Static task
static1
Behavioral task
behavioral1
Sample
cd0c052a4b4bac0cc6086be2daa85a10e03c68225281b7a71a36e469e913b3b6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cd0c052a4b4bac0cc6086be2daa85a10e03c68225281b7a71a36e469e913b3b6.exe
Resource
win10v2004-20220901-en
General
-
Target
cd0c052a4b4bac0cc6086be2daa85a10e03c68225281b7a71a36e469e913b3b6
-
Size
324KB
-
MD5
9003364fc71b4b05f7fcc2d2fe088920
-
SHA1
d6ca1abdbf5adcd7b26acf9ad5cedd394ecdb9d1
-
SHA256
cd0c052a4b4bac0cc6086be2daa85a10e03c68225281b7a71a36e469e913b3b6
-
SHA512
17861b815e6d20428caa2f8568dd4c35b77a81988d521c6af55fc2cb1537fb3e76ce6f3d56a58a43fe7f462672eb62ec0c7bbb8c4cc5a1fa1f30631ca70dc605
-
SSDEEP
6144:nlbIo6BduBt8kFK0HOOp7gd333333Y333333u6KOrmP+:aBdi/k8KOKm
Malware Config
Signatures
Files
-
cd0c052a4b4bac0cc6086be2daa85a10e03c68225281b7a71a36e469e913b3b6.exe windows x86
cef305ed2020d8cb6366e241bda2779f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
Process32NextW
GetCurrentThreadId
Process32FirstW
TerminateProcess
FlushInstructionCache
GetLastError
DeleteCriticalSection
RaiseException
lstrcmpiW
CreateMutexW
InterlockedDecrement
CreateToolhelp32Snapshot
LoadLibraryExW
GetModuleHandleW
SetLastError
LocalFree
GetCommandLineW
lstrcmpW
CreateDirectoryW
lstrcpynW
RemoveDirectoryW
GetVersionExW
FindFirstFileW
FindClose
Sleep
FindNextFileW
GetFileAttributesExW
DeleteFileW
CreateFileW
GetFileSize
WaitForSingleObject
WriteFile
SetFilePointer
SetEvent
TerminateThread
WaitForMultipleObjects
CreateEventW
ResetEvent
GetTickCount
OpenProcess
SizeofResource
LoadResource
GetModuleFileNameW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
FreeLibrary
GetProcessHeap
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
GetComputerNameW
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
OutputDebugStringW
IsBadReadPtr
GetFileAttributesW
GetLocalTime
FindResourceExW
LockResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetLogicalDrives
GetVolumeInformationW
GetDriveTypeW
InterlockedIncrement
InitializeCriticalSection
LoadLibraryW
GetCurrentProcess
DuplicateHandle
CreateProcessW
CloseHandle
GetProcAddress
GetStdHandle
ReadFile
CreatePipe
user32
LoadStringW
InvalidateRect
EndDialog
CallWindowProcW
SetWindowPos
GetDlgItem
GetParent
SendMessageW
DefWindowProcW
SetWindowTextW
MessageBoxW
GetWindowTextLengthW
GetDlgCtrlID
SetTimer
PostMessageW
ShowWindow
GetWindow
GetWindowTextW
EnableWindow
GetWindowRect
GetActiveWindow
DialogBoxParamW
UnregisterClassA
FindWindowA
SendMessageTimeoutW
IsIconic
CharNextW
MapWindowPoints
GetClientRect
LoadIconW
GetWindowLongW
LoadCursorW
SetWindowLongW
KillTimer
SetCursor
SystemParametersInfoW
RegisterClassExW
CreateWindowExW
GetClassInfoExW
SetRect
DestroyWindow
IsWindow
gdi32
CreateSolidBrush
SelectObject
GetStockObject
SetBkMode
SetTextColor
SetBkColor
GetObjectW
CreateFontIndirectW
advapi32
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyW
GetUserNameW
RegDeleteKeyW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
CommandLineToArgvW
ole32
CoLoadLibrary
CoUninitialize
CoTaskMemFree
CoInitialize
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CLSIDFromProgID
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoFreeLibrary
oleaut32
SysFreeString
VarUI4FromStr
SysAllocStringByteLen
SysAllocString
qqmusiccommon_new
?SetDoc@CMarkup@@QAE_NABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?OutOfElem@CMarkup@@QAE_NXZ
?IntoElem@CMarkup@@QAE_NXZ
?FindElem@CMarkup@@QAE_NUMCD_CSTR@@@Z
?GetOsVersion@qqmusic@@YAXAAK0@Z
?WriteLog@qqmusic@@YAXKPB_WZZ
?InitVersionInfo@qqmusic@@YAHPAUHINSTANCE__@@@Z
?GetAppVersionBuildNo@qqmusic@@YAIXZ
?GetAppVersion@qqmusic@@YAIXZ
?GetAppDataFolder@qqmusic@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?UTF8To16@CMarkup@@SAHPAGPBDH@Z
?GetAttrib@CMarkup@@QBE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@UMCD_CSTR@@@Z
?GetData@CMarkup@@QBE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
??1CMarkup@@QAE@XZ
??0CMarkup@@QAE@XZ
shlwapi
StrCmpW
wnsprintfW
PathFileExistsW
msvcp80
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
msvcr80
_invoke_watson
_controlfp_s
strncpy_s
_getpid
towlower
_local_unwind4
srand
_snprintf_s
_vsnwprintf_s
wcsncat_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??3@YAXPAX@Z
memmove_s
iswspace
free
??_V@YAXPAX@Z
malloc
memcpy_s
_vscwprintf
vswprintf_s
wcstoul
wcschr
wcsstr
??2@YAPAXI@Z
_recalloc
wcsncpy_s
_wtoi
_purecall
wprintf_s
_time64
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
wcsrchr
calloc
_beginthreadex
swprintf_s
_CxxThrowException
memcpy
memset
_wcsicmp
__CxxFrameHandler3
fputc
__iob_func
exit
rand
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
netapi32
Netbios
wininet
InternetCanonicalizeUrlW
InternetReadFileExA
InternetSetStatusCallbackW
InternetConnectW
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
InternetQueryOptionW
InternetCloseHandle
InternetSetOptionW
InternetOpenW
wintrust
WinVerifyTrust
crypt32
CertCloseStore
CryptMsgGetParam
CryptQueryObject
CertFreeCertificateContext
CertGetNameStringW
CertCreateCertificateContext
CryptMsgClose
Sections
.text Size: 148KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE