38c5673321d7a9590cccec2cac0cd0f1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

38c5673321d7a9590cccec2cac0cd0f1_JaffaCakes118
Size

1.1MB
MD5

38c5673321d7a9590cccec2cac0cd0f1
SHA1

a0f6c2a6765bff2c2019e25d88554ac519c11f56
SHA256

cbc01520c64b2330f8c38c3a5b90544d0802cc89cc9a56ac00a36587c893d082
SHA512

b9f32b7c01bf23bbde15239863306eccd5df6ef176502f89e9cc232c6c982d2e054ca26897c60593bce7fcede11dc52e885a955040f231b842c9770d81fc5fbc
SSDEEP

24576:SOqfKf+gcVKqcK2WGprsGRgg+OFO6gO83IIVFcoi4nBelV+N:SDKf+/o6Ggg+qO6F8tibS

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
38c5673321d7a9590cccec2cac0cd0f1_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$R0
unpack001/HaoZip.exe
unpack001/HaoZipC.exe
unpack001/HaoZipUpdate.exe
unpack001/lang/HaoZipLang_chs.dll

Files

38c5673321d7a9590cccec2cac0cd0f1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/option.ini
$R0
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 396KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
7zNew.data
.7z
HaoZip.chm
.chm
HaoZip.exe
.exe windows:4 windows x86 arch:x86

55239a21a6813dedc2f8eb76ba3f01eb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\rczip.1.6\trunk\bin\win32\release_tiny\pdb\HaoZip.pdb

Imports

kernel32

Sleep
GetProcessTimes
FormatMessageW
WideCharToMultiByte
GetACP
MultiByteToWideChar
DosDateTimeToFileTime
GetSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
ResumeThread
GetFileSize
SetFilePointer
SetEndOfFile
SetFileTime
WriteFile
ReadFile
VirtualFree
VirtualAlloc
CreateMutexW
ReleaseMutex
GetLongPathNameW
SearchPathW
GetTempPathW
GetFullPathNameW
GetWindowsDirectoryW
GetTempFileNameW
MoveFileExW
SetFileAttributesW
lstrcatW
GetLocalTime
GetComputerNameW
GetVersionExW
LockResource
FindResourceW
LoadResource
ExpandEnvironmentStringsW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenEventW
GetVolumeInformationW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
FindResourceExW
CreateSemaphoreW
LoadLibraryExW
EnumResourceLanguagesW
EnumResourceNamesW
SystemTimeToTzSpecificLocalTime
GetFileAttributesW
CopyFileW
FreeLibrary
GetProcAddress
GetStdHandle
GetPrivateProfileStringW
GetSystemInfo
GlobalMemoryStatus
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetThreadLocale
GetLocaleInfoA
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
LoadLibraryW
CreateProcessW
SetLastError
RaiseException
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
SetCurrentDirectoryW
DeleteFileW
CloseHandle
CreateEventW
WaitForMultipleObjects
FindCloseChangeNotification
FindFirstChangeNotificationW
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleW
SetErrorMode
GetCurrentDirectoryW
FileTimeToSystemTime
InterlockedExchange
FindFirstFileW
FindClose
CreateFileW
GetLastError
ReleaseSemaphore
ResetEvent
TerminateThread
WaitForSingleObject
GlobalSize
InterlockedDecrement
InterlockedIncrement
GetDriveTypeW
GetFileTime
VirtualAllocEx
OpenProcess
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
LoadLibraryA
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
LocalFree
LocalAlloc
MoveFileW
RemoveDirectoryW
FindNextFileW
CreateDirectoryW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CompareStringW
lstrcmpiW
EnumResourceTypesW
lstrlenW

user32

IsDialogMessageW
GetClassNameW
TranslateMessage
DispatchMessageW
UnregisterClassA
GetMessageW
GetDlgItem
SetWindowTextW
SendDlgItemMessageW
wsprintfW
TrackPopupMenu
SetCursor
CheckMenuItem
GetMenuState
ExitWindowsEx
MessageBoxW
ShowCursor
CopyRect
GetWindowPlacement
SetWindowPlacement
DeleteMenu
CreateIconIndirect
GetIconInfo
CopyIcon
IsMenu
SetScrollInfo
SetScrollPos
GetSysColorBrush
ScrollWindowEx
ClientToScreen
GetMenuItemInfoW
GetMenuItemCount
InflateRect
DrawStateW
DrawFrameControl
GetSubMenu
DrawIconEx
InsertMenuItemW
TrackPopupMenuEx
RegisterClassExW
GetClassInfoExW
MessageBeep
SetDlgItemInt
GetDlgItemInt
MonitorFromPoint
GetMonitorInfoW
GetCursor
EnableMenuItem
SetDlgItemTextW
GetTopWindow
LoadStringW
IsChild
GetSystemMetrics
SetParent
WindowFromPoint
GetWindowThreadProcessId
FindWindowExW
SetTimer
KillTimer
CreateDialogParamW
GetWindowDC
EqualRect
LoadBitmapW
ChangeClipboardChain
RegisterClassW
GetClassLongW
MoveWindow
GetScrollInfo
SetClipboardViewer
RegisterClipboardFormatW
SetClipboardData
EmptyClipboard
SetRectEmpty
ScreenToClient
GetCursorPos
GetFocus
PtInRect
GetDlgCtrlID
DrawFocusRect
ReleaseCapture
FillRect
GetCapture
DestroyWindow
SetCapture
CallWindowProcW
DefWindowProcW
EndPaint
BeginPaint
GetClientRect
CharNextW
GetWindowTextW
GetWindow
DrawTextW
GetWindowTextLengthW
MapWindowPoints
CreateWindowExW
OffsetRect
SetWindowPos
GetPropW
SetPropW
RedrawWindow
SystemParametersInfoW
GetParent
IsWindowEnabled
EnableWindow
EndDialog
UpdateWindow
SetFocus
DialogBoxParamW
SetWindowLongW
PostQuitMessage
GetWindowRect
GetWindowLongW
IsWindowVisible
LoadImageW
InvalidateRect
GetActiveWindow
ReleaseDC
DrawTextExW
GetDC
GetDesktopWindow
AppendMenuW
CreatePopupMenu
CreateMenu
GetKeyState
DestroyMenu
SetMenu
LoadCursorW
GetSysColor
DestroyIcon
LoadIconW
GetMenu
CloseClipboard
GetClipboardData
OpenClipboard
SendMessageW
BringWindowToTop
SetForegroundWindow
ShowWindow
IsIconic
IsWindow
PostMessageW
PostThreadMessageW

gdi32

CreateCompatibleDC
DeleteObject
SetTextColor
SetBkColor
ExtTextOutW
GetObjectW
SelectObject
StretchBlt
CreateFontIndirectW
GetStockObject
SetBkMode
BitBlt
MoveToEx
LineTo
CreateBitmap
CreatePatternBrush
SetROP2
PatBlt
CreateSolidBrush
GetTextExtentPoint32W
GetTextMetricsW
SetViewportOrgEx
TextOutW
FillPath
CreateCompatibleBitmap
BeginPath
GetBkColor
PathToRegion
CreatePen
EndPath
DeleteDC

comdlg32

GetSaveFileNameW
ChooseFontW
CommDlgExtendedError
GetOpenFileNameW

advapi32

RegSetValueExW
RegCreateKeyW
RegDeleteValueW
RegOpenKeyW
RegDeleteKeyW
GetUserNameW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExA
RegOpenKeyExA

shell32

SHFileOperationW
ShellExecuteW
DragQueryFileW
SHGetPathFromIDListW
SHGetDesktopFolder
ord28
ord74
Shell_NotifyIconW
ShellExecuteExW
FindExecutableW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc
SHGetFileInfoW
DragFinish

ole32

RevokeDragDrop
ReleaseStgMedium
OleRun
CoCreateInstance
RegisterDragDrop
OleUninitialize
OleInitialize
CoTaskMemFree
CoInitialize
CoUninitialize
DoDragDrop

oleaut32

VariantClear
GetErrorInfo

shlwapi

SHAutoComplete
AssocQueryStringW
StrRetToBufW

msimg32

TransparentBlt

msvcr80

srand
rand
swprintf_s
_wrename
_errno
towlower
_vsnwprintf_s
towupper
__RTDynamicCast
_wtoi64
wcscmp
_wtof
_snwprintf
abs
wcsstr
memcmp
strcpy
free
_wtoi
malloc
wcscpy
wcscpy_s
_purecall
wcscat
wcsncpy_s
_beginthreadex
_waccess
memmove
_time64
wcsncmp
??0exception@std@@QAE@XZ
swscanf
sscanf
memcpy
memset
strlen
_itow
??_V@YAXPAX@Z
wcsrchr
??0exception@std@@QAE@ABV01@@Z
_isatty
??1exception@std@@UAE@XZ
_vswprintf
wcschr
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
wcslen
_invalid_parameter_noinfo
wcsncpy
memmove_s
?what@exception@std@@UBEPBDXZ
memcpy_s
_wcsicmp
??3@YAXPAX@Z
_endthreadex
sprintf_s
_recalloc
_rotl
_wcsnicmp
strcpy_s
_wfopen_s
fclose
feof
fgetc
fwrite
fread
_wchmod
_CxxThrowException
__CxxFrameHandler3
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
strcmp
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_wcsupr
__iob_func
_fileno

comctl32

ImageList_Destroy
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_LoadImageW
ImageList_GetImageCount
ImageList_GetIcon
ord8
PropertySheetW
_TrackMouseEvent
InitCommonControlsEx
CreateStatusWindowW
CreatePropertySheetPageW
DestroyPropertySheetPage
ImageList_GetIconSize
ImageList_Create
ImageList_Remove

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
HaoZipC.exe
.exe windows:4 windows x86 arch:x86

a1bbff8294f1350d497180a7eefc5ce5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\rczip.1.6\trunk\bin\win32\release_tiny\pdb\HaoZipC.pdb

Imports

kernel32

GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryW
CloseHandle
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
FormatMessageW
LocalFree
GetPrivateProfileStringW
DeleteFileW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
WaitForSingleObject
CreateMutexW
ReleaseMutex
FindFirstFileW
FindClose
FindNextFileW
GetStdHandle
WriteFile
FileTimeToDosDateTime
DosDateTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
ReadFile
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
SetFilePointer
GetFileSize
MoveFileExW
lstrlenW
SetFileAttributesW
GetTempPathW
GetFullPathNameW
GetTempFileNameW
GetLongPathNameW
SetFileTime
SearchPathW
MoveFileW
SetEndOfFile
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime

user32

LoadStringW
IsWindow
MessageBoxW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHGetPathFromIDListW
SHChangeNotify

ole32

CoTaskMemFree

msvcr80

fflush
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
strcspn
memset
_purecall
memchr
??3@YAXPAX@Z
??_V@YAXPAX@Z
memmove_s
_invalid_parameter_noinfo
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
exit
free
strlen
??2@YAPAXI@Z
memcpy_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
localeconv
??0exception@std@@QAE@ABV01@@Z
sprintf_s
wcslen
memcpy
memmove
__RTDynamicCast
_fileno
_isatty
__iob_func
_vsnwprintf_s
_errno
srand
_time64
rand
signal
towupper
wcschr
towlower
_waccess
__crtGetStringTypeW
__CxxFrameHandler3
_CxxThrowException
setlocale
fgetwc
fputwc
ungetwc
??0bad_cast@std@@QAE@ABV01@@Z
setvbuf
ungetc
fgetc
fwrite
fgetpos
fseek
fsetpos
fclose
__uncaught_exception
___mb_cur_max_l_func
___lc_codepage_func
___lc_handle_func
__crtLCMapStringW
__pctype_func
_calloc_crt
_create_locale
_ui64toa_s
_free_locale
_malloc_crt
abort
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
HaoZipUpdate.exe
.exe windows:4 windows x86 arch:x86

3c45d941c395a803914eed4956f5d94f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\rczip.1.6\trunk\bin\win32\release_tiny\pdb\HaoZipUpdate.pdb

Imports

kernel32

GetTickCount
Sleep
CompareStringW
LoadLibraryW
GetCurrentDirectoryW
MoveFileW
CopyFileW
DeleteFileW
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
WaitForSingleObject
CloseHandle
ResumeThread
GetACP
WideCharToMultiByte
FindFirstFileW
FindClose
FindNextFileW
GetLongPathNameW
SetFileAttributesW
CreateFileW
GetFullPathNameW
GetTempPathW
GetTempFileNameW
SetFileTime
GetCurrentProcess
GetWindowsDirectoryW
WriteFile
GetVersionExW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReadFile
GetFileSize
SetFilePointer
SetEndOfFile
LocalFree
FormatMessageW
GetPrivateProfileStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
LoadLibraryExW
RaiseException
GetModuleHandleW
LoadLibraryA
InitializeCriticalSection
LeaveCriticalSection
GetLastError
CreateMutexW
GetCurrentThreadId
lstrlenW
InterlockedExchange
DeleteCriticalSection
FindResourceW
LoadResource
SizeofResource
SetLastError
MultiByteToWideChar
InterlockedDecrement
EnterCriticalSection
GetModuleFileNameW
GetProcAddress
InterlockedIncrement
FlushInstructionCache
FreeLibrary
lstrcmpiW

user32

GetMessageW
PeekMessageW
TranslateMessage
SetWindowLongW
UnregisterClassA
PostQuitMessage
GetClassNameW
CreateWindowExW
SetRectEmpty
DispatchMessageW
BeginPaint
EndPaint
IsDialogMessageW
SetFocus
UpdateWindow
GetWindowTextLengthW
GetSysColor
FillRect
GetSystemMetrics
GetFocus
KillTimer
SetCapture
DrawFocusRect
IsIconic
SetTimer
GetCapture
GetDlgCtrlID
GetWindowTextW
ReleaseCapture
PtInRect
IsWindow
GetDC
DrawTextW
GetMenuDefaultItem
LoadMenuW
GetClassInfoExW
SetMenuDefaultItem
DestroyIcon
RegisterWindowMessageW
SetForegroundWindow
GetSubMenu
RegisterClassExW
DestroyMenu
IsMenu
TrackPopupMenu
LoadStringW
PostMessageW
GetActiveWindow
SetDlgItemTextW
IsWindowVisible
ScreenToClient
SetCursor
GetCursorPos
LoadCursorW
IsWindowEnabled
DialogBoxParamW
ReleaseDC
ShowWindow
CreateDialogParamW
DestroyWindow
MessageBoxW
DefWindowProcW
CharNextW
SetWindowPos
MapWindowPoints
GetClientRect
EndDialog
GetParent
GetWindowRect
GetWindowLongW
CallWindowProcW
OffsetRect
LoadImageW
SetWindowTextW
GetDlgItem
SendMessageW
LoadIconW
GetWindow
SystemParametersInfoW
InvalidateRect

gdi32

GetObjectW
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
GetStockObject
DeleteObject

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW

shell32

Shell_NotifyIconW
SHGetPathFromIDListW
ShellExecuteW
SHChangeNotify
ShellExecuteExW
SHGetSpecialFolderLocation

ole32

CoTaskMemRealloc
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance

oleaut32

VarUI4FromStr

comctl32

_TrackMouseEvent
InitCommonControlsEx

msvcr80

wcscpy_s
sprintf_s
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__CxxFrameHandler3
_CxxThrowException
swprintf_s
strncpy_s
vswprintf_s
memcmp
_vswprintf_c_l
memcpy
strcmp
memmove
_beginthreadex
_waccess
srand
_time64
rand
towlower
towupper
wcschr
_errno
_vsnwprintf_s
_purecall
_invalid_parameter_noinfo
_wtoi
??0exception@std@@QAE@XZ
strlen
?what@exception@std@@UBEPBDXZ
??_V@YAXPAX@Z
memcpy_s
wcsncpy_s
_recalloc
wcslen
??0exception@std@@QAE@ABV01@@Z
free
??2@YAPAXI@Z
malloc
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
memset
memmove_s
??3@YAXPAX@Z

wininet

InternetOpenUrlW
HttpOpenRequestW
HttpSendRequestExW
InternetConnectW
InternetReadFile
HttpQueryInfoW
InternetWriteFile
InternetCrackUrlW
HttpEndRequestW
InternetSetOptionW
InternetOpenW
InternetCloseHandle

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Microsoft.VC80.CRT.manifest
TarNew.data
ZipNew.data
lang/HaoZipLang_chs.dll
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\rczip.1.6\trunk\bin\win32\release_tiny\lang\pdb\HaoZipLang_chs.pdb

Sections

.text
Size: 512B - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
好压免责声明.txt

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.1MB

.rsrc Size: 18KB - Virtual size: 17KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 899B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 574B

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 396KB - Virtual size: 393KB

.rdata Size: 172KB - Virtual size: 171KB

.data Size: 20KB - Virtual size: 26KB

.rsrc Size: 4KB - Virtual size: 976B

.reloc Size: 16KB - Virtual size: 13KB

55239a21a6813dedc2f8eb76ba3f01eb

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.1MB

.rsrc
Size: 18KB - Virtual size: 17KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 899B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 574B

.text
Size: 396KB - Virtual size: 393KB

.rdata
Size: 172KB - Virtual size: 171KB

.data
Size: 20KB - Virtual size: 26KB

.rsrc
Size: 4KB - Virtual size: 976B

.reloc
Size: 16KB - Virtual size: 13KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 224KB - Virtual size: 223KB

.data
Size: 28KB - Virtual size: 32KB

.rsrc
Size: 17KB - Virtual size: 16KB

.text
Size: 198KB - Virtual size: 198KB

.rdata
Size: 45KB - Virtual size: 44KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.text
Size: 128KB - Virtual size: 128KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 9KB - Virtual size: 9KB

.text
Size: 512B - Virtual size: 6B

.rdata
Size: 512B - Virtual size: 130B

.data
Size: - Virtual size: 804B

.rsrc
Size: 366KB - Virtual size: 365KB

.reloc
Size: 512B - Virtual size: 480B