New.7z
- SHA256 b2a9d9fa76e0d276d2a9ee93a0cd32a7796ffa5c5481dba57c89c0590fb61d09
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New/3mm.exe
Resource
win11-20240508-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
New/6mm.exe
Resource
win11-20240426-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
New/dgbw.exe
Resource
win11-20240508-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
New/dggw.exe
Resource
win11-20240426-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
New/vm-uw.exe
Resource
win11-20240426-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target New.7z
- Size 1.3MB
- Sample240611-v35bcavdmb
- SHA256 b2a9d9fa76e0d276d2a9ee93a0cd32a7796ffa5c5481dba57c89c0590fb61d09
- MD5 4a0669dd1287f85e595dd08755ba039d
- SHA1 b04919cc21e958db088a79b125f9bb967ba3607c
- SHA512 2cd1ceba87fe33fdacf6a9e3cbd868dff07088751c01e7e0548733318f70028d8c3051ab0ab8dc7614e685b1d78106fcb77f95e69153fd289f5cd39938acf8d4
- SSDEEP 24576:TjnByrJ9Y9rJ/p65savb6Xzzq6FG4qglM3cfEFjxpKgo9lfKR:/Bu9+9/p66avbGq0LqwAcfEJ94KR
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/New/3mm.exe unpack001/New/6mm.exe unpack001/New/dgbw.exe unpack001/New/dggw.exe unpack001/New/vm-uw.exe
File Explorer
-
New.7z.7z 1.3MB
-
New/3mm.exe.exe 1009KB
-
New/6mm.exe.exe 1.1MB
-
New/dgbw.exe.exe 570KB
-
New/dggw.exe.exe 570KB
-
New/vm-uw.exe.exe 566KB
New/3mm.exe
- IMPHASH eec4c9510d1f15621b464022e8c2d408
- SHA256 05b5a1a5354201eb02051a8555a63d82e98766798f5739111c454103ca2599bb
- MD5 a38109846c85c59384c9b71ef67f655d
- SHA1 211f659b70bf4abd6be8b742e156cc6d5c1d9e43
- SHA512 adc11e5871df6db8f5921ef803865a4611bc274bfef308a524cc7d00e9f4e81d2047ff984a90a6dc752c506246fc9ae141409c685e79d83185c577126729a19a
- SSDEEP 24576:Ld9Mrf7iaNVxowiTsJvJkI65s0o5bJQAoDy:ByTeFwWsJxkI660o5roW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
243441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
H:\Work\haozip\bin\Win32\release\pdb\HaoZip7zSetup.pdb
comctl32
InitCommonControlsEx
shell32
SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ShellExecuteW
CommandLineToArgvW
kernel32
HeapAlloc
LocalFree
GetProcessHeap
GetFileAttributesW
LoadLibraryW
CloseHandle
GetProcAddress
FreeLibrary
GetCurrentProcess
GetVersionExW
GetModuleHandleW
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileApisToOEM
SetPriorityClass
SetThreadPriority
GetEnvironmentVariableW
GetCurrentThread
GetCommandLineW
FindResourceW
FindFirstFileW
FindNextFileW
FindClose
GetLongPathNameW
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
LoadLibraryExW
WriteFile
SetFileTime
SetEndOfFile
FormatMessageW
InterlockedExchangeAdd
ReadFile
SetFilePointer
GetFileSize
ResumeThread
GetACP
GetLastError
WideCharToMultiByte
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
FileTimeToSystemTime
WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
LCMapStringW
HeapFree
MultiByteToWideChar
VirtualFree
VirtualAlloc
GetStringTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
GetFileType
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
DispatchMessageW
SetTimer
IsDialogMessageW
TranslateMessage
LoadIconW
KillTimer
PostQuitMessage
EnableWindow
ScreenToClient
IsWindow
MessageBoxW
ShowWindow
PostMessageW
GetWindowRect
SetWindowPos
DialogBoxParamW
SendMessageW
EndDialog
SetWindowTextW
SetFocus
GetDlgItem
GetWindowTextW
IsWindowVisible
CreateDialogParamW
GetMessageW
GetDesktopWindow
LoadStringW
DestroyIcon
GetSystemMetrics
gdi32
CreateSolidBrush
DeleteObject
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
Name
.text
Size
314KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=146, id=243, version=40116,
count=26, id=242, version=40116,
count=2, productName=Unmarked objects (old),
count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=18, id=260, version=26706,
count=24, id=259, version=26706,
count=46, id=261, version=26706,
count=1, id=259, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=239, id=1, productName=Unmarked objects,
count=216, id=265, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
New/6mm.exe
- IMPHASH eec4c9510d1f15621b464022e8c2d408
- SHA256 417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632
- MD5 bceaadd320aaa1bc88b2e670b6ea4e16
- SHA1 8cb2d9312eb4c8beea071f692b55c5f1a2a38fea
- SHA512 71938de64075cb5aaad692529c7aea612ada995c11d71b8e917a703b416b68d643628e1e5aba89c3a0e58f3ce5b5e31cdefa179227d2340ce2425b0e557c979d
- SSDEEP 24576:Ld9Mrf7iaNVxowuT2hn4VXlM0fDfJN0KfMrw:ByTeFw6W4V11fDfvurw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
243441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
H:\Work\haozip\bin\Win32\release\pdb\HaoZip7zSetup.pdb
comctl32
InitCommonControlsEx
shell32
SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ShellExecuteW
CommandLineToArgvW
kernel32
HeapAlloc
LocalFree
GetProcessHeap
GetFileAttributesW
LoadLibraryW
CloseHandle
GetProcAddress
FreeLibrary
GetCurrentProcess
GetVersionExW
GetModuleHandleW
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileApisToOEM
SetPriorityClass
SetThreadPriority
GetEnvironmentVariableW
GetCurrentThread
GetCommandLineW
FindResourceW
FindFirstFileW
FindNextFileW
FindClose
GetLongPathNameW
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
LoadLibraryExW
WriteFile
SetFileTime
SetEndOfFile
FormatMessageW
InterlockedExchangeAdd
ReadFile
SetFilePointer
GetFileSize
ResumeThread
GetACP
GetLastError
WideCharToMultiByte
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
FileTimeToSystemTime
WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
LCMapStringW
HeapFree
MultiByteToWideChar
VirtualFree
VirtualAlloc
GetStringTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
GetFileType
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
DispatchMessageW
SetTimer
IsDialogMessageW
TranslateMessage
LoadIconW
KillTimer
PostQuitMessage
EnableWindow
ScreenToClient
IsWindow
MessageBoxW
ShowWindow
PostMessageW
GetWindowRect
SetWindowPos
DialogBoxParamW
SendMessageW
EndDialog
SetWindowTextW
SetFocus
GetDlgItem
GetWindowTextW
IsWindowVisible
CreateDialogParamW
GetMessageW
GetDesktopWindow
LoadStringW
DestroyIcon
GetSystemMetrics
gdi32
CreateSolidBrush
DeleteObject
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
Name
.text
Size
314KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=146, id=243, version=40116,
count=26, id=242, version=40116,
count=2, productName=Unmarked objects (old),
count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=18, id=260, version=26706,
count=24, id=259, version=26706,
count=46, id=261, version=26706,
count=1, id=259, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=239, id=1, productName=Unmarked objects,
count=216, id=265, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
New/dgbw.exe
- IMPHASH eec4c9510d1f15621b464022e8c2d408
- SHA256 acad5da56a5e89b288e11f39789d7583c07972bc5253bcdcea96cb020b703474
- MD5 d6ead5d81986e9e21984c4ee8df32183
- SHA1 7eb429ce51bf900f0ef4aa589cf8a789b6a4792a
- SHA512 13aba25679b8e3fe1b96ba94262d6afaa57f8554f7dc31e4643a417545ef292537e7e09cc5ec4c5c0c418b3057009eabfee00c5cf89d0a0354be2a7ff484f0be
- SSDEEP 12288:LQM9bROJmafSPZDz7qElw2KxPo0q7qzC9b/uEvtHKYTsviIR8Cufe9ZqQwExr//M:Ld9Mrf7iaNVxowsTNkw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
243441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
H:\Work\haozip\bin\Win32\release\pdb\HaoZip7zSetup.pdb
comctl32
InitCommonControlsEx
shell32
SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ShellExecuteW
CommandLineToArgvW
kernel32
HeapAlloc
LocalFree
GetProcessHeap
GetFileAttributesW
LoadLibraryW
CloseHandle
GetProcAddress
FreeLibrary
GetCurrentProcess
GetVersionExW
GetModuleHandleW
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileApisToOEM
SetPriorityClass
SetThreadPriority
GetEnvironmentVariableW
GetCurrentThread
GetCommandLineW
FindResourceW
FindFirstFileW
FindNextFileW
FindClose
GetLongPathNameW
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
LoadLibraryExW
WriteFile
SetFileTime
SetEndOfFile
FormatMessageW
InterlockedExchangeAdd
ReadFile
SetFilePointer
GetFileSize
ResumeThread
GetACP
GetLastError
WideCharToMultiByte
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
FileTimeToSystemTime
WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
LCMapStringW
HeapFree
MultiByteToWideChar
VirtualFree
VirtualAlloc
GetStringTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
GetFileType
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
DispatchMessageW
SetTimer
IsDialogMessageW
TranslateMessage
LoadIconW
KillTimer
PostQuitMessage
EnableWindow
ScreenToClient
IsWindow
MessageBoxW
ShowWindow
PostMessageW
GetWindowRect
SetWindowPos
DialogBoxParamW
SendMessageW
EndDialog
SetWindowTextW
SetFocus
GetDlgItem
GetWindowTextW
IsWindowVisible
CreateDialogParamW
GetMessageW
GetDesktopWindow
LoadStringW
DestroyIcon
GetSystemMetrics
gdi32
CreateSolidBrush
DeleteObject
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
Name
.text
Size
314KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=146, id=243, version=40116,
count=26, id=242, version=40116,
count=2, productName=Unmarked objects (old),
count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=18, id=260, version=26706,
count=24, id=259, version=26706,
count=46, id=261, version=26706,
count=1, id=259, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=239, id=1, productName=Unmarked objects,
count=216, id=265, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
New/dggw.exe
- IMPHASH eec4c9510d1f15621b464022e8c2d408
- SHA256 cfcdfdff42246ab34c0f8a8ca746dc47ddb3cb757a23dd0a4c1fda5cdbc67cd8
- MD5 bb5e489728d77d8d98792ef21634f6a6
- SHA1 96e5834b313a41173f156d3a09bb1a4b3595233a
- SHA512 6888b567193ff358ea9f3add80bae4c0bbc981e6f91294ac0a8277718fc7d52f94d45d288498c3d42a554d24b935f9e614733bf9adb011ff9a307315e67d2411
- SSDEEP 12288:LQM9bROJmafSPZDz7qElw2KxPo0q7qzC9b/uEvtHKYTsviIR8Cufe9ZqQwExr//b:Ld9Mrf7iaNVxowtTW0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
243441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
H:\Work\haozip\bin\Win32\release\pdb\HaoZip7zSetup.pdb
comctl32
InitCommonControlsEx
shell32
SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ShellExecuteW
CommandLineToArgvW
kernel32
HeapAlloc
LocalFree
GetProcessHeap
GetFileAttributesW
LoadLibraryW
CloseHandle
GetProcAddress
FreeLibrary
GetCurrentProcess
GetVersionExW
GetModuleHandleW
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileApisToOEM
SetPriorityClass
SetThreadPriority
GetEnvironmentVariableW
GetCurrentThread
GetCommandLineW
FindResourceW
FindFirstFileW
FindNextFileW
FindClose
GetLongPathNameW
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
LoadLibraryExW
WriteFile
SetFileTime
SetEndOfFile
FormatMessageW
InterlockedExchangeAdd
ReadFile
SetFilePointer
GetFileSize
ResumeThread
GetACP
GetLastError
WideCharToMultiByte
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
FileTimeToSystemTime
WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
LCMapStringW
HeapFree
MultiByteToWideChar
VirtualFree
VirtualAlloc
GetStringTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
GetFileType
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
DispatchMessageW
SetTimer
IsDialogMessageW
TranslateMessage
LoadIconW
KillTimer
PostQuitMessage
EnableWindow
ScreenToClient
IsWindow
MessageBoxW
ShowWindow
PostMessageW
GetWindowRect
SetWindowPos
DialogBoxParamW
SendMessageW
EndDialog
SetWindowTextW
SetFocus
GetDlgItem
GetWindowTextW
IsWindowVisible
CreateDialogParamW
GetMessageW
GetDesktopWindow
LoadStringW
DestroyIcon
GetSystemMetrics
gdi32
CreateSolidBrush
DeleteObject
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
Name
.text
Size
314KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=146, id=243, version=40116,
count=26, id=242, version=40116,
count=2, productName=Unmarked objects (old),
count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=18, id=260, version=26706,
count=24, id=259, version=26706,
count=46, id=261, version=26706,
count=1, id=259, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=239, id=1, productName=Unmarked objects,
count=216, id=265, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
New/vm-uw.exe
- IMPHASH eec4c9510d1f15621b464022e8c2d408
- SHA256 aa1ad7c508d497292d1e017b946cc381be204bd641543bcf584da286eb6f685f
- MD5 78c6129bfd81f88cfb7171caf2d386a1
- SHA1 f626224572dea0bc2983e3b3986bd1c1af5533ce
- SHA512 38d0f61a25f015ad149765ced45ab81591ec02f9fe290c1560db9f53f9b7e6edc371eaebbcc54156006e63fe323b976bf560b9db69328f5ffe0fd9b734a9717b
- SSDEEP 12288:LQM9bROJmafSPZDz7qElw2KxPo0q7qzC9b/uEvtHKYTsviIR8Cufe9ZqQwExr//R:Ld9Mrf7iaNVxowGT/M
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
243441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
H:\Work\haozip\bin\Win32\release\pdb\HaoZip7zSetup.pdb
comctl32
InitCommonControlsEx
shell32
SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ShellExecuteW
CommandLineToArgvW
kernel32
HeapAlloc
LocalFree
GetProcessHeap
GetFileAttributesW
LoadLibraryW
CloseHandle
GetProcAddress
FreeLibrary
GetCurrentProcess
GetVersionExW
GetModuleHandleW
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileApisToOEM
SetPriorityClass
SetThreadPriority
GetEnvironmentVariableW
GetCurrentThread
GetCommandLineW
FindResourceW
FindFirstFileW
FindNextFileW
FindClose
GetLongPathNameW
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
LoadLibraryExW
WriteFile
SetFileTime
SetEndOfFile
FormatMessageW
InterlockedExchangeAdd
ReadFile
SetFilePointer
GetFileSize
ResumeThread
GetACP
GetLastError
WideCharToMultiByte
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
FileTimeToSystemTime
WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
LCMapStringW
HeapFree
MultiByteToWideChar
VirtualFree
VirtualAlloc
GetStringTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
GetFileType
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
DispatchMessageW
SetTimer
IsDialogMessageW
TranslateMessage
LoadIconW
KillTimer
PostQuitMessage
EnableWindow
ScreenToClient
IsWindow
MessageBoxW
ShowWindow
PostMessageW
GetWindowRect
SetWindowPos
DialogBoxParamW
SendMessageW
EndDialog
SetWindowTextW
SetFocus
GetDlgItem
GetWindowTextW
IsWindowVisible
CreateDialogParamW
GetMessageW
GetDesktopWindow
LoadStringW
DestroyIcon
GetSystemMetrics
gdi32
CreateSolidBrush
DeleteObject
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
Name
.text
Size
314KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=146, id=243, version=40116,
count=26, id=242, version=40116,
count=2, productName=Unmarked objects (old),
count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=18, id=260, version=26706,
count=24, id=259, version=26706,
count=46, id=261, version=26706,
count=1, id=259, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=239, id=1, productName=Unmarked objects,
count=216, id=265, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=4, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,