Static task
static1
Behavioral task
behavioral1
Sample
Qwrsu.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Qwrsu.exe
Resource
win10v2004-20230703-en
General
-
Target
Qwrsu.exe
-
Size
994KB
-
MD5
c2d8e129c5620e49aa838614d27fa8e6
-
SHA1
0580b9ff7fc19bc5793fa057205982e57ab27103
-
SHA256
0a2d6b3a0d5fcd3fa61e8796304402e4c35d7c7173a01d231b4730f56e19e816
-
SHA512
9ab626c0a53e54b727b3dbaeec5ae306706d043c463c61ddd849fb3d592723bb05dbec329e56f7e0a488a33b98aa0c926a441de5966c6057bfc5d562a7beb37e
-
SSDEEP
24576:mMEKj6SuwQjpTQWc122vzvnEytusJO1Ld+1dinrlPc:FEKjjQj5QBPE45JOldrlPc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Qwrsu.exe
Files
-
Qwrsu.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 926KB - Virtual size: 925KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ