Q-Dir_Installer_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Q-Dir_Installer_x64.exe
Size

2.3MB
MD5

4aa781cb946bb07d16cc2c79a3a2cbd7
SHA1

c68fe1a79927f3e36ca6c6f0004605aed943908d
SHA256

f3511482c2f76f2682088ca84274d8330b6773044afd325441f8800ec5afb3c1
SHA512

9a0669c84cdeb7d67cf6c490a7990e8409dee226ae325573d92615107815d8ef4f0b834b1d9a3e184af79be3cf3671e5cb69531d3bbe92cfa2c4b269e96b7ef5
SSDEEP

49152:Ys4RlxKRpbPR8wwhyqdB/VblezqfbYdNBe:LpbCxpDOefbYdNBe

Score

1^/10

Malware Config

Signatures

Files

Q-Dir_Installer_x64.exe
.exe windows x64

ebbfa972423ebc0a313a71b07465fad3

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:60:89:6b:93:1c:3c:5a:e1:ad:84:cf:da:71:06:b0
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

14/06/2021, 00:00

Not After

14/06/2023, 23:59

Subject

CN=Nenad Hrg,O=Nenad Hrg,L=Srima,C=HR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:3a:7f:e8:0b:4e:4b:c8:d9:0c:6f:27:4a:bc:9e:fd:73:62:f7:d9:76:23:7f:bb:3c:c0:f3:9d:7e:16:4c:af
Signer

Actual PE Digest

17:3a:7f:e8:0b:4e:4b:c8:d9:0c:6f:27:4a:bc:9e:fd:73:62:f7:d9:76:23:7f:bb:3c:c0:f3:9d:7e:16:4c:af

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LCMapStringW
LCMapStringA
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
HeapCreate
HeapSetInformation
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetStringTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
HeapSize
HeapReAlloc
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableW
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
GetStartupInfoW
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
InterlockedPushEntrySList
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
GetTempFileNameW
SetVolumeLabelW
CreateMutexW
LoadLibraryExW
GetTickCount
GetProfileStringW
GetLocaleInfoW
GetNumberFormatW
GetEnvironmentVariableW
GetPrivateProfileIntW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
WritePrivateProfileStringW
GetDiskFreeSpaceW
TerminateProcess
GetSystemDirectoryW
GetUserDefaultLangID
GetUserDefaultLCID
EnumDateFormatsW
EnumTimeFormatsW
GetTimeFormatW
GetDateFormatW
GetShortPathNameW
GetPrivateProfileStringW
SizeofResource
FreeResource
GetLocalTime
SetFileTime
GetFileSize
SetFilePointer
ReadFile
TerminateThread
GetCurrentProcessId
MoveFileW
GetTimeZoneInformation
GetLogicalDrives
lstrcpynA
GlobalHandle
MulDiv
DeleteCriticalSection
InitializeCriticalSection
GetLastError
CreateThread
ExitProcess
Sleep
OutputDebugStringA
RemoveDirectoryW
DeleteFileW
GetLogicalDriveStringsW
GetDriveTypeW
GetFileAttributesW
SetFileAttributesW
CopyFileW
CreateDirectoryW
GetTempPathW
GetModuleFileNameW
CreateFileW
WriteFile
CloseHandle
GetVersionExW
FindFirstFileW
GetFullPathNameW
SetLastError
CompareStringW
FindClose
FindNextFileW
FindResourceW
LoadResource
LockResource
GetCurrentProcess
FlushInstructionCache
lstrcpyW
FreeLibrary
WideCharToMultiByte
lstrcmpiW
lstrcmpW
lstrcatW
OutputDebugStringW
GetWindowsDirectoryW
GetModuleHandleW
GetCurrentThreadId
lstrlenA
MultiByteToWideChar
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
RaiseException
GlobalSize
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
lstrcpynW
lstrlenW
LoadLibraryW
GetCommandLineW

user32

SetMenuDefaultItem
IntersectRect
IsRectEmpty
SetScrollInfo
SetScrollPos
GetScrollPos
GetSystemMenu
GetMenuDefaultItem
SetRect
LoadBitmapW
PeekMessageW
SendMessageW
wsprintfW
SetWindowTextW
CallWindowProcW
GetWindowLongPtrW
IsMenu
SetWindowsHookExW
GetSysColorBrush
CallNextHookEx
UnhookWindowsHookEx
WindowFromPoint
GetWindowThreadProcessId
MessageBeep
TrackPopupMenuEx
DrawEdge
SetMenuItemInfoW
InsertMenuW
CheckMenuItem
EnableMenuItem
GetWindowDC
IsDialogMessageW
TranslateAcceleratorW
TrackPopupMenu
GetDoubleClickTime
GetMessagePos
EqualRect
CreatePopupMenu
AppendMenuW
SetClassLongW
PostMessageW
CopyRect
CreateDialogParamW
GetKeyState
GetMenuState
SendDlgItemMessageW
wvsprintfW
SetMenu
SetForegroundWindow
DeleteMenu
LoadAcceleratorsW
CharUpperW
RemoveMenu
GetMenuStringW
LoadIconW
CheckDlgButton
IsDlgButtonChecked
CreateDialogIndirectParamW
GetClipboardData
SetPropW
GetMenu
SetActiveWindow
mouse_event
MenuItemFromPoint
SetWindowPlacement
DispatchMessageW
SetWindowLongPtrW
EnumChildWindows
FindWindowExW
EndDialog
GetWindowLongW
SetWindowPos
GetClientRect
ShowWindow
SetTimer
KillTimer
GetParent
GetDlgItem
MapWindowPoints
SystemParametersInfoW
GetWindowRect
GetWindow
SetWindowLongW
RegisterClipboardFormatW
PostQuitMessage
GetFocus
GetAsyncKeyState
CharNextW
LoadImageW
GetSystemMetrics
MessageBoxW
GetWindowPlacement
InsertMenuItemW
GetScrollInfo
SendMessageA
SetMenuItemBitmaps
keybd_event
MapVirtualKeyW
DrawIcon
ScrollWindowEx
IsZoomed
SendMessageTimeoutW
GetMessageW
RemovePropW
GetMenuItemID
GetPropW
ShowCaret
DestroyIcon
GetIconInfo
LoadStringA
EnumWindows
FrameRect
InflateRect
SetParent
IsWindowVisible
DialogBoxIndirectParamW
RegisterWindowMessageW
CreateAcceleratorTableW
RegisterClassExW
LoadCursorW
GetClassInfoExW
DestroyAcceleratorTable
GetDesktopWindow
IsChild
RedrawWindow
InvalidateRgn
ClientToScreen
MoveWindow
SetWindowContextHelpId
MapDialogRect
MessageBoxA
GetMenuItemInfoW
GetActiveWindow
EnableWindow
GetCapture
ReleaseCapture
DrawAnimatedRects
TranslateMessage
GetDlgCtrlID
GetMenuItemCount
DestroyMenu
CreateWindowExW
GetWindowTextW
GetWindowTextLengthW
ScreenToClient
SetDlgItemTextW
IsWindow
LoadStringW
DrawTextW
ReleaseDC
GetDC
LoadMenuW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetSubMenu
DefWindowProcW
DestroyCursor
OffsetRect
CharLowerW
CreateCursor
GetClassNameW
SetRectEmpty
DialogBoxParamW
DestroyWindow
UpdateWindow
InvalidateRect
IsWindowEnabled
SetCapture
SetFocus
PtInRect
FillRect
DrawFocusRect
SetCursor
GetCursorPos
GetSysColor
BeginPaint
EndPaint
UnregisterClassA

gdi32

GetViewportExtEx
GetWindowExtEx
SelectClipRgn
SetViewportExtEx
SetWindowExtEx
GetEnhMetaFileHeader
ResetDCW
StartPage
EndPage
OffsetViewportOrgEx
EndDoc
AbortDoc
StartDocW
SetStretchBltMode
StretchBlt
GetCurrentObject
GetPixel
SetDIBitsToDevice
SetMapMode
Rectangle
LPtoDP
GetBkColor
DPtoLP
CreateEnhMetaFileW
CloseEnhMetaFile
SetPixel
CreateDCW
GetDIBits
GetClipBox
SetViewportOrgEx
CreateBitmap
CreatePatternBrush
PatBlt
GetTextExtentPoint32W
LineTo
MoveToEx
CreatePen
IntersectClipRect
OffsetWindowOrgEx
ExcludeClipRect
SetWindowOrgEx
ExtTextOutW
RestoreDC
SaveDC
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateFontIndirectW
DeleteDC
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteObject
GetObjectW
CreateSolidBrush
SetTextColor
SetBkColor
DeleteEnhMetaFile
SetBkMode
GetStockObject

winspool.drv

OpenPrinterW
ClosePrinter
GetPrinterW

comdlg32

PrintDlgW
ChooseColorW
GetOpenFileNameW
GetSaveFileNameW
PageSetupDlgW

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
GetUserNameW
RegOpenKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW
CryptHashData
CryptGetHashParam
RegQueryInfoKeyW
GetTokenInformation
RegDeleteKeyW

shell32

SHFileOperationW
SHAppBarMessage
Shell_NotifyIconW
ord21
DragFinish
SHBrowseForFolderW
ord88
ord68
ExtractIconExW
SHGetSettings
ord25
DragQueryFileW
ord17
ord16
SHGetFileInfoW
DragAcceptFiles
ord190
ord155
ord18
ord4
ord2
SHGetDesktopFolder
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc

ole32

CoUninitialize
CoInitialize
OleDuplicateData
DoDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemFree
CoCreateInstance
ReleaseStgMedium
OleGetClipboard
RevokeDragDrop
CoSetProxyBlanket
CoTaskMemRealloc
OleSetClipboard

oleaut32

VarUI4FromStr
VariantChangeType
OleCreatePictureIndirect
DispCallFunc
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysAllocString
SysStringLen
VariantClear
SysAllocStringLen
SysFreeString
VariantInit

shlwapi

PathRelativePathToW
StrCpyW

comctl32

ImageList_LoadImageW
_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetIconSize
ImageList_GetIcon
InitCommonControlsEx
ImageList_SetBkColor
ImageList_Remove
ImageList_Destroy
ImageList_GetImageCount
ImageList_Draw
ImageList_DrawEx
ImageList_AddMasked
ImageList_GetImageInfo
CreateStatusWindowW
PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromStreamICM
GdipImageRotateFlip
GdiplusStartup
GdipDrawImageRectRectI
GdipSetImageAttributesGamma
GdipSetImageAttributesColorMatrix
GdipCreateHICONFromBitmap
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageThumbnail
GdipCloneImage
GdipDrawImageRectI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipImageSelectActiveFrame
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetPropertyItemSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCreateBitmapFromFile
GdipGetImageGraphicsContext
GdipSetCompositingMode

winmm

PlaySoundW
timeGetTime

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Shared
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 18B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebbfa972423ebc0a313a71b07465fad3

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

0a:60:89:6b:93:1c:3c:5a:e1:ad:84:cf:da:71:06:b0Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

17:3a:7f:e8:0b:4e:4b:c8:d9:0c:6f:27:4a:bc:9e:fd:73:62:f7:d9:76:23:7f:bb:3c:c0:f3:9d:7e:16:4c:afSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

winmm

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 331KB - Virtual size: 331KB

.data Size: 34KB - Virtual size: 119KB

.pdata Size: 90KB - Virtual size: 89KB

Shared Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 18B

.rsrc Size: 496KB - Virtual size: 495KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

0a:60:89:6b:93:1c:3c:5a:e1:ad:84:cf:da:71:06:b0
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

17:3a:7f:e8:0b:4e:4b:c8:d9:0c:6f:27:4a:bc:9e:fd:73:62:f7:d9:76:23:7f:bb:3c:c0:f3:9d:7e:16:4c:af
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 331KB - Virtual size: 331KB

.data
Size: 34KB - Virtual size: 119KB

.pdata
Size: 90KB - Virtual size: 89KB

Shared
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 18B

.rsrc
Size: 496KB - Virtual size: 495KB