HaoZipFormats[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

HaoZipFormats.dll
Size

1.3MB
MD5

b519f72abef252a63f97a9fad7cf409b
SHA1

d99a8b0e68b2c3a5e22cae9522b5d66c7595fdef
SHA256

3907e3cbb788e78a44f5ec198372d685388a2456e759079824282b7413506f9c
SHA512

27f69b31c22fcd19f82a4e556e5d7594c49de5be986af29f7e181e0cd5fd578fbb8e6667a24142345e6f9ce7c5c2daf0e157bde2bfccbb91e15936b813a3bb26
SSDEEP

24576:XzKtnHcRheyPZYX+Bljtv4oYI8Kojg1Yl4jdOxPO/fkawGvZvhVcn8QPyWZ4UEju:5NzgEYwQc+sjjw2p7Y

Score

1^/10

Malware Config

Signatures

Files

HaoZipFormats.dll
.dll windows:4 windows x86 arch:x86

9cf70bd4f677fef073915c3a0447dfb3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c8:ea:98:be:b2:34:d2:78:d6:6f:fb:c1:1f:de:d1:1b:f7:24:0d:15
Signer

Actual PE Digest

c8:ea:98:be:b2:34:d2:78:d6:6f:fb:c1:1f:de:d1:1b:f7:24:0d:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\haozip25\rczip\bin\win32\release\pdb\HaoZipFormats.pdb

Imports

kernel32

GetFullPathNameW
GetLongPathNameW
CreateFileW
SetCurrentDirectoryW
SetFileAttributesW
MoveFileW
RemoveDirectoryW
lstrlenW
GetTempFileNameW
GetTempPathW
SetFileTime
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
GetModuleHandleW
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
Sleep
GetStartupInfoW
CreateProcessW
CreatePipe
GetExitCodeProcess
WaitForSingleObject
TerminateProcess
ReadFile
CreateFileA
WriteFile
GetFileType
SetFilePointer
SetEndOfFile
GetStdHandle
DeleteFileW
FormatMessageW
LocalFree
GetProcAddress
GetDriveTypeA
GetDiskFreeSpaceA
GetFileAttributesA
IsDBCSLeadByte
GetCPInfo
GetCurrentProcess
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
ReadConsoleW
GetConsoleMode
SetConsoleMode
GetModuleFileNameW
FindFirstFileA
FindNextFileA
DeleteCriticalSection
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
CreateEventW
GetFileSize
VirtualAlloc
GetCurrentDirectoryW
GetWindowsDirectoryW
CreateDirectoryW
CloseHandle
GetLastError
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
SetLastError
GetACP
VirtualFree
ResumeThread
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
DosDateTimeToFileTime
FileTimeToDosDateTime
InterlockedExchangeAdd
LoadLibraryW
LoadLibraryExW
FreeLibrary
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection

user32

OemToCharA
CharToOemA
CharLowerA
OemToCharBuffA
OemToCharBuffW
CharUpperA

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

msvcr80

towlower
towupper
_vsnwprintf_s
wcschr
wcslen
strlen
_purecall
memcpy
memset
memcmp
__RTDynamicCast
atoi
memchr
free
strcmp
wcsncpy
wcscpy_s
vsprintf
wcscmp
malloc
wcscpy
strcpy
realloc
strncpy
rename
sprintf
remove
strncmp
toupper
putchar
strchr
strcat
abs
strrchr
strpbrk
wcsrchr
wcscat
wcspbrk
calloc
_CxxThrowException
__CxxFrameHandler3
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_vsnprintf
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
rand
srand
_errno
??_V@YAXPAX@Z
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_invalid_parameter_noinfo
??2@YAPAXI@Z
memcpy_s
??3@YAXPAX@Z
memmove_s
_beginthreadex
_time64

Exports

Exports

CreateArchiveInfoObjects
SetCodePage
SetResFileName
SetWorkDirectory

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cf70bd4f677fef073915c3a0447dfb3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

c8:ea:98:be:b2:34:d2:78:d6:6f:fb:c1:1f:de:d1:1b:f7:24:0d:15Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcr80

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 143KB - Virtual size: 143KB

.data Size: 25KB - Virtual size: 83KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 65KB - Virtual size: 65KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

c8:ea:98:be:b2:34:d2:78:d6:6f:fb:c1:1f:de:d1:1b:f7:24:0d:15
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 143KB - Virtual size: 143KB

.data
Size: 25KB - Virtual size: 83KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 65KB - Virtual size: 65KB