Static task
static1
Behavioral task
behavioral1
Sample
ApplyQysoftCode.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ApplyQysoftCode.exe
Resource
win10v2004-20230220-en
General
-
Target
ApplyQysoftCode.exe
-
Size
38KB
-
MD5
06335360d27ce0097942c9db1c49be84
-
SHA1
aefadb49ad8524a41b913bad55499283473ddb1d
-
SHA256
74ab17d5df4cffacc874d1bb97a43a4d5c640fb5b0e5723b1f6edaeed851b5ba
-
SHA512
0ed9fccff6772eeb08cb51f2f76bf41cf70a45b04be076ef92ef6446846d3a490dd1e80110f8ff94767900e38365890bb047c7599653ca0f7a1c47e52ce33b6a
-
SSDEEP
768:3DZenFbFuM+CWojtCsUJA/ncD+2M+CWojtC:3InFbFuMsctpYAnr2Msct
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ApplyQysoftCode.exe
Files
-
ApplyQysoftCode.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ