General

  • Target

    highferrum.com_910.zip

  • Size

    36.3MB

  • MD5

    1d8f0072b73f3d1503d8ac7fc59193fa

  • SHA1

    bc4431ecac95bc5947f98b56aca1ac27b0818d40

  • SHA256

    e899483c681f5db3d3d272d753da7abdfc8fdcf5004a705f301585cdfdb92340

  • SHA512

    5f9a2bc04acbb754b4b8d09360e26f23814fe05b032e87ea09f63166a61a8460667445eba27275edc3e8f6fa81578bbce1efc24831eca9318d354d2879ce4243

  • SSDEEP

    786432:XFWnw9xq0tjCBvfYkf/qjWXMm34i6VUAVfUV0YojXz/ZwX:1Wn90tjCtY0Cj7m34vUiUeYojXds

Score
8/10

Malware Config

Signatures

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Unsigned PE 85 IoCs

    Checks for missing Authenticode signature.

Files

  • highferrum.com_910.zip
    .zip
  • CodeEditor.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Configuration/CategoryDir/1.txt
  • Configuration/CategoryDir/10.txt
  • Configuration/CategoryDir/11.txt
  • Configuration/CategoryDir/12.txt
  • Configuration/CategoryDir/13.txt
  • Configuration/CategoryDir/14.txt
  • Configuration/CategoryDir/15.txt
  • Configuration/CategoryDir/16.txt
  • Configuration/CategoryDir/17.txt
  • Configuration/CategoryDir/18.txt
  • Configuration/CategoryDir/19.txt
  • Configuration/CategoryDir/2.txt
  • Configuration/CategoryDir/20.txt
  • Configuration/CategoryDir/21.txt
  • Configuration/CategoryDir/22.txt
  • Configuration/CategoryDir/23.txt
  • Configuration/CategoryDir/24.txt
  • Configuration/CategoryDir/25.txt
  • Configuration/CategoryDir/26.txt
  • Configuration/CategoryDir/27.txt
  • Configuration/CategoryDir/28.txt
  • Configuration/CategoryDir/29.txt
  • Configuration/CategoryDir/3.txt
  • Configuration/CategoryDir/30.txt
  • Configuration/CategoryDir/31.txt
  • Configuration/CategoryDir/32.txt
  • Configuration/CategoryDir/33.txt
  • Configuration/CategoryDir/34.txt
  • Configuration/CategoryDir/4.txt
  • Configuration/CategoryDir/5.txt
  • Configuration/CategoryDir/6.txt
  • Configuration/CategoryDir/7.txt
  • Configuration/CategoryDir/8.txt
  • Configuration/CategoryDir/9.txt
  • Configuration/FileDetect.txt
  • Configuration/Option.xml
  • Configuration/Synonym/常用词库.txt
  • Configuration/config.db3
  • Configuration/httpserver.xml
  • Configuration/proxy.xml
  • Configuration/runlog.db3
  • DatabaseManager.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • FileTemplate/默认csv模版.csv
  • FileTemplate/默认html模版.html
    .html
  • FileTemplate/默认txt模版.txt
  • FileTemplate/默认word模版2007.docx
    .docx office2007
  • HVMRun64.dll
    .dll windows:4 windows x64 arch:x64

    24bf9a199ae32cd3a98859ac8abf9944


    Headers

    Imports

    Exports

    Sections

  • HVMRuntm.dll
    .dll windows:4 windows x86 arch:x86

    acbfd6641075b891a3a3eebd8ed76ba0


    Headers

    Imports

    Exports

    Sections

  • HttpPostGet.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • LocoyProxy.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Module/Pbootcms1.wpm
    .zip
  • module.xml
  • Module/Pbootcms2.wpm
    .zip
  • module.xml
  • RunTime32.dll
    .dll windows:4 windows x86 arch:x86

    cd1917f42ea97c5c799b74e7cf03e684


    Headers

    Imports

    Exports

    Sections

  • RunTime64.dll
    .dll windows:4 windows x64 arch:x64

    f3e70a253febf26e577746ecfe946cd4


    Headers

    Imports

    Exports

    Sections

  • System/AxInterop.SHDocVw.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/ClosedXML.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/Common.Logging.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/DevComponents.DotNetBar.Schedule.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/DevComponents.DotNetBar.SuperGrid.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/DevComponents.DotNetBar2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/DevComponents.Instrumentation.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/Dict/ChsDoubleName1.txt
  • System/Dict/ChsDoubleName2.txt
  • System/Dict/ChsSingleName.txt
  • System/Dict/chinese.pos.dict
  • System/Dict/chinese.unk.dict
  • System/DiffieHellman.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/DocX.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/DocumentFormat.OpenXml.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System/DotRas.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/FiddlerCore4.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System/HtmlAgilityPack.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/ICSharpCode.SharpZipLib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/Interop.SHDocVw.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/Microsoft.Office.Interop.Excel.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System/Microsoft.Office.Interop.Word.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System/Microsoft.Vbe.Interop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System/Microsoft.mshtml.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/MySql.Data.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/NPOI.OOXML.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/NPOI.OpenXml4Net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/NPOI.OpenXmlFormats.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/NPOI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/Nox2App.dll
    .dll windows:4 windows x86 arch:x86

    e4a7c254c1b1f0e6529dae097a512334


    Headers

    Imports

    Exports

    Sections

  • System/Nox2App.x64.dll
    .dll windows:5 windows x64 arch:x64

    c3937df3ef10b8f56823732718e28bc2


    Headers

    Imports

    Exports

    Sections

  • System/Org.Mentalis.Security.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/PHP/Interface.php
  • System/PHP/ext/php_bz2.dll
    .dll windows:5 windows x86 arch:x86

    7b24496d0812cfc9ab3c5b236418a6a7


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_curl.dll
    .dll windows:5 windows x86 arch:x86

    898893ee41f6a91a6378939dbf0e9c47


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_enchant.dll
    .dll windows:5 windows x86 arch:x86

    6c0af7900cae167031bcce8dea86ce12


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_exif.dll
    .dll windows:5 windows x86 arch:x86

    0e8e980b088bbf7ed938a5a1206c7f69


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_fileinfo.dll
    .dll windows:5 windows x86 arch:x86

    6610d44ac9d9587f3afa970ce617a4bf


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_gd2.dll
    .dll windows:5 windows x86 arch:x86

    6299f70b6f35904a6b2e52cd2b7931a2


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_gettext.dll
    .dll windows:5 windows x86 arch:x86

    cda3e86c163305518cd1def8ffef51e8


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_gmp.dll
    .dll windows:5 windows x86 arch:x86

    4a12c7c56964dc8b50df9c8211aabbd4


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_imap.dll
    .dll windows:5 windows x86 arch:x86

    bf7163a5d872a5a6d71af71fdd5d829c


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_interbase.dll
    .dll windows:5 windows x86 arch:x86

    3f22d2cd4751fb0ab3f25f83576d3e14


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_intl.dll
    .dll windows:5 windows x86 arch:x86

    cd5157533d1c61478d766c59ab2b5a7e


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_ldap.dll
    .dll windows:5 windows x86 arch:x86

    4442ed5ad8fd3630e3ba863f83cf00e6


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_mbstring.dll
    .dll windows:5 windows x86 arch:x86

    acd17d15a247b32b7982a6008674eb86


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_mysql.dll
    .dll windows:5 windows x86 arch:x86

    796fa13925950b8efd581762c48f8618


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_mysqli.dll
    .dll windows:5 windows x86 arch:x86

    679ca4e897a905ae02b243e0ea86de78


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_oci8.dll
    .dll windows:5 windows x86 arch:x86

    9744961a973527ce493e899b892fe1a5


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_oci8_11g.dll
    .dll windows:5 windows x86 arch:x86

    0e60c42c23e89b9c663e911536ae2686


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_openssl.dll
    .dll windows:5 windows x86 arch:x86

    5dccc87a63cbd2db0399f32da8c4eabc


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_pdo_firebird.dll
    .dll windows:5 windows x86 arch:x86

    90b9647afb6e6773578d8bfe3af47088


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_pdo_mysql.dll
    .dll windows:5 windows x86 arch:x86

    d187e0b6a3c1da12c83e3fa7ccb08661


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_pdo_oci.dll
    .dll windows:5 windows x86 arch:x86

    87ff34128f8bd2cd8f5dd81d0d7b45d2


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_pdo_odbc.dll
    .dll windows:5 windows x86 arch:x86

    5f204270922f591974953efbca9b816c


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_pdo_pgsql.dll
    .dll windows:5 windows x86 arch:x86

    bdd103a7139deac7a416ba981c82da90


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_pdo_sqlite.dll
    .dll windows:5 windows x86 arch:x86

    9374b1d720b9a276a03a9ab8e3c92d55


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_pgsql.dll
    .dll windows:5 windows x86 arch:x86

    5a64d6e51e28fd8cda572b776edb9d3b


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_shmop.dll
    .dll windows:5 windows x86 arch:x86

    7269207514630924bda0fe656bf62d21


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_snmp.dll
    .dll windows:5 windows x86 arch:x86

    dc274f64bc87bc048b5f1ee04b45c73a


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_soap.dll
    .dll windows:5 windows x86 arch:x86

    d40def18055fea4b5bf2043d0d61ad5f


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_sockets.dll
    .dll windows:5 windows x86 arch:x86

    ef7e5bd93d2a93460cdd8f607f79d4ba


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_sqlite.dll
    .dll windows:5 windows x86 arch:x86

    bab074ef467071a79c51a1fae42f4a0e


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_sqlite3.dll
    .dll windows:5 windows x86 arch:x86

    aefc110a9f58315a361b69b5662578e7


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_sybase_ct.dll
    .dll windows:5 windows x86 arch:x86

    f9f65a7e0d9e35bf7466f9ad6896378b


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_tidy.dll
    .dll windows:5 windows x86 arch:x86

    34a1238930832cf07249ccc6c33a5126


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_xmlrpc.dll
    .dll windows:5 windows x86 arch:x86

    8f9dcc5f30d5771303eff5b951191575


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ext/php_xsl.dll
    .dll windows:5 windows x86 arch:x86

    c509801ca8fc748eb00e26b0def810d0


    Headers

    Imports

    Exports

    Sections

  • System/PHP/libeay32.dll
    .dll windows:5 windows x86 arch:x86

    73e7b4eafaf30559b752534f53103bd4


    Headers

    Imports

    Exports

    Sections

  • System/PHP/php.exe
    .exe windows:5 windows x86 arch:x86

    d19229025d485a63427a363aaba24f83


    Headers

    Imports

    Sections

  • System/PHP/php.ini
  • System/PHP/php5.dll
    .dll windows:5 windows x86 arch:x86

    0036f40b66345fd6292a7df36acf48e2


    Headers

    Imports

    Exports

    Sections

  • System/PHP/ssleay32.dll
    .dll windows:5 windows x86 arch:x86

    22ac2ca8e237d62babc3f902eb50d28d


    Headers

    Imports

    Exports

    Sections

  • System/Quartz.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/SharpSSH.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/SpiderInterface.XML
    .xml
  • System/SpiderInterface.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/SysData/4177048067575ca1e011faf.log
  • System/System.Data.SQLite.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/Tamir.SharpSSH.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/WinHtmlEditor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/complete.wav
  • System/editor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/log.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/log4net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/msoffice.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/office.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System/schemes.xml
    .xml
  • System/webbrowser.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System/x64/SQLite.Interop.dll
    .dll windows:5 windows x64 arch:x64

    bbc9151d0b0b2eccc2d963459fa624c6


    Headers

    Imports

    Exports

    Sections

  • System/x86/SQLite.Interop.dll
    .dll windows:5 windows x86 arch:x86

    2127788792d47434f1ad96fe4d02d5c6


    Headers

    Imports

    Exports

    Sections

  • WebPostManager.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 高铁采集器9.8全功能版.exe
    .exe windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections