ZAZAPIt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ZAZAPIt.dll
Size

83KB
MD5

676f846516c24d4f9b1364a1ff436157
SHA1

3b6a81c584c23a5d4e3300123c1dc392ad7f7bb6
SHA256

57f1c4789dc1255d3c38ddb32cef2d95e2d23d5528a81bb5faabde285b31c615
SHA512

2b6a21fc11679b976990fb573d40cd79cbd75f4e039a27c4fab6d6b8d3fd05a726810fcd462fbc617a6f761f3c10671aa20b5b82ff7d5b502eb549b46c42674d
SSDEEP

1536:yFrVRHdpGAP1lG3XJx5KnQlGX+1EO/po2:qhRR+v8X6EO/po2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ZAZAPIt.dll

Files

ZAZAPIt.dll
.dll windows:5 windows x64 arch:x64

b3074855f427a9fc361fa6cbffca8f1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
ClearCommError
WriteFile
CreateFileA
CloseHandle
SetCommTimeouts
GetCommTimeouts
SetCommState
GetCommState
PurgeComm
DeviceIoControl
GetLastError
QueryPerformanceCounter
GetDriveTypeA
GetTickCount
WaitForSingleObject
ResetEvent
GetSystemDefaultLangID
Sleep
CreateEventA
EncodePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
_lclose
GlobalAlloc
GlobalLock
LocalAlloc
LocalLock
LocalUnlock
LocalFree
GlobalUnlock
SetLastError
GlobalFree
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DecodePointer

user32

SendMessageA
EnableWindow
MessageBoxA
ReleaseDC
GetDC

gdi32

SelectPalette
RealizePalette
CreateDIBitmap
CreateCompatibleDC
SelectObject
StretchBlt
DeleteDC
DeleteObject
CreatePalette

mfc100

ord12284
ord2754
ord8047
ord9688
ord5973
ord10794
ord7766
ord12920
ord10577
ord3275
ord10712
ord7931
ord13599
ord13598
ord13670
ord13687
ord13683
ord13685
ord13686
ord13684
ord4230
ord7057
ord2785
ord2788
ord12181
ord5319
ord2659
ord2877
ord2878
ord3479
ord10054
ord9701
ord7833
ord10754
ord6423
ord11953
ord9171
ord266
ord265
ord300
ord1457
ord6580
ord876
ord5871
ord8000
ord8977
ord4895
ord6865
ord11470
ord10840
ord10871
ord9145
ord7063
ord3934
ord10867
ord10859
ord5031
ord3288
ord13107
ord13110
ord13108
ord13111
ord13106
ord13109
ord6868
ord11099
ord12808
ord10609
ord13700
ord10877
ord6823
ord11489
ord3477
ord3535
ord8182
ord12925
ord6806
ord12927
ord11107
ord11106
ord2116
ord4555
ord13393
ord11410
ord7213
ord7286
ord1266
ord4260
ord4251
ord4222
ord4264
ord4243
ord4209
ord4213
ord4246
ord3849
ord13605
ord3842
ord2573
ord12928
ord6807
ord12926
ord5887
ord10366
ord12138
ord5046
ord2285
ord10747
ord3355
ord2852
ord2851
ord2753
ord10790
ord4458
ord4722
ord4892
ord8135
ord4700
ord4920
ord4461
ord4597
ord4445
ord6640
ord6641
ord6631
ord4595
ord7065
ord8982
ord8001
ord5562
ord10875
ord1474
ord1481
ord1487
ord1485
ord1492
ord369
ord1291
ord924
ord316
ord4124
ord889
ord1272
ord1274
ord4218
ord4255
ord4226
ord4238
ord1709
ord4234
ord2353
ord893
ord13144
ord2051
ord321
ord3285
ord2014
ord2012
ord2040
ord1945
ord2002
ord396
ord1914
ord2050
ord2048
ord1906
ord1844
ord1895
ord322
ord1275

msvcr100

rand
__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__C_specific_handler
feof
srand
memset
fread
fopen
fwrite
fseek
fclose
_time64
strncpy
??0exception@std@@QEAA@AEBV01@@Z
_CxxThrowException
malloc
free
__CxxFrameHandler3
sprintf
memmove
memchr
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBD@Z
memcpy

msvcp100

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

Exports

Exports

JPSetPackSize
TestMsg
ZAZAutoOpen
ZAZBurnCode
ZAZClear5xxFLAG
ZAZCloseDeviceEx
ZAZDelChar
ZAZDoUserDefine
ZAZDownChar
ZAZDownCharFromFile
ZAZDownChar_Test
ZAZDownElfData
ZAZDownElfDataX
ZAZDownImage
ZAZEmpty
ZAZEnableTestMsg
ZAZEnroll
ZAZErr2Str
ZAZFingerData2BMPData
ZAZGenBinImage
ZAZGenChar
ZAZGetCharLen
ZAZGetImage
ZAZGetImage_Enroll
ZAZGetImgDataFromBMP
ZAZGetRandomData
ZAZGetUDiskNum
ZAZGetUSBDevNum
ZAZHighSpeedSearch
ZAZIdentify
ZAZImgData2BMP
ZAZImgQuality
ZAZLoadChar
ZAZMatch
ZAZOpenDeviceEx
ZAZPortControl
ZAZReadIndexTable
ZAZReadInfPage
ZAZReadInfo
ZAZReadParTable
ZAZRegModule
ZAZSearch
ZAZSetBaud
ZAZSetCharLen
ZAZSetChipAddr
ZAZSetPacketSize
ZAZSetPwd
ZAZSetSecurLevel
ZAZSetledsound
ZAZShowFingerData
ZAZStoreChar
ZAZTemplateNum
ZAZTestPro
ZAZUpChar
ZAZUpChar2File
ZAZUpImage
ZAZUpdatOnline
ZAZVfyPwd
ZAZWriteInfo
ZAZWriteReg
ZAZ_SB

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 830B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3074855f427a9fc361fa6cbffca8f1e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

mfc100

msvcr100

msvcp100

setupapi

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 1024B - Virtual size: 830B

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 1024B - Virtual size: 830B