qBittorrent_7[.]21_win64__NCXMOD3M20279469[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

qBittorrent_7.21_win64__NCXMOD3M20279469.exe
Size

62.9MB
MD5

c09dd2b816d52ac847281d8ff2cef708
SHA1

fd528a4dcb893024bd11a23e7846dfb1d2d8b4e6
SHA256

c8c5d6c16bb67cefc26796702580b213256187c5524cc91832314b5c38105cd2
SHA512

434b823caa41ecc5d51ce38907990ab348dc77ea63afc49083cecd99afd4b5d58662ac3daca7f21676ebe8f223ef8df601df291bda1d0d5860744ed3ff6bd5fc
SSDEEP

786432:N8/mIs13XFuKfOtVr33qVyaozR2bPwWlx1kWqoE7s9VwpWeMLvMQ+lIF9dSZpGeg:Na76XF4Q8aokPlE7sTwpczJjrWcSB017

Score

1^/10

Malware Config

Signatures

Files

qBittorrent_7.21_win64__NCXMOD3M20279469.exe
.exe windows x64

36097321cfc49284b2caa283fc19daf4

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:a2:a6:e5:14:b1:87:c5:2e:1f:ea:52:40:cb:04:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/04/2011, 00:00

Not After

25/06/2013, 23:59

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a2:3b:06:15:a7:a0:4e:3e:69:66:e1:2e:93:89:03:70:0b:5c:70:00
Signer

Actual PE Digest

a2:3b:06:15:a7:a0:4e:3e:69:66:e1:2e:93:89:03:70:0b:5c:70:00

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

30/05/2012, 17:43
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentThread
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

CryptHashData

user32

GetSystemMetrics

shell32

ShellExecuteExW

ole32

CoInitializeEx

crypt32

CryptStringToBinaryA

ws2_32

connect

bcrypt

BCryptGenRandom

oleaut32

GetErrorInfo

Sections

.text
Size: 629KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.;j<
Size: 42.4MB - Virtual size: 42.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.JFL
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.>:w
Size: 19.3MB - Virtual size: 19.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36097321cfc49284b2caa283fc19daf4

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

5f:a2:a6:e5:14:b1:87:c5:2e:1f:ea:52:40:cb:04:e9Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

a2:3b:06:15:a7:a0:4e:3e:69:66:e1:2e:93:89:03:70:0b:5c:70:00Signer

Signature Validations

Verification

30/05/2012, 17:43 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

shell32

ole32

crypt32

ws2_32

bcrypt

oleaut32

Sections

.text Size: 629KB - Virtual size: 628KB

.rdata Size: 179KB - Virtual size: 178KB

.data Size: 5KB - Virtual size: 10KB

.pdata Size: 22KB - Virtual size: 21KB

_RDATA Size: 512B - Virtual size: 348B

.;j< Size: 42.4MB - Virtual size: 42.4MB

.JFL Size: 3KB - Virtual size: 3KB

.>:w Size: 19.3MB - Virtual size: 19.3MB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 328KB - Virtual size: 327KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

5f:a2:a6:e5:14:b1:87:c5:2e:1f:ea:52:40:cb:04:e9
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

a2:3b:06:15:a7:a0:4e:3e:69:66:e1:2e:93:89:03:70:0b:5c:70:00
Signer

30/05/2012, 17:43
Valid: false

.text
Size: 629KB - Virtual size: 628KB

.rdata
Size: 179KB - Virtual size: 178KB

.data
Size: 5KB - Virtual size: 10KB

.pdata
Size: 22KB - Virtual size: 21KB

_RDATA
Size: 512B - Virtual size: 348B

.;j<
Size: 42.4MB - Virtual size: 42.4MB

.JFL
Size: 3KB - Virtual size: 3KB

.>:w
Size: 19.3MB - Virtual size: 19.3MB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 328KB - Virtual size: 327KB