QUOTATIO[.]EXE[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
QUOTATIO.EXE.exe
Size 297KB
Sample230323-p4mvsshf6t
SHA256 4bf75ced5431972bf4d34227e7fbf107f16ca9879bee1d0b225321ee100e3a11
MD5 8d2e9406accfc4e70e8717acd1acac0f
SHA1 879ee79717775fc82af2f34875be6d3953454221
SHA512 c676b10e8275a305bada959c664751c95844cab6c1f959f9ba00157c886c462017a51def3704f081f0798cd0cb0c58db8c75d262c368464deccbc2cfbec92454
SSDEEP 6144:kQLFhHAzxhDJh/xAm2g2bh5jMko872Ed+7RKlOLRkpT4c0hM9egWlgy:xFWVhDT/R21172wDC6p8298gy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

QUOTATIO.EXE.exe

.exe 297KB

QUOTATIO.EXE.exe

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 4bf75ced5431972bf4d34227e7fbf107f16ca9879bee1d0b225321ee100e3a11
MD5 8d2e9406accfc4e70e8717acd1acac0f
SHA1 879ee79717775fc82af2f34875be6d3953454221
SHA512 c676b10e8275a305bada959c664751c95844cab6c1f959f9ba00157c886c462017a51def3704f081f0798cd0cb0c58db8c75d262c368464deccbc2cfbec92454
SSDEEP 6144:kQLFhHAzxhDJh/xAm2g2bh5jMko872Ed+7RKlOLRkpT4c0hM9egWlgy:xFWVhDT/R21172wDC6p8298gy
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

Minor OS version

Major OS version

Entry point

13188

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance