500909-qqsrvexe[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

500909-qqsrvexe.exe
Size

118KB
MD5

f1bf04ac46c4a9fd55f902d495461147
SHA1

19ecb3ca12a0d19897af0c87673becd5cff7aeba
SHA256

bc06890c2b7992e31726f069dfbb6f1fda24601a7538244d44783c5a323d965a
SHA512

ea26cf15fed1b1db0f63b14a7fe90736c3b50069a44e2afb5cbe677434bb899dc0796155ea5615a3af6a57b89a8c1752451ca3b688fbe031ee8b0d5f3406591a
SSDEEP

3072:/O0mln1RvntAOEiKLvBN1g4sZsGR6pst3:G3nrqRvBQRt3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
500909-qqsrvexe.exe

Files

500909-qqsrvexe.exe
.exe windows x86

7cc3a712b00c184b18453863a1a633b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

wnsprintfW
StrCmpNA
StrChrA
StrCmpNW
StrStrW

kernel32

CreateEventW
WriteConsoleW
CreateFileW
SetFilePointerEx
HeapFree
lstrlenW
lstrlenA
lstrcmpA
GetSystemWow64DirectoryW
Sleep
GetLastError
lstrcpyA
GlobalFree
HeapReAlloc
HeapAlloc
lstrcpynA
GetProcessHeap
lstrcpyW
GetTickCount
GetCurrentProcess
GetCurrentThreadId
CloseHandle
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
GetModuleFileNameW
OpenProcess
GetWindowsDirectoryW
ReadProcessMemory
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetStringTypeW
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetLastError
RtlUnwind
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetFileType

user32

wsprintfA
wsprintfW

shell32

SHGetFolderPathW

ole32

CoInitializeEx
CoGetObject
CoUninitialize

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cc3a712b00c184b18453863a1a633b4

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

ole32

Sections

.text Size: 76KB - Virtual size: 75KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 3KB - Virtual size: 8KB

.gfids Size: 512B - Virtual size: 300B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 76KB - Virtual size: 75KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 3KB - Virtual size: 8KB

.gfids
Size: 512B - Virtual size: 300B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 5KB - Virtual size: 5KB