libzippp[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
libzippp.dll
Size 50KB
Sample260705-ecfmascy7q
SHA256 ec0faf53d7ffb05fe4ab339f4e2ae8e2c1e007c3d94faa2c45c80678144f5506
MD5 32de6252485d58cb01614c8d19965ef1
SHA1 9cc8badb443582537751d60415d45d0d177f39dc
SHA512 ad7870a047fa73bc0fb8948308ac67ad33fac9a63f17bbc556c96bfb84e1685e3462c26fa31da110cb7b2521888f078d54e8bbf51b78fc272cb047d40b1840b6
SSDEEP 768:t9RiZjbcHwbMBTNP1j72o6Cp5Nn2a85/ETtTIeqGAX:/oZjgHwQBTJ1FrFi/E9IeqGA
TLSH
T1DA332953BB5902EDE1A6A37CD59E1E09E6B6B44137134BCF07B0822A6E237C25D3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libzippp.dll

File Explorer

libzippp.dll

.dll 50KB

libzippp.dll

IMPHASH c728ef361de1d01abf773e23d524bc93
SHA256 ec0faf53d7ffb05fe4ab339f4e2ae8e2c1e007c3d94faa2c45c80678144f5506
MD5 32de6252485d58cb01614c8d19965ef1
SHA1 9cc8badb443582537751d60415d45d0d177f39dc
SHA512 ad7870a047fa73bc0fb8948308ac67ad33fac9a63f17bbc556c96bfb84e1685e3462c26fa31da110cb7b2521888f078d54e8bbf51b78fc272cb047d40b1840b6
SSDEEP 768:t9RiZjbcHwbMBTNP1j72o6Cp5Nn2a85/ETtTIeqGAX:/oZjgHwQBTJ1FrFi/E9IeqGA
TLSH
T1DA332953BB5902EDE1A6A37CD59E1E09E6B6B44137134BCF07B0822A6E237C25D3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\tools\vcpkg\buildtrees\libzippp\x64-windows-rel\libzippp.pdb

zip

zip_name_locate zip_open zip_open_from_source zip_register_progress_callback_with_state zip_register_cancel_callback_with_state zip_stat_init zip_set_archive_comment zip_get_num_entries zip_source_buffer zip_source_buffer_create zip_source_close zip_source_file zip_source_free zip_source_keep zip_source_open zip_source_read zip_stat_index zip_get_archive_comment zip_fread zip_delete zip_set_file_compression zip_fopen_index zip_file_set_mtime zip_file_set_comment zip_file_rename zip_file_get_comment zip_file_add zip_fclose zip_error_strerror zip_error_set zip_error_init_with_code zip_error_init zip_error_fini zip_error_code_system zip_error_code_zip zip_get_error zip_discard zip_dir_add zip_close

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Xbad_function_call@std@@YAXXZ

vcruntime140

memcmp memchr _CxxThrowException __std_exception_destroy __std_exception_copy _purecall memcpy memmove __current_exception __current_exception_context __C_specific_handler memset __std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _initialize_narrow_environment _initterm_e _initialize_onexit_table _execute_onexit_table terminate _invalid_parameter_noinfo_noreturn _cexit _configure_narrow_argv _initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc free

kernel32

QueryPerformanceCounter IsDebuggerPresent InitializeSListHead DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId RtlCaptureContext IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry

??0ZipArchive@libzippp@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4Encryption@01@@Z ??0ZipEntry@libzippp@@AEAA@PEBVZipArchive@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K_JGIG22H@Z ??0ZipEntry@libzippp@@QEAA@AEBV01@@Z ??0ZipEntry@libzippp@@QEAA@XZ ??0ZipProgressListener@libzippp@@QEAA@$$QEAV01@@Z ??0ZipProgressListener@libzippp@@QEAA@AEBV01@@Z ??0ZipProgressListener@libzippp@@QEAA@XZ ??1ZipArchive@libzippp@@UEAA@XZ ??1ZipEntry@libzippp@@UEAA@XZ ??4ZipEntry@libzippp@@QEAAAEAV01@AEBV01@@Z ??4ZipProgressListener@libzippp@@QEAAAEAV01@$$QEAV01@@Z ??4ZipProgressListener@libzippp@@QEAAAEAV01@AEBV01@@Z ??_7ZipArchive@libzippp@@6B@ ??_7ZipEntry@libzippp@@6B@ ??_7ZipProgressListener@libzippp@@6B@ ?addData@ZipArchive@libzippp@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBX_K_N@Z ?addEntry@ZipArchive@libzippp@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?addFile@ZipArchive@libzippp@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?addProgressListener@ZipArchive@libzippp@@QEAAXPEAVZipProgressListener@2@@Z ?close@ZipArchive@libzippp@@QEAAHXZ ?createEntry@ZipArchive@libzippp@@AEBA?AVZipEntry@2@PEAUzip_stat@@@Z ?deleteEntry@ZipArchive@libzippp@@QEBAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?deleteEntry@ZipArchive@libzippp@@QEBAHAEBVZipEntry@2@@Z ?discard@ZipArchive@libzippp@@QEAAXXZ ?free@ZipArchive@libzippp@@SAXPEAV12@@Z ?fromBuffer@ZipArchive@libzippp@@SAPEAV12@PEBXI_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4Encryption@12@@Z ?fromSource@ZipArchive@libzippp@@SAPEAV12@PEAUzip_source@@W4OpenMode@12@_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4Encryption@12@@Z ?fromWritableBuffer@ZipArchive@libzippp@@SAPEAV12@PEAPEAXIW4OpenMode@12@_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4Encryption@12@@Z ?getBufferLength@ZipArchive@libzippp@@QEBA_KXZ ?getCRC@ZipEntry@libzippp@@QEBAHXZ ?getComment@ZipArchive@libzippp@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4State@12@@Z ?getComment@ZipEntry@libzippp@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getCompressionLevel@ZipArchive@libzippp@@QEBAIXZ ?getCompressionLevel@ZipEntry@libzippp@@QEBAIXZ ?getCompressionMethod@ZipArchive@libzippp@@QEBA?AW4CompressionMethod@2@XZ ?getCompressionMethod@ZipEntry@libzippp@@QEBA?AW4CompressionMethod@2@XZ ?getDate@ZipEntry@libzippp@@QEBA_JXZ ?getDeflatedSize@ZipEntry@libzippp@@QEBA_KXZ ?getEncryptionMethod@ZipEntry@libzippp@@QEBAGXZ ?getEntries@ZipArchive@libzippp@@QEBA?AV?$vector@VZipEntry@libzippp@@V?$allocator@VZipEntry@libzippp@@@std@@@std@@W4State@12@@Z ?getEntriesCount@ZipArchive@libzippp@@QEBA_JW4State@12@@Z ?getEntry@ZipArchive@libzippp@@QEBA?AVZipEntry@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1W4State@12@@Z ?getEntry@ZipArchive@libzippp@@QEBA?AVZipEntry@2@_JW4State@12@@Z ?getEntryComment@ZipArchive@libzippp@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVZipEntry@2@W4State@12@@Z ?getIndex@ZipEntry@libzippp@@QEBA_KXZ ?getMode@ZipArchive@libzippp@@QEBA?AW4OpenMode@12@XZ ?getName@ZipEntry@libzippp@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getNbEntries@ZipArchive@libzippp@@QEBA_JW4State@12@@Z ?getPath@ZipArchive@libzippp@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getProgressListeners@ZipArchive@libzippp@@QEBA?AV?$vector@PEAVZipProgressListener@libzippp@@V?$allocator@PEAVZipProgressListener@libzippp@@@std@@@std@@XZ ?getProgressPrecision@ZipArchive@libzippp@@QEBANXZ ?getSize@ZipEntry@libzippp@@QEBA_KXZ ?getZipHandle@ZipArchive@libzippp@@QEBAPEAUzip@@XZ ?getZipSource@ZipArchive@libzippp@@QEBAPEAUzip_source@@XZ ?hasEntry@ZipArchive@libzippp@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1W4State@12@@Z ?isDirectory@ZipEntry@libzippp@@QEBA_NXZ ?isEncrypted@ZipArchive@libzippp@@QEBA_NXZ ?isFile@ZipEntry@libzippp@@QEBA_NXZ ?isMutable@ZipArchive@libzippp@@QEBA_NXZ ?isNull@ZipEntry@libzippp@@QEBA_NXZ ?isOpen@ZipArchive@libzippp@@QEBA_NXZ ?open@ZipArchive@libzippp@@QEAA_NW4OpenMode@12@_N@Z ?openBuffer@ZipArchive@libzippp@@AEAA_NPEAPEAXIW4OpenMode@12@_N@Z ?openSource@ZipArchive@libzippp@@AEAA_NPEAUzip_source@@W4OpenMode@12@_N@Z ?readAsBinary@ZipEntry@libzippp@@QEBAPEAXW4State@ZipArchive@2@_K@Z ?readAsText@ZipEntry@libzippp@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4State@ZipArchive@2@_K@Z ?readContent@ZipEntry@libzippp@@QEBAHAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@W4State@ZipArchive@2@_K@Z ?readEntry@ZipArchive@libzippp@@QEBAHAEBVZipEntry@2@AEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@W4State@12@_K@Z ?readEntry@ZipArchive@libzippp@@QEBAHAEBVZipEntry@2@V?$function@$$A6A_NPEBX_K@Z@std@@W4State@12@_K@Z ?readEntry@ZipArchive@libzippp@@QEBAPEAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4State@12@_K@Z ?readEntry@ZipArchive@libzippp@@QEBAPEAXAEBVZipEntry@2@_NW4State@12@_K@Z ?removeComment@ZipArchive@libzippp@@QEBA_NXZ ?removeProgressListener@ZipArchive@libzippp@@QEAAXPEAVZipProgressListener@2@@Z ?renameEntry@ZipArchive@libzippp@@QEBAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?renameEntry@ZipArchive@libzippp@@QEBAHAEBVZipEntry@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setComment@ZipArchive@libzippp@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setComment@ZipEntry@libzippp@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setCompressionLevel@ZipArchive@libzippp@@QEAAXI@Z ?setCompressionLevel@ZipEntry@libzippp@@QEAA_NI@Z ?setCompressionMethod@ZipArchive@libzippp@@QEAAXW4CompressionMethod@2@@Z ?setCompressionMethod@ZipEntry@libzippp@@QEAA_NW4CompressionMethod@2@@Z ?setEntryComment@ZipArchive@libzippp@@QEBA_NAEBVZipEntry@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setEntryCompressionConfig@ZipArchive@libzippp@@QEBA_NAEAVZipEntry@2@W4CompressionMethod@2@I@Z ?setErrorHandlerCallback@ZipArchive@libzippp@@QEAAXP6AXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0HH@Z@Z ?setProgressPrecision@ZipArchive@libzippp@@QEAAXN@Z ?unlink@ZipArchive@libzippp@@QEAA_NXZ