qbcore[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

qbcore.dll
Size

108KB
MD5

fc6ebebbe50f6d2736a5ed2d76509728
SHA1

af263396b3b3f18a84a2c2e3460952c38f7ceff5
SHA256

6987c59c2bc68484b63dc68b6b05b823458cc91dc44c50579b464d1d777bf1b1
SHA512

d91488763f082cfc4d49b00f2cce54c35dc7e824f4c18f23f48ceea88037aba6d7a8f025e695957dc2c70bb5b5b995b1108ab640527481e0726f2e3692e525fb
SSDEEP

1536:Oh3MU/5bLDCMtm/ejs5x2WcHG82RqNoRKV2KoyqkvITnzZh/Qz6r:mt5bLDtm/ejs5xqHG82RWqWITzZRQO

Score

1^/10

Malware Config

Signatures

Files

qbcore.dll
.dll windows x86

efbedc2d31c01d615e0f9cc07136a4ad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord470
ord860
ord535
ord4160
ord2827
ord941
ord5572
ord2915
ord2379
ord2864
ord6172
ord5873
ord3619
ord2841
ord6283
ord2784
ord2764
ord4129
ord4202
ord858
ord5856
ord4277
ord2754
ord537
ord5789
ord940
ord2753
ord2859
ord5875
ord6648
ord2763
ord4278
ord6662
ord5440
ord6383
ord823
ord5450
ord6394
ord5834
ord2044
ord2107
ord3402
ord3721
ord809
ord795
ord2614
ord556
ord1088
ord2122
ord2860
ord6199
ord3874
ord3797
ord6358
ord6197
ord1200
ord926
ord2818
ord6453
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord3830
ord641
ord692
ord2514
ord5943
ord2621
ord1134
ord304
ord623
ord310
ord629
ord5265
ord323
ord4853
ord4998
ord6052
ord1775
ord5280
ord4425
ord3597
ord324
ord2302
ord4234
ord4299
ord4710
ord5953
ord5788
ord472
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord2863
ord668
ord1973
ord1975
ord6321
ord5973
ord1005
ord5176
ord2716
ord2082
ord1980
ord2770
ord356
ord924
ord5683
ord2919
ord4295
ord922
ord3167
ord4061
ord5174
ord1770
ord1572
ord816
ord562
ord6215
ord289
ord3706
ord5786
ord1795
ord2575
ord3574
ord3573
ord3693
ord4396
ord609
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord5794
ord5579
ord5571
ord6061
ord5864
ord3596
ord5787
ord6194
ord6021
ord4284
ord4133
ord4297
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord1640
ord5736
ord1641
ord5785
ord5678
ord640
ord755
ord3092
ord6880
ord1168
ord1146
ord1233
ord2152
ord4275
ord2414
ord2448
ord800
ord3626
ord825
ord567
ord540
ord818
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord4376
ord3831
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3663
ord815
ord3571

msvcrt

rand
__CxxFrameHandler
atoi
_mbscmp
atol
strstr
_mbsstr
_ftol
_CIpow
_beginthreadex
srand
time
printf
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
free
_initterm
malloc
_adjust_fdiv

kernel32

VirtualAlloc
CreateThread
GetModuleFileNameA
CreateMutexA
GetLastError
Sleep
SetEvent
ResetEvent
WaitForSingleObject
FindResourceA
LoadResource
SizeofResource
LockResource
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CloseHandle
CreateEventA
lstrcatA
lstrlenA
WinExec
lstrcpyA
GetWindowsDirectoryA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls

user32

GrayStringA
WindowFromPoint
SetCursor
InvalidateRect
UpdateWindow
GetClientRect
IsIconic
EqualRect
SetRect
GetWindowRect
LoadCursorA
SetTimer
GetSysColor
GetSystemMetrics
DrawIcon
GetSystemMenu
DrawTextA
LoadIconA
IntersectRect
MessageBoxA
FillRect
GetParent
ReleaseDC
InflateRect
SetWindowLongA
RedrawWindow
MessageBeep
SendMessageA
EnableWindow
KillTimer
GetCapture
ReleaseCapture
SetCapture
CopyRect
TabbedTextOutA
AppendMenuA
DrawStateA
OffsetRect
GetDC
IsWindowVisible
GetCursorPos
GetDesktopWindow
SubtractRect
IsWindow
LoadBitmapA
ScreenToClient
CopyIcon
PtInRect

gdi32

CreateFontIndirectA
GetTextExtentPoint32A
GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
CreateSolidBrush
PolyBezier
CreateRectRgnIndirect
GetStockObject
RoundRect
GetBkColor
DPtoLP
GetMapMode
LPtoDP
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
CreateFontA
CreateBitmap
CreateCompatibleDC
CreatePen
BitBlt
CreateCompatibleBitmap

advapi32

RegOpenKeyExA
RegQueryValueA
RegCloseKey

shell32

ShellExecuteA
SHAppBarMessage

comctl32

_TrackMouseEvent

ole32

CreateStreamOnHGlobal

olepro32

ord251

oleaut32

VariantClear

msvcp60

??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

ws2_32

htons
send
WSAStartup
WSACleanup
closesocket
connect
gethostbyname
socket
recv

Exports

Exports

cef_api_hash
cef_browser_host_create_browser
cef_clear_cache
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_get_global_manager
cef_currently_on
cef_drag_data_create
cef_execute_process
cef_get_extensions_for_mime_type
cef_initialize
cef_log
cef_post_delayed_task
cef_post_task
cef_process_message_create
cef_quit_message_loop
cef_run_message_loop
cef_shutdown
cef_stream_reader_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_list_alloc
cef_string_list_append
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_thread
cef_v8value_create_function
cef_v8value_create_object
cef_v8value_create_string

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

efbedc2d31c01d615e0f9cc07136a4ad

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

msvcp60

ws2_32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 52KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 20KB - Virtual size: 17KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 56KB - Virtual size: 52KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 20KB - Virtual size: 17KB

.reloc
Size: 8KB - Virtual size: 5KB