qakbot | 900959cec2c1ef934cbd697a9dc0f87e711dbe0ff1f6dfc69df1cf06bdd05cca[.]dll

Resubmissions

16/05/2023, 15:35

230516-s1tqqaae3z 10

16/05/2023, 15:31

230516-sx3jfsbd67 10

Sharing

Copy URL

Twitter E-mail

General

Target

900959cec2c1ef934cbd697a9dc0f87e711dbe0ff1f6dfc69df1cf06bdd05cca.dll
Size

132KB
MD5

2cf467ffa53ed0aa86d4b98c8c785aed
SHA1

4280daee9ffc5c6f772edc81c27eac2d35af45a5
SHA256

900959cec2c1ef934cbd697a9dc0f87e711dbe0ff1f6dfc69df1cf06bdd05cca
SHA512

f50dc9431e7d1a7b0673c30ded7877e746273c7b0f6237d023998aeea79a0244d526bb1e0d198248b4f66e51b551a5868c6e7d65adb9b6daab385745b0123fb5
SSDEEP

3072:uxutslYY4EK5JPjVlz8zSGAF/J25H1oTBfv+Nyg:HCmEKPbzWSjRJgH1oTBn+NL

Score

10^/10

qakbot

Malware Config

Signatures

Qakbot family
qakbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
900959cec2c1ef934cbd697a9dc0f87e711dbe0ff1f6dfc69df1cf06bdd05cca.dll

Files

900959cec2c1ef934cbd697a9dc0f87e711dbe0ff1f6dfc69df1cf06bdd05cca.dll
.dll windows x86

0141f24aaf1b810b9fcc5f6886f26f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

windowscodecs

WICMapSchemaToName
WICMapShortNameToGuid
WICMapGuidToShortName

msvcrt

localeconv
strtod
strchr
strncpy
_time64
malloc
free
memset
memchr
_strtoi64
_errno
_snprintf
_ftol2_sse
_vsnwprintf
memcpy
atol
qsort
_vsnprintf

kernel32

SwitchToThread
GetModuleHandleW
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
GetModuleHandleA
LoadLibraryA
GetNumberFormatA
lstrcatW
WideCharToMultiByte
FindFirstFileW
FindNextFileW
SetFileAttributesW
lstrlenW
LoadLibraryW
FreeLibrary
GetCommandLineW
GetVersionExA
GetSystemInfo
GetCurrentDirectoryW
GetWindowsDirectoryW
lstrcmpiA
GetSystemTimeAsFileTime
GetExitCodeProcess
LocalAlloc
ExitThread
FlushFileBuffers
SetThreadPriority
GetTickCount
MoveFileW
K32GetModuleFileNameExW
lstrcmpA
lstrcpynA
DisconnectNamedPipe
GetProcessId
GetCurrentThread
CreateMutexW
lstrcatA
CreateDirectoryW
lstrcpynW
GetLastError
GetDriveTypeW
lstrcmpiW
Sleep
SetCurrentDirectoryA
GetFileAttributesW
GetCurrentProcessId
MultiByteToWideChar

user32

RegisterClassExA
UnregisterClassA
CreateWindowExA
DestroyWindow
CharUpperBuffW
CharUpperBuffA
DefWindowProcW

gdi32

CreateFontA
GdiTransparentBlt
CreateHalftonePalette
CreateFontIndirectExW
CreateEnhMetaFileA
CreateScalableFontResourceA
CreatePenIndirect
CreateSolidBrush
CreateEllipticRgn
CreateDIBPatternBrush
CreateScalableFontResourceW
CreateDIBPatternBrushPt
CreateRoundRectRgn
CreateRectRgnIndirect
CreateEllipticRgnIndirect
CreateHatchBrush
CreateBrushIndirect
CreateBitmapIndirect
GdiGetBatchLimit
CreateDIBSection
CreatePatternBrush

advapi32

CreatePrivateObjectSecurity
GetEventLogInformation
AddAccessDeniedAce
AccessCheckByTypeAndAuditAlarmA
AddAccessAllowedAceEx
EnumerateTraceGuidsEx
AccessCheckAndAuditAlarmA
ChangeServiceConfig2A
AddAccessAllowedAce
EventWriteString
EventActivityIdControl
GetAce
ConvertToAutoInheritPrivateObjectSecurity
CloseTrace
FindFirstFreeAce
EventWrite
EventWriteEx
AddAuditAccessObjectAce
EqualDomainSid
EventWriteTransfer

shell32

CommandLineToArgvW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoCreateInstance

oleaut32

SafeArrayGetUBound
VariantClear
SafeArrayGetLBound
SysFreeString
SysAllocString
SafeArrayGetElement
SafeArrayDestroy

Exports

Exports

print

Sections

.text
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

0141f24aaf1b810b9fcc5f6886f26f14

Headers

File Characteristics

Imports

windowscodecs

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 97KB - Virtual size: 100KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 97KB - Virtual size: 100KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB