QTExecutionSite[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

QTExecutionSite.dll
Size

432KB
MD5

e1448338cd029db0b6b4bdf900093902
SHA1

3396510d02f4ada6bd57af99b24b863c11dacd25
SHA256

77b5221c6a4f29ffb9c0d8592ee476954a200e07ba4ac605e8106108f761a747
SHA512

a748003ffa2496025545e49f4d18a254b5921be61a04de1ec25a794e1f3865eb753cfd7486514a864b714fedfbcc73e7e42e5ca6ff19f52e59b44ff2566188c0
SSDEEP

6144:LxhJydzrbrBehOnZHcNphtOFKFGPxlHu6jeDeCMZ5t/V:1hJYzrbrgqKA0FiHu6KDoH

Score

N/A

Malware Config

Signatures

Files

QTExecutionSite.dll
.dll regsvr32 windows x86

69a007433184391e52dd4b219e4f28f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathIsRelativeW

kernel32

CreateFileW
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
CreateEventW
CloseHandle
lstrlenW
InterlockedDecrement
MultiByteToWideChar
ResetEvent
GetLastError
CreateProcessW
GetTickCount
LoadLibraryA
OutputDebugStringW
lstrcpyW
LoadLibraryExW
GlobalAlloc
RaiseException
WideCharToMultiByte
OpenEventW
SetEvent
FreeLibrary
LoadLibraryW
GetProcAddress
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
Sleep
GetCurrentThreadId
LeaveCriticalSection
LocalFree
FindResourceExW
FormatMessageW
EnterCriticalSection
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
GetFileSize
ReadFile
GlobalReAlloc
SetFilePointer
WriteFile
GlobalFree
GlobalLock
GlobalUnlock
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
lstrlenA
FindResourceW

user32

GetUserObjectInformationW
GetProcessWindowStation
SwitchDesktop
GetThreadDesktop
BlockInput
GetDC
SetCursor
LoadCursorW
ClientToScreen
GetClientRect
GetWindowRect
SystemParametersInfoW
IsRectEmpty
GetDoubleClickTime
MessageBoxW
ReleaseDC
MsgWaitForMultipleObjects
LoadStringW
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegDeleteValueW

ole32

CoGetClassObject
StringFromCLSID
CoTaskMemFree
CLSIDFromProgID
OleLoadFromStream
OleSaveToStream
WriteClassStm
CoCreateInstance

oleaut32

SafeArrayRedim
VarCmp
SysReAllocStringLen
SafeArrayLock
SafeArrayGetElement
VariantCopy
RegisterTypeLi
DispCallFunc
VariantChangeType
VarDecCmp
SafeArrayDestroyData
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayDestroyDescriptor
SafeArrayPutElement
LoadTypeLi
LoadRegTypeLi
CreateErrorInfo
SetErrorInfo
VariantInit
SysStringLen
SysAllocStringLen
SafeArrayCopy
SafeArrayUnlock
SafeArrayCreate
SafeArrayGetVartype
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
VariantClear
SysAllocString
SysFreeString
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayUnaccessData
GetErrorInfo

atl71

ord18
ord49
ord55
ord56
ord22
ord10
ord32
ord31
ord58
ord30
ord23
ord61
ord64
ord15
ord11

msvcp71

?_Nomemory@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

miclogfile

?MicLogWriteToFileHr@@YA_NW4ELogLevel@@JPBGJPBDJ1ZZ
?MicLogWriteToFile@@YA_NW4ELogLevel@@JPBGJPBD1ZZ

msvcr71

_strdup
swprintf
wcscat
_purecall
realloc
wcschr
_access
wcsstr
wcsncpy
iswdigit
_wtoi
strncpy
strncmp
_callnewh
__security_error_handler
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
_wcsicmp
gmtime
time
fclose
_wfopen
_setjmp3
sprintf
fwrite
fflush
printf
longjmp
fprintf
_iob
wcstol
calloc
??1type_info@@UAE@XZ
??0exception@@QAE@XZ
??3@YAXPAX@Z
??_V@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memcpy
_wcsnicmp
wcsrchr
free
iswspace
memset
wcstok
wcscpy
wcslen
wcscmp
_resetstkoflw
_except_handler3
malloc
memmove
memcmp
_vscwprintf
vswprintf
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ

micpackvariant

?PackVariant@@YAJUtagVARIANT@@PAPAXPAK@Z
?UnpackVariant@@YAJPBXPAUtagVARIANT@@PAK@Z

zlibu

ord3
ord10
ord7
ord4
ord6

gdi32

DeleteObject
GetStockObject
SelectObject
DeleteDC
BitBlt
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCW
StretchDIBits
SetDIBitsToDevice
SetStretchBltMode
RealizePalette
SelectPalette
StretchBlt
CreatePalette
CreateDIBitmap
GetDIBits
GetObjectW
GetSystemPaletteEntries

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
png_IDAT
png_IEND
png_IHDR
png_PLTE
png_bKGD
png_cHRM
png_check_sig
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_write_struct
png_destroy_info_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_gAMA
png_get_copyright
png_get_error_ptr
png_get_header_ver
png_get_header_version
png_get_io_ptr
png_get_libpng_ver
png_get_user_transform_ptr
png_hIST
png_iCCP
png_iTXt
png_init_io
png_malloc
png_memcpy_check
png_memset_check
png_oFFs
png_pCAL
png_pHYs
png_permit_empty_plte
png_sBIT
png_sCAL
png_sPLT
png_sRGB
png_set_IHDR
png_set_PLTE
png_set_bKGD
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_error_fn
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_read_user_chunk_fn
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_text
png_set_unknown_chunks
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_bytes
png_sig_cmp
png_tEXt
png_tIME
png_tRNS
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_zTXt

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69a007433184391e52dd4b219e4f28f1

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

atl71

msvcp71

miclogfile

msvcr71

micpackvariant

zlibu

gdi32

Exports

Exports

Sections

.text Size: 276KB - Virtual size: 275KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 12KB - Virtual size: 9KB

.rsrc Size: 36KB - Virtual size: 34KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 276KB - Virtual size: 275KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 36KB - Virtual size: 34KB

.reloc
Size: 32KB - Virtual size: 31KB