d3dafe67af147ee88eedb8b408b4fa51428e9daf7cd0c7102d9b353fd351155f

Sharing

Copy URL Twitter E-mail

General

Target

d3dafe67af147ee88eedb8b408b4fa51428e9daf7cd0c7102d9b353fd351155f
Size

1.7MB
MD5

0d98810ba6c63e572ed8c3aead554e83
SHA1

d1a94249746a1f1e90998a44ae77ac89ffa06d09
SHA256

d3dafe67af147ee88eedb8b408b4fa51428e9daf7cd0c7102d9b353fd351155f
SHA512

bfb110312d1665a5e27a24b93fd3e30ec0d8f169528ac5a1a52f0d0a5d897dcdbe8286fcadd62a8f2cfbfdb27de0102d555e15d11693c26e6cd259584906dee7
SSDEEP

24576:d+N290QIzCJ3u2xvYm541SkEOxiyZC6+36QK6aTBpysV2cGMGzpoEVqJ:Acp5Vy1PiSC9fK6KBpDVWoEVqJ

Score

N/A

Malware Config

Signatures

Files

d3dafe67af147ee88eedb8b408b4fa51428e9daf7cd0c7102d9b353fd351155f
.exe windows x86

cd77cd812931b045b68948ff0f0729b7

Code Sign

37:31:12:9f:75:d9:d5:f0:70:e5:db:ff:76:14:17:cc
Certificate

Issuer

CN=WoSign Class 2 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

18/12/2015, 07:46

Not After

18/06/2016, 07:46

Subject

CN=Zhang Qingming,L=Xin'an,ST=Henan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4e:9a:d8:05:bb:29:ad:45:5a:98:8c:2a:55:d9:42:2d
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 2 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:74:a9:d6:76:78:0f:02:7f:7b:a4:93:1f:d4:e9:86:0d:64:8d:d8
Signer

Actual PE Digest

d3:74:a9:d6:76:78:0f:02:7f:7b:a4:93:1f:d4:e9:86:0d:64:8d:d8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Zhang Qingming,L=Xin'an,ST=Henan,C=CN

15/03/2016, 10:26
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteExA
ShellExecuteA

kernel32

GetModuleFileNameA
GetModuleFileNameW
GetFileSize
Sleep
GetTickCount
RemoveDirectoryA
GetVersionExA
GetCurrentProcess
GetSystemDirectoryA
HeapReAlloc
SystemTimeToFileTime
GetLocalTime
FileTimeToDosDateTime
ReadFile
GetSystemTimeAsFileTime
OutputDebugStringA
GetCurrentThreadId
GetStdHandle
SetConsoleTitleA
AllocConsole
FreeConsole
SetLastError
FormatMessageA
SleepEx
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
TlsAlloc
TlsFree
TlsGetValue
OpenEventA
ResetEvent
TlsSetValue
ResumeThread
MoveFileExA
GetShortPathNameA
GetWindowsDirectoryA
SetFileAttributesA
GetLongPathNameA
LoadLibraryA
FreeLibrary
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
CreateEventA
SetEvent
CreateMutexA
CopyFileA
CreateFileA
GetFileAttributesA
GetCommandLineW
GetVersion
GetFileType
GlobalMemoryStatus
FlushConsoleInputBuffer
GetLastError
CloseHandle
WriteFile
CreateDirectoryA
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA

qt5core

??0QObject@@QAE@PAV0@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
??1QObject@@UAE@XZ
??1QTranslator@@UAE@XZ
?registerResource@QResource@@SA_NABVQString@@0@Z
?installTranslator@QCoreApplication@@SA_NPAVQTranslator@@@Z
?load@QTranslator@@QAE_NABVQString@@000@Z
??0QString@@QAE@XZ
??0QTranslator@@QAE@PAVQObject@@@Z
??1QSharedMemory@@UAE@XZ
?setCodecForLocale@QTextCodec@@SAXPAV1@@Z
?codecForName@QTextCodec@@SAPAV1@PBD@Z
?detach@QSharedMemory@@QAE_NXZ
?data@QSharedMemory@@QAEPAXXZ
?attach@QSharedMemory@@QAE_NW4AccessMode@1@@Z
?error@QSharedMemory@@QBE?AW4SharedMemoryError@1@XZ
?create@QSharedMemory@@QAE_NHW4AccessMode@1@@Z
??1QString@@QAE@XZ
??0QSharedMemory@@QAE@ABVQString@@PAVQObject@@@Z
??0QString@@QAE@PBD@Z
??1QUrl@@QAE@XZ
??0QString@@QAE@ABV0@@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
?setUrl@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
??YQString@@QAEAAV0@ABV0@@Z
?fromUtf8@QString@@SA?AV1@PBDH@Z
??8QString@@QBE_NPBD@Z
??1QVariant@@QAE@XZ
?toInt@QVariant@@QBEHPA_N@Z
?property@QObject@@QBE?AVQVariant@@PBD@Z
??4QString@@QAEAAV0@PBD@Z
?start@QTimer@@QAEXH@Z
??1Connection@QMetaObject@@QAE@XZ
?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z
??0QTimer@@QAE@PAVQObject@@@Z
??4QString@@QAEAAV0@ABV0@@Z
?fromLocal8Bit@QString@@SA?AV1@PBDH@Z
?metaObject@QSharedMemory@@UBEPBUQMetaObject@@XZ
?qt_metacast@QSharedMemory@@UAEPAXPBD@Z
?qt_metacall@QSharedMemory@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QTimer@@UBEPBUQMetaObject@@XZ
?qt_metacast@QTimer@@UAEPAXPBD@Z
?qt_metacall@QTimer@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?timerEvent@QTimer@@MAEXPAVQTimerEvent@@@Z
?connectSlotsByName@QMetaObject@@SAXPAVQObject@@@Z
??0QSize@@QAE@XZ
?setObjectName@QObject@@QAEXABVQString@@@Z
?isEmpty@QString@@QBE_NXZ
?objectName@QObject@@QBE?AVQString@@XZ
?translate@QCoreApplication@@SA?AVQString@@PBD00H@Z
??1QTimer@@UAE@XZ
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
?height@QSize@@QBEHXZ
?width@QSize@@QBEHXZ
?arg@QString@@QBE?AV1@HHHVQChar@@@Z
??0QChar@@QAE@UQLatin1Char@@@Z
??8@YA_NABVQString@@0@Z
?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z
??1QByteArray@@QAE@XZ
??0QByteArray@@QAE@PBDH@Z
?className@QMetaObject@@QBEPBDXZ
?qBadAlloc@@YAXXZ
?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAXPBX@Z2P6APAX13@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z
?registerNormalizedTypedef@QMetaType@@SAHABVQByteArray@@H@Z
?append@QByteArray@@QAEAAV1@D@Z
?append@QByteArray@@QAEAAV1@PBD@Z
?reserve@QByteArray@@QAEXH@Z
??0QByteArray@@QAE@XZ
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?qt_metacast@QObject@@UAEPAXPBD@Z
?qt_metacall@QObject@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z
?staticMetaObject@QObject@@2UQMetaObject@@B
?toLocal8Bit@QString@@QBE?AVQByteArray@@XZ
?data@QByteArray@@QAEPADXZ
?qWinMain@@YAXPAUHINSTANCE__@@0PADHAAHAAV?$QVector@PAD@@@Z
?shared_null@QArrayData@@2QBU1@B
?deallocate@QArrayData@@SAXPAU1@II@Z
?allocate@QArrayData@@SAPAU1@IIIV?$QFlags@W4AllocationOption@QArrayData@@@@@Z
?data@QArrayData@@QAEPAXXZ
?fromWCharArray@QString@@SA?AV1@PB_WH@Z

qt5gui

?surfaceHandle@QWindow@@EBEPAVQPlatformSurface@@XZ
?surfaceType@QWindow@@UBE?AW4SurfaceType@QSurface@@XZ
?size@QWindow@@UBE?AVQSize@@XZ
?addFile@QIcon@@QAEXABVQString@@ABVQSize@@W4Mode@1@W4State@1@@Z
??0QIcon@@QAE@XZ
?openUrl@QDesktopServices@@SA_NABVQUrl@@@Z
??1QImage@@UAE@XZ
?size@QImage@@QBE?AVQSize@@XZ
?load@QImage@@QAE_NABVQString@@PBD@Z
??0QImage@@QAE@XZ
?nativeEvent@QWindow@@MAE_NABVQByteArray@@PAXPAJ@Z
?tabletEvent@QWindow@@MAEXPAVQTabletEvent@@@Z
?touchEvent@QWindow@@MAEXPAVQTouchEvent@@@Z
?moveEvent@QWindow@@MAEXPAVQMoveEvent@@@Z
??0QIcon@@QAE@ABVQString@@@Z
??1QIcon@@QAE@XZ
?screen@QWindow@@QBEPAVQScreen@@XZ
?format@QWindow@@UBE?AVQSurfaceFormat@@XZ
??1QCursor@@QAE@XZ
?setCursor@QWindow@@QAEXABVQCursor@@@Z
??0QCursor@@QAE@W4CursorShape@Qt@@@Z
?logicalDotsPerInch@QScreen@@QBENXZ

qt5qml

?setContextProperty@QQmlContext@@QAEXABVQString@@PAVQObject@@@Z
?qdeclarativeelement_destructor@QQmlPrivate@@YAXPAVQObject@@@Z
?qmlregister@QQmlPrivate@@YAHW4RegistrationType@1@PAX@Z

qt5quick

??1QQuickView@@UAE@XZ
?setSource@QQuickView@@QAEXABVQUrl@@@Z
?rootContext@QQuickView@@QBEPAVQQmlContext@@XZ
??0QQuickView@@QAE@PAVQWindow@@@Z
?event@QQuickWindow@@MAE_NPAVQEvent@@@Z
?timerEvent@QQuickView@@MAEXPAVQTimerEvent@@@Z
?accessibleRoot@QQuickWindow@@UBEPAVQAccessibleInterface@@XZ
?focusObject@QQuickWindow@@UBEPAVQObject@@XZ
?exposeEvent@QQuickWindow@@MAEXPAVQExposeEvent@@@Z
?resizeEvent@QQuickView@@MAEXPAVQResizeEvent@@@Z
?focusInEvent@QQuickWindow@@MAEXPAVQFocusEvent@@@Z
?focusOutEvent@QQuickWindow@@MAEXPAVQFocusEvent@@@Z
?showEvent@QQuickWindow@@MAEXPAVQShowEvent@@@Z
?hideEvent@QQuickWindow@@MAEXPAVQHideEvent@@@Z
?keyPressEvent@QQuickView@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QQuickView@@MAEXPAVQKeyEvent@@@Z
?mousePressEvent@QQuickView@@MAEXPAVQMouseEvent@@@Z
?mouseReleaseEvent@QQuickView@@MAEXPAVQMouseEvent@@@Z
?mouseDoubleClickEvent@QQuickWindow@@MAEXPAVQMouseEvent@@@Z
?mouseMoveEvent@QQuickView@@MAEXPAVQMouseEvent@@@Z
?wheelEvent@QQuickWindow@@MAEXPAVQWheelEvent@@@Z
?event@QQuickItem@@MAE_NPAVQEvent@@@Z
?boundingRect@QQuickItem@@UBE?AVQRectF@@XZ
?clipRect@QQuickItem@@UBE?AVQRectF@@XZ
?contains@QQuickItem@@UBE_NABVQPointF@@@Z
?inputMethodQuery@QQuickItem@@UBE?AVQVariant@@W4InputMethodQuery@Qt@@@Z
?isTextureProvider@QQuickItem@@UBE_NXZ
?textureProvider@QQuickItem@@UBEPAVQSGTextureProvider@@XZ
?itemChange@QQuickItem@@MAEXW4ItemChange@1@ABTItemChangeData@1@@Z
?keyPressEvent@QQuickItem@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QQuickItem@@MAEXPAVQKeyEvent@@@Z
?inputMethodEvent@QQuickItem@@MAEXPAVQInputMethodEvent@@@Z
?focusInEvent@QQuickItem@@MAEXPAVQFocusEvent@@@Z
?focusOutEvent@QQuickItem@@MAEXPAVQFocusEvent@@@Z
?mousePressEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z
?mouseMoveEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z
?mouseReleaseEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z
?mouseDoubleClickEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z
?mouseUngrabEvent@QQuickItem@@MAEXXZ
?touchUngrabEvent@QQuickItem@@MAEXXZ
?wheelEvent@QQuickItem@@MAEXPAVQWheelEvent@@@Z
?touchEvent@QQuickItem@@MAEXPAVQTouchEvent@@@Z
?hoverEnterEvent@QQuickItem@@MAEXPAVQHoverEvent@@@Z
?hoverMoveEvent@QQuickItem@@MAEXPAVQHoverEvent@@@Z
?hoverLeaveEvent@QQuickItem@@MAEXPAVQHoverEvent@@@Z
?dragEnterEvent@QQuickItem@@MAEXPAVQDragEnterEvent@@@Z
?dragMoveEvent@QQuickItem@@MAEXPAVQDragMoveEvent@@@Z
?dragLeaveEvent@QQuickItem@@MAEXPAVQDragLeaveEvent@@@Z
?dropEvent@QQuickItem@@MAEXPAVQDropEvent@@@Z
?childMouseEventFilter@QQuickItem@@MAE_NPAV1@PAVQEvent@@@Z
?windowDeactivateEvent@QQuickItem@@MAEXXZ
?geometryChanged@QQuickItem@@MAEXABVQRectF@@0@Z
?updatePaintNode@QQuickItem@@MAEPAVQSGNode@@PAV2@PAUUpdatePaintNodeData@1@@Z
?releaseResources@QQuickItem@@MAEXXZ
?updatePolish@QQuickItem@@MAEXXZ
?classBegin@QQuickItem@@MAEXXZ
?componentComplete@QQuickItem@@MAEXXZ
??0QQuickItem@@QAE@PAV0@@Z
??1QQuickItem@@UAE@XZ
?qt_metacast@QQuickItem@@UAEPAXPBD@Z
?qt_metacall@QQuickItem@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?staticMetaObject@QQuickItem@@2UQMetaObject@@B
?qt_metacast@QQuickView@@UAEPAXPBD@Z
?qt_metacall@QQuickView@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?staticMetaObject@QQuickView@@2UQMetaObject@@B
?rootObject@QQuickView@@QBEPAVQQuickItem@@XZ

qt5widgets

?focusInEvent@QWidget@@MAEXPAVQFocusEvent@@@Z
?keyReleaseEvent@QWidget@@MAEXPAVQKeyEvent@@@Z
?keyPressEvent@QDialog@@MAEXPAVQKeyEvent@@@Z
?wheelEvent@QWidget@@MAEXPAVQWheelEvent@@@Z
?mouseMoveEvent@QWidget@@MAEXPAVQMouseEvent@@@Z
?mouseDoubleClickEvent@QWidget@@MAEXPAVQMouseEvent@@@Z
?mouseReleaseEvent@QWidget@@MAEXPAVQMouseEvent@@@Z
?mousePressEvent@QWidget@@MAEXPAVQMouseEvent@@@Z
?hasHeightForWidth@QWidget@@UBE_NXZ
?heightForWidth@QWidget@@UBEHH@Z
?minimumSizeHint@QDialog@@UBE?AVQSize@@XZ
?sizeHint@QDialog@@UBE?AVQSize@@XZ
?focusOutEvent@QWidget@@MAEXPAVQFocusEvent@@@Z
?eventFilter@QDialog@@MAE_NPAVQObject@@PAVQEvent@@@Z
?event@QWidget@@MAE_NPAVQEvent@@@Z
??0QDialog@@QAE@PAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z
?setWindowFlags@QWidget@@QAEXV?$QFlags@W4WindowType@Qt@@@@@Z
?createWindowContainer@QWidget@@SAPAV1@PAVQWindow@@PAV1@V?$QFlags@W4WindowType@Qt@@@@@Z
?addWidget@QBoxLayout@@QAEXPAVQWidget@@HV?$QFlags@W4AlignmentFlag@Qt@@@@@Z
??1QDialog@@UAE@XZ
?resize@QWidget@@QAEXHH@Z
??0QApplication@@QAE@AAHPAPADH@Z
?setWindowIcon@QWidget@@QAEXABVQIcon@@@Z
?show@QWidget@@QAEXXZ
?exec@QApplication@@SAHXZ
??1QApplication@@UAE@XZ
?enterEvent@QWidget@@MAEXPAVQEvent@@@Z
?leaveEvent@QWidget@@MAEXPAVQEvent@@@Z
?paintEvent@QWidget@@MAEXPAVQPaintEvent@@@Z
?moveEvent@QWidget@@MAEXPAVQMoveEvent@@@Z
?resizeEvent@QDialog@@MAEXPAVQResizeEvent@@@Z
?closeEvent@QDialog@@MAEXPAVQCloseEvent@@@Z
?contextMenuEvent@QDialog@@MAEXPAVQContextMenuEvent@@@Z
?tabletEvent@QWidget@@MAEXPAVQTabletEvent@@@Z
?actionEvent@QWidget@@MAEXPAVQActionEvent@@@Z
?dragEnterEvent@QWidget@@MAEXPAVQDragEnterEvent@@@Z
?dragMoveEvent@QWidget@@MAEXPAVQDragMoveEvent@@@Z
?staticMetaObject@QDialog@@2UQMetaObject@@B
?qt_metacall@QDialog@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QDialog@@UAEPAXPBD@Z
?warning@QMessageBox@@SA?AW4StandardButton@1@PAVQWidget@@ABVQString@@1V?$QFlags@W4StandardButton@QMessageBox@@@@W421@@Z
?activateWindow@QWidget@@QAEXXZ
?raise@QWidget@@QAEXXZ
?isMinimized@QWidget@@QBE_NXZ
?showNormal@QWidget@@QAEXXZ
?showMinimized@QWidget@@QAEXXZ
?isActiveWindow@QWidget@@QBE_NXZ
??1QVBoxLayout@@UAE@XZ
?setWindowTitle@QWidget@@QAEXABVQString@@@Z
?controlTypes@QLayout@@UBE?AV?$QFlags@W4ControlType@QSizePolicy@@@@XZ
?spacerItem@QLayoutItem@@UAEPAVQSpacerItem@@XZ
?layout@QLayout@@UAEPAV1@XZ
?widget@QLayoutItem@@UAEPAVQWidget@@XZ
?invalidate@QBoxLayout@@UAEXXZ
?minimumHeightForWidth@QBoxLayout@@UBEHH@Z
?heightForWidth@QBoxLayout@@UBEHH@Z
?hasHeightForWidth@QBoxLayout@@UBE_NXZ
?isEmpty@QLayout@@UBE_NXZ
?geometry@QLayout@@UBE?AVQRect@@XZ
?setGeometry@QBoxLayout@@UAEXABVQRect@@@Z
?expandingDirections@QBoxLayout@@UBE?AV?$QFlags@W4Orientation@Qt@@@@XZ
?maximumSize@QBoxLayout@@UBE?AVQSize@@XZ
?minimumSize@QBoxLayout@@UBE?AVQSize@@XZ
?sizeHint@QBoxLayout@@UBE?AVQSize@@XZ
?count@QBoxLayout@@UBEHXZ
?indexOf@QLayout@@UBEHPAVQWidget@@@Z
?dragLeaveEvent@QWidget@@MAEXPAVQDragLeaveEvent@@@Z
?itemAt@QBoxLayout@@UBEPAVQLayoutItem@@H@Z
?addItem@QBoxLayout@@UAEXPAVQLayoutItem@@@Z
?childEvent@QLayout@@MAEXPAVQChildEvent@@@Z
?qt_metacall@QVBoxLayout@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QVBoxLayout@@UAEPAXPBD@Z
?metaObject@QVBoxLayout@@UBEPBUQMetaObject@@XZ
??0QVBoxLayout@@QAE@PAVQWidget@@@Z
?setSpacing@QBoxLayout@@QAEXH@Z
?setContentsMargins@QLayout@@QAEXHHHH@Z
?sharedPainter@QWidget@@MBEPAVQPainter@@XZ
?redirected@QWidget@@MBEPAVQPaintDevice@@PAVQPoint@@@Z
?initPainter@QWidget@@MBEXPAVQPainter@@@Z
?metric@QWidget@@MBEHW4PaintDeviceMetric@QPaintDevice@@@Z
?paintEngine@QWidget@@UBEPAVQPaintEngine@@XZ
?devType@QWidget@@UBEHXZ
?reject@QDialog@@UAEXXZ
?accept@QDialog@@UAEXXZ
?done@QDialog@@UAEXH@Z
?exec@QDialog@@UAEHXZ
?open@QDialog@@UAEXXZ
?focusNextPrevChild@QWidget@@MAE_N_N@Z
?inputMethodQuery@QWidget@@UBE?AVQVariant@@W4InputMethodQuery@Qt@@@Z
?inputMethodEvent@QWidget@@MAEXPAVQInputMethodEvent@@@Z
?nativeEvent@QWidget@@MAE_NABVQByteArray@@PAXPAJ@Z
?changeEvent@QWidget@@MAEXPAVQEvent@@@Z
?hideEvent@QWidget@@MAEXPAVQHideEvent@@@Z
?showEvent@QDialog@@MAEXPAVQShowEvent@@@Z
?setVisible@QDialog@@UAEX_N@Z
?dropEvent@QWidget@@MAEXPAVQDropEvent@@@Z
?takeAt@QBoxLayout@@UAEPAVQLayoutItem@@H@Z
?setFocusPolicy@QWidget@@QAEXW4FocusPolicy@Qt@@@Z

zlibwapi

ord3
ord21
ord19
ord20
ord7
ord4
ord6
ord46

msvcp90

?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Xlen@_String_base@std@@SAXXZ
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?max@?$numeric_limits@K@std@@SAKXZ
?min@?$numeric_limits@K@std@@SAKXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?NDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1locale@std@@QAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eof@?$char_traits@D@std@@SAHXZ
?not_eof@?$char_traits@D@std@@SAHABH@Z
?eq@?$char_traits@D@std@@SA_NABD0@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?copy@?$char_traits@D@std@@SAPADPADPBDI@Z
?allocate@?$allocator@D@std@@QAEPADIPBX@Z
?max@?$numeric_limits@I@std@@SAIXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$allocator@D@std@@QAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDU_Size_type_nosscl@01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?widen@?$ctype@D@std@@QBEDD@Z
??1_Lockit@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??Bid@locale@std@@QAEIXZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?max@?$numeric_limits@H@std@@SAHXZ
??0locale@std@@QAE@ABV01@@Z
??0locale@std@@QAE@XZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?narrow@?$ctype@D@std@@QBEDDD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADU_Size_type_nosscl@01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?width@ios_base@std@@QAEHH@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?exceptions@ios_base@std@@QAEXH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flags@ios_base@std@@QAEHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?precision@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??4locale@std@@QAEAAV01@ABV01@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?_Xran@_String_base@std@@SAXXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?global@locale@std@@SA?AV12@ABV12@@Z
??0locale@std@@QAE@PBDH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@JHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPADH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

msvcr90

_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_beginthreadex
_gmtime64
getenv
_errno
strcat_s
strncpy_s
strcpy_s
fflush
isdigit
fputs
qsort
_strtoi64
isxdigit
strtol
memmove
strtoul
__iob_func
_stat64
__sys_nerr
strerror
strrchr
realloc
calloc
strncmp
isalnum
isalpha
tolower
_vsnprintf_s
fputc
ferror
fread
_except_handler3
_vsnprintf
_localtime64
memchr
ispunct
isspace
_time64
memcpy_s
rand
perror
rename
ftell
sscanf
_stat64i32
setlocale
strstr
fwrite
sprintf
_stricmp
fopen
rewind
fgets
_strnicmp
fseek
fprintf
fclose
_snprintf
strncpy
strchr
sprintf_s
atoi
??8type_info@@QBE_NABV0@@Z
memmove_s
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
_strdup
wcsstr
vfprintf
abort
_setmode
_fileno
feof
isupper
signal
_getch
??0bad_cast@std@@QAE@PBD@Z
wcstombs
malloc
free
??0exception@std@@QAE@ABQBD@Z
strlen
memcpy
memset
strcpy
strcmp
??0exception@std@@QAE@ABQBDH@Z
_purecall
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_controlfp_s

iphlpapi

GetAdaptersInfo

ws2_32

ioctlsocket
select
__WSAFDIsSet
gethostname
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
WSASetLastError
socket
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
closesocket
WSAStartup
WSACleanup
getservbyport
shutdown

user32

MessageBoxA
GetProcessWindowStation
GetDesktopWindow
GetUserObjectInformationW

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource

Sections

.text
Size: 789KB - Virtual size: 788KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 539KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd77cd812931b045b68948ff0f0729b7

Code Sign

37:31:12:9f:75:d9:d5:f0:70:e5:db:ff:76:14:17:ccCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

4e:9a:d8:05:bb:29:ad:45:5a:98:8c:2a:55:d9:42:2dCertificate

Extended Key Usages

Key Usages

d3:74:a9:d6:76:78:0f:02:7f:7b:a4:93:1f:d4:e9:86:0d:64:8d:d8Signer

Signature Validations

Verification

15/03/2016, 10:26 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

qt5core

qt5gui

qt5qml

qt5quick

qt5widgets

zlibwapi

msvcp90

msvcr90

iphlpapi

ws2_32

user32

advapi32

Sections

.text Size: 789KB - Virtual size: 788KB

.rdata Size: 247KB - Virtual size: 247KB

.data Size: 68KB - Virtual size: 78KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 539KB - Virtual size: 538KB

.reloc Size: 67KB - Virtual size: 67KB

37:31:12:9f:75:d9:d5:f0:70:e5:db:ff:76:14:17:cc
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

4e:9a:d8:05:bb:29:ad:45:5a:98:8c:2a:55:d9:42:2d
Certificate

d3:74:a9:d6:76:78:0f:02:7f:7b:a4:93:1f:d4:e9:86:0d:64:8d:d8
Signer

15/03/2016, 10:26
Valid: false

.text
Size: 789KB - Virtual size: 788KB

.rdata
Size: 247KB - Virtual size: 247KB

.data
Size: 68KB - Virtual size: 78KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 539KB - Virtual size: 538KB

.reloc
Size: 67KB - Virtual size: 67KB