HaoZip[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

HaoZip.dll
Size

2.9MB
MD5

c9a6ccf44b40885cbc720f7afa191a64
SHA1

9245ae7beb2a4098a3feaec9635135c872e5efc3
SHA256

46107d0b7d62ea48861f54012cdb7bc149cb837d1e4cfe2a7ea3fa0c0f79e33b
SHA512

f1f87556af07a01fa9bb8b566ba93baacd9c02e598132d85d687b006e067d5642d530a0903ab408511ffc35a49c560b87208a647f0677bb79763c9929d77138c
SSDEEP

49152:dod1dV66Vak8/swWRbV+/L6AVlRpqZICdXlFGnRf0bdEK9ceEc4aJYDoO64wEwwX:dodV66Vak8/swWRbV+/L6AVlRpqjXlFI

Score

1^/10

Malware Config

Signatures

Files

HaoZip.dll
.dll windows:4 windows x86 arch:x86

b42a4fdc510c41e75be3021c6f6e9b58

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:32:8f:34:20:b5:6b:f5:ba:72:74:13:bd:db:c9:f1:ca:a0:f2:4c
Signer

Actual PE Digest

32:32:8f:34:20:b5:6b:f5:ba:72:74:13:bd:db:c9:f1:ca:a0:f2:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\haozip25\rczip\bin\win32\release\pdb\HaoZip.Dll.pdb

Imports

gdiplus

GdipGetImageThumbnail
GdipGraphicsClear
GdipLoadImageFromFile
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipLoadImageFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipAlloc
GdipFree
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipCreateBitmapFromFile
GdiplusStartup
GdipCreateFromHDC
GdipCreateBitmapFromGdiDib
GdipGetImageWidth
GdipDisposeImage

wininet

InternetWriteFile
HttpEndRequestW
InternetOpenW
InternetCrackUrlW
InternetOpenUrlW
InternetCloseHandle
HttpSendRequestExW
HttpAddRequestHeadersW
InternetConnectW
HttpSendRequestW
HttpQueryInfoW
HttpOpenRequestW
InternetReadFile
InternetSetOptionW

kernel32

SetFileAttributesW
GetCurrentProcessId
GetACP
WideCharToMultiByte
InterlockedExchangeAdd
DosDateTimeToFileTime
GetSystemTime
SystemTimeToFileTime
FileTimeToDosDateTime
ReleaseMutex
CreateMutexW
SetFilePointer
GetFileSize
RemoveDirectoryW
CreateDirectoryW
SetFileTime
SetEndOfFile
FormatMessageW
LocalFree
GetFileTime
ResumeThread
SwitchToThread
ResetEvent
SetCurrentDirectoryW
GetWindowsDirectoryW
GetSystemDirectoryW
GetFullPathNameW
GetCurrentDirectoryW
GetLongPathNameW
GetTempFileNameW
SearchPathW
GetTempPathW
WinExec
OpenSemaphoreW
GetPrivateProfileStringW
WritePrivateProfileStringW
SetThreadPriority
OpenThread
TerminateProcess
LocalAlloc
FileTimeToLocalFileTime
FreeResource
GlobalSize
GetVolumeInformationW
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetComputerNameW
FindFirstFileW
FindClose
FindNextFileW
CreateSemaphoreW
SetEvent
ReleaseSemaphore
CreateEventW
WaitForMultipleObjects
WaitForSingleObject
CopyFileW
SystemTimeToTzSpecificLocalTime
MoveFileW
lstrcpyW
lstrlenA
MoveFileExW
GetDriveTypeW
GetFileAttributesW
LockResource
GlobalFree
OpenProcess
GlobalMemoryStatus
GetSystemInfo
GetProcessTimes
GetLocalTime
GetCurrentThread
DeviceIoControl
SetPriorityClass
FindFirstChangeNotificationW
FindCloseChangeNotification
GetOverlappedResult
ReadDirectoryChangesW
GetLogicalDriveStringsW
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
CompareFileTime
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
CreateProcessW
CreatePipe
GetStartupInfoW
GetExitCodeProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetThreadLocale
GetLocaleInfoA
GetVersionExA
InterlockedCompareExchange
DeleteFileW
UpdateResourceW
ExpandEnvironmentStringsW
GetSystemDefaultLangID
ReadFile
WriteFile
EndUpdateResourceW
GetCPInfoExW
EnumSystemCodePagesW
FindResourceExW
EnumResourceTypesW
EnumResourceNamesW
GetStdHandle
FileTimeToSystemTime
GetVersionExW
GetProcAddress
LoadLibraryW
CompareStringW
CloseHandle
CreateFileW
Sleep
GetCommandLineW
GlobalAlloc
GlobalUnlock
SetErrorMode
GetCurrentProcess
lstrcmpW
FlushInstructionCache
MulDiv
GetTickCount
InterlockedExchange
SetLastError
GlobalLock
InterlockedIncrement
LoadResource
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
InterlockedDecrement
LeaveCriticalSection
FreeLibrary
EnterCriticalSection
LoadLibraryExW
GetModuleFileNameW
SizeofResource
FindResourceW
RaiseException
GetCurrentThreadId
GetLastError
GetModuleHandleW
lstrlenW
lstrcmpiW
ExpandEnvironmentStringsA
EnumResourceLanguagesW
BeginUpdateResourceW

user32

RegisterClipboardFormatW
LoadBitmapW
SetWindowRgn
SetWindowPlacement
CreateIconIndirect
IsClipboardFormatAvailable
SetRectEmpty
UpdateWindow
SwitchToThisWindow
IsWindowUnicode
GetCursorPos
DispatchMessageA
MsgWaitForMultipleObjects
PtInRect
GetMessageA
GetMenuState
GetCapture
DrawTextExW
CheckMenuRadioItem
EnableMenuItem
CreateMenu
GetForegroundWindow
EnumWindows
LoadImageW
LoadMenuW
LoadAcceleratorsW
PostThreadMessageW
GetWindowThreadProcessId
PostQuitMessage
MonitorFromPoint
DeleteMenu
GetMonitorInfoW
TrackPopupMenu
IsMenu
AppendMenuW
LoadIconW
ShowScrollBar
SetTimer
KillTimer
DestroyMenu
CreatePopupMenu
GetMenuItemInfoW
GetMenuItemCount
TrackPopupMenuEx
OffsetRect
DrawFocusRect
DestroyIcon
DrawStateW
GetSubMenu
DrawFrameControl
InsertMenuItemW
DrawIconEx
GetSystemMetrics
InflateRect
GetPropW
GetClassLongW
SetPropW
DrawTextW
MessageBeep
SendDlgItemMessageW
GetDlgItemInt
SetDlgItemInt
GetMessageW
EndDialog
SetRect
GetSystemMenu
SetActiveWindow
GetKeyState
IsDialogMessageW
IsWindowEnabled
IsWindowVisible
wsprintfW
RemovePropW
GetSysColorBrush
CopyRect
GetWindowDC
WindowFromPoint
IsZoomed
SetDlgItemTextW
SetScrollPos
GetScrollRange
GetScrollPos
GetIconInfo
AdjustWindowRectEx
DrawEdge
GetMenu
CharNextW
DefWindowProcW
GetDC
RegisterWindowMessageW
SetWindowPos
ReleaseDC
GetWindowLongW
GetClassNameW
InvalidateRect
IsChild
SetCursor
FillRect
IsIconic
SetForegroundWindow
BringWindowToTop
GetWindowRect
MapWindowPoints
EnableWindow
GetDlgCtrlID
FindWindowExW
SystemParametersInfoW
GetActiveWindow
MessageBoxW
LoadStringW
DialogBoxParamW
ShowWindow
PeekMessageW
CreateDialogParamW
DispatchMessageW
TranslateMessage
DestroyAcceleratorTable
SetFocus
RegisterClassExW
EndPaint
GetWindowTextLengthW
BeginPaint
MoveWindow
GetFocus
ScreenToClient
RedrawWindow
SetWindowTextW
CreateWindowExW
InvalidateRgn
SendMessageW
PostMessageW
SetWindowLongW
ClientToScreen
GetWindow
GetWindowTextW
DestroyWindow
CallWindowProcW
LoadCursorW
GetClassInfoExW
GetDlgItem
UnregisterClassA
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetClipboardData
ExitWindowsEx
LoadStringA
RemoveMenu
CheckRadioButton
SendMessageTimeoutW
CheckDlgButton
GetTopWindow
DrawIcon
GetMenuDefaultItem
SetScrollRange
SetMenuItemInfoW
CopyIcon
SetScrollInfo
CheckMenuItem
GetScrollInfo
ScrollWindowEx
SetLayeredWindowAttributes
ShowCursor
IsWindow
GetClientRect
GetDesktopWindow
SetCapture
ReleaseCapture
GetParent
CreateAcceleratorTableW
GetSysColor

gdi32

SetStretchBltMode
CreateRectRgnIndirect
CreateRectRgn
SetViewportOrgEx
CreatePolygonRgn
GetTextExtentPoint32W
StretchBlt
GetTextMetricsW
SetBkMode
SetTextColor
CreateFontIndirectW
SetBkColor
ExtTextOutW
CreateCompatibleDC
GetObjectW
CreateSolidBrush
AngleArc
SetDCPenColor
CreateCompatibleBitmap
GetStockObject
SelectObject
BitBlt
GetDeviceCaps
GetPixel
GetDIBits
CreateDIBSection
SetPixel
GetBkMode
CreatePen
MoveToEx
GetCurrentObject
LineTo
FillPath
TextOutW
EndPath
PathToRegion
BeginPath
GetBkColor
DeleteObject
CombineRgn
DeleteDC

comdlg32

ChooseFontW
GetSaveFileNameW
GetOpenFileNameW

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
GetUserNameW
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueW
RegEnumKeyW
RegOpenCurrentUser
RegQueryInfoKeyW

shell32

DragAcceptFiles
Shell_NotifyIconW
SHBindToParent
SHGetSpecialFolderPathW
ord644
ord74
ord2
ord4
ShellExecuteW
DragQueryFileW
DragFinish
SHGetFileInfoW
ord28
SHGetPathFromIDListW
ShellExecuteExW
SHGetDesktopFolder
SHGetFolderLocation
SHGetMalloc
SHGetSpecialFolderLocation
SHChangeNotify
SHFileOperationW
ord645
FindExecutableW

ole32

OleRun
OleDuplicateData
ReleaseStgMedium
RegisterDragDrop
RevokeDragDrop
DoDragDrop
CoInitialize
CoUninitialize
OleUninitialize
OleInitialize
CLSIDFromProgID
CreateStreamOnHGlobal
CoCreateGuid
CLSIDFromString
OleLockRunning
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoGetClassObject

oleaut32

SysStringLen
VarUI4FromStr
VariantInit
SysAllocStringLen
LoadRegTypeLi
GetErrorInfo
SysFreeString
OleCreateFontIndirect
SysAllocString
SysStringByteLen
LoadTypeLi
VariantClear

shlwapi

AssocQueryStringW
StrCmpIW
SHAutoComplete
StrStrW
PathIsRelativeW
StrStrIW
StrCmpW
StrRetToBufW

comctl32

ImageList_Destroy
DestroyPropertySheetPage
PropertySheetW
InitCommonControlsEx
CreatePropertySheetPageW
ImageList_GetIcon
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_GetImageCount
ImageList_SetBkColor
ImageList_ReplaceIcon
_TrackMouseEvent
CreateStatusWindowW
ImageList_Create
ImageList_Add
ImageList_Remove
ImageList_Draw

msvcr80

_errno
signal
srand
rand
_mktime64
vswprintf_s
_beginthreadex
ispunct
setvbuf
fseek
iswascii
toupper
ungetc
fsetpos
fgetc
fputc
fwrite
iswpunct
fclose
fflush
fgetpos
_wtoi
wcscpy_s
wcsrchr
_vswprintf
wcschr
_wrename
_endthreadex
_itow
sscanf
swscanf
_snwprintf
wcsncat
memcmp
_localtime64_s
_CxxThrowException
__CxxFrameHandler3
fgetwc
fputwc
ungetwc
__crtGetStringTypeW
setlocale
__crtLCMapStringW
___mb_cur_max_l_func
___lc_codepage_func
___lc_handle_func
_create_locale
_ui64toa_s
_free_locale
_malloc_crt
__pctype_func
__uncaught_exception
__crtLCMapStringA
isupper
_calloc_crt
_invoke_watson
_fsopen
wcstombs_s
_wfsopen
_get_osplatform
islower
abort
_vsnwprintf_s
__dllonexit
towupper
_localtime64
_wcsicmp
wcsncpy
_splitpath_s
_stricmp
_time64
memcpy
_wtof
__iob_func
_isatty
_fileno
__RTDynamicCast
memmove
strncpy
memset
strlen
_wchmod
fread
feof
_wfopen_s
towlower
_encode_pointer
memchr
_lock
_onexit
_decode_pointer
strcspn
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
?terminate@@YAXXZ
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
??1bad_cast@std@@UAE@XZ
localeconv
sprintf_s
swprintf_s
_invalid_parameter_noinfo
_purecall
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
_recalloc
malloc
wcsncpy_s
free
memmove_s
memcpy_s
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??_V@YAXPAX@Z
??3@YAXPAX@Z
__CppXcptFilter
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
wcsstr
_wcsupr
_vswprintf_c_l
_wcsnicmp
wcsncmp
_waccess
swscanf_s
realloc
strncpy_s
_itow_s
wcstol
_crt_debugger_hook

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msimg32

GradientFill
TransparentBlt

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

Exports

Exports

BatchRenameUtils
BatchTextReplace
ConsoleMain
HaoZipMain
ImageConvert
ImageViewerCloseEditor
ImageViewerCreate
ImageViewerDestory
ImageViewerInitialize
ImageViewerInitializeLang
ImageViewerInstance
ImageViewerIsClosed
ImageViewerSetInternalFile
ImageViewerSetLogoIcon
ImageViewerSetXmlProfile
ImageViewerShowFileEditor
ImageViewerUpdateSkin
ImageViewerUpdateTitleBar
Initialize
MD5Utils
ModuleFinitialize
ModuleInitialize
UpdateMain

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 425KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b42a4fdc510c41e75be3021c6f6e9b58

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

32:32:8f:34:20:b5:6b:f5:ba:72:74:13:bd:db:c9:f1:ca:a0:f2:4cSigner

Headers

File Characteristics

PDB Paths

Imports

gdiplus

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcr80

version

msimg32

setupapi

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 425KB - Virtual size: 424KB

.data Size: 60KB - Virtual size: 76KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 162KB - Virtual size: 161KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

32:32:8f:34:20:b5:6b:f5:ba:72:74:13:bd:db:c9:f1:ca:a0:f2:4c
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 425KB - Virtual size: 424KB

.data
Size: 60KB - Virtual size: 76KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 162KB - Virtual size: 161KB