029e82d3a4bf81a21a3b3901555

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 32KB - Virtual size: 36KB

.reloc Size: 512B - Virtual size: 220B

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 32KB - Virtual size: 36KB

.reloc
Size: 512B - Virtual size: 220B