Static task
static1
Behavioral task
behavioral1
Sample
QueryPlatform_V1.1.3(Server).exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
QueryPlatform_V1.1.3(Server).exe
Resource
win10v2004-20230220-en
General
-
Target
QueryPlatform_V1.1.3(Server).exe
-
Size
1.9MB
-
MD5
c89620e780d660569962d8577a52a9e4
-
SHA1
71480e5f1564482f37fadbed1718f06708c51b36
-
SHA256
a4cf2f1c997cc9d309bc1e4fa7de26929b8f530c30688220386efeb6bd1aec61
-
SHA512
ea712dddf14071046d874592dffa016b28f9a0842d8b916f5149c16df6af062095ec6053d8e7e86d3641750818342317d7e16a213d78a5d71d005272d728aed5
-
SSDEEP
49152:wQNy6CxYxiXUrq2wGXhM0SfKV/dKsVPhkqLjMD10UpVG:wQNlaYxiErqLshM0Sq/AsVPhkbS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource QueryPlatform_V1.1.3(Server).exe
Files
-
QueryPlatform_V1.1.3(Server).exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ