685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971

Sharing

Copy URL Twitter E-mail

General

Target
685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971
Size 589KB
Sample221121-nw2tbacf3s
SHA256 685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971
MD5 3b0cc8b216505e407de1c7d1d13a05b0
SHA1 2662bceb79c5fbb22e0d0d6103bc5770867993dd
SHA512 d2a6fe64e9c94a5d95537585167813432deba0b595283034167a51393c04d8be26dca5544e380019d428d8d9b7079763de48bb1970f037cc9184730013c25e55
SSDEEP 12288:TIAT+0PpJlc8jecAyHNkCBVPIHOljydP2s5byxDLVp6VAd+KU:y0pc8tVIOl2dP3UJLVp6V6U
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971

.exe 589KB

685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971

IMPHASH 3b4d575f36f0f3608e33f41c1a242406
SHA256 685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971
MD5 3b0cc8b216505e407de1c7d1d13a05b0
SHA1 2662bceb79c5fbb22e0d0d6103bc5770867993dd
SHA512 d2a6fe64e9c94a5d95537585167813432deba0b595283034167a51393c04d8be26dca5544e380019d428d8d9b7079763de48bb1970f037cc9184730013c25e55
SSDEEP 12288:TIAT+0PpJlc8jecAyHNkCBVPIHOljydP2s5byxDLVp6VAd+KU:y0pc8tVIOl2dP3UJLVp6V6U
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

11758

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

qbutilities

?GetReDirectFileInstance@ReDirectFile@Util@@SAPAV12@XZ ?GetMemoryManager@Util@@YAAAVIMemoryManager@1@XZ ??0OpsContext@Util@@QAE@XZ ??1OpsContext@Util@@UAE@XZ ??RMessageFunctor@Ops@Util@@QBAXPBDZZ ??0MessageFunctor@Ops@Util@@QAE@AAV12@W4Level@12@W4EventType@12@PBDJ33@Z ?GetOps@Util@@YAAAVOps@1@XZ ?GetFailed@Status@Util@@SAABV12@XZ ??4Status@Util@@QAEAAV01@ABV01@@Z ?GetSystemAccessDenied@Status@Util@@SAABV12@XZ ?IsProcessRunningWithAdminPrivileges@Util@@YA_NXZ ?IsWindowsUserAnAdmin@Util@@YA_NXZ ?GetSucceeded@Status@Util@@SAABV12@XZ ?GetInvalidArg@Status@Util@@SAABV12@XZ ?Failed@Status@Util@@QBE_NXZ ?GetStatusMessage@Status@Util@@QBEABV?$TString@DV?$TStringAllocator@D@Util@@@2@XZ ?GetLongAttribute@Status@Util@@QBEJPBD@Z ?FormatStringV@Util@@YAPADPBDPAD@Z ?EndOperations@Ops@Util@@QAEXXZ ?BeginOperations@Ops@Util@@QAEXPBVOpsContext@2@@Z ?CreateDOMDocument@MSXML_XML@Util@@YAJPAPAUIXMLDOMDocument2@MSXML2@@@Z ?AddSubscriptionStr@OpsSubscriptionManager@Util@@QAEXPBD0@Z ??1MessageFunctor@Ops@Util@@QAE@XZ ?SetOpsFileLogDirectory@OpsContext@Util@@UAEXABV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z ?SetOpsFileConfigDirectory@OpsContext@Util@@UAEXABV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z ?GetOpsLogDirectory@OpsContext@Util@@UBEXAAV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z ?GetOpsDirectory@OpsContext@Util@@UBEXAAV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z ?CompareStrings@Util@@YA?AW4StringCompareResult@1@PBD0W4CaseSensitivity@1@@Z ?SetReleaseMode@ReDirectFile@Util@@QAEXW4ReleaseModeTypeID@12@@Z ?GetStringAttribute@Status@Util@@QBEXPBDAAV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z ?GetDirectoryFromId@ReDirectFile@Util@@QAE?BV?$TString@DV?$TStringAllocator@D@Util@@@2@W4BaseDirectory@12@@Z ?CopyString@Util@@YAPADPADIPBD@Z ?StringLength@Util@@YAIPBD@Z ??1Status@Util@@QAE@XZ ??0Status@Util@@QAE@ABV01@@Z ?Succeeded@Status@Util@@QBE_NXZ ?GetStatusCode@Status@Util@@QBEJXZ ?AttributeExists@Status@Util@@QBE_NPBD@Z

databasemanager

?StartServer@DBManager@DBMgr@@SA?AVStatus@Util@@XZ ?RestartServer@DBManager@DBMgr@@SA?AVStatus@Util@@XZ ?ResetServerConfig@DBManager@DBMgr@@SA?AVStatus@Util@@XZ ?StartMonitorService@DBManager@DBMgr@@SA?AVStatus@Util@@XZ ?SetServerMode@DBManager@DBMgr@@SA?AVStatus@Util@@W4ServerMode@2@_N@Z ?StartPersonalSecondaryServer@DBManager@DBMgr@@SA?AVStatus@Util@@W4ServerType@2@W4ServerExeVersion@2@PBD@Z ?SetCacheSize@DBManager@DBMgr@@SA?AVStatus@Util@@J_N@Z ?SetInitialCacheSize@DBManager@DBMgr@@SA?AVStatus@Util@@J_N@Z ?StopServer@DBManager@DBMgr@@SA?AVStatus@Util@@_N0@Z

ole32

CoUninitialize CoInitialize

stlport_r50

?_Assert@?$__stl_debug_engine@_N@stlp_std@@SAXPBD0H@Z ?deallocate@?$__debug_alloc@V?$__node_alloc@$00$0A@@stlp_std@@@stlp_std@@SAXPAXI@Z ?allocate@?$__debug_alloc@V?$__node_alloc@$00$0A@@stlp_std@@@stlp_std@@SAPAXI@Z

msvcr90

strspn _controlfp_s _invoke_watson _except_handler4_common _decode_pointer _onexit _lock __dllonexit _unlock ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _crt_debugger_hook __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm __initenv _XcptFilter _exit _cexit __getmainargs _amsg_exit exit puts strcspn __CxxFrameHandler3 ??3@YAXPAX@Z strlen strcat_s isdigit atoi strcmp

kernel32

GetCurrentThreadId GetTickCount IsDebuggerPresent QueryPerformanceCounter InterlockedExchange Sleep InterlockedCompareExchange TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcessId GetSystemTimeAsFileTime