zqsexr[.]dll | Triage

General

Target

zqsexr.dll
Size

11KB
MD5

1ab65a4fc6b47ce4ee3c3a2bc1ba91a5
SHA1

c205dcb78b7b150cb52d075eab3f5aa1d859c07c
SHA256

40681937c243262b919b7c6c20a55102d327c17afacfc55345e98ee124ba4dfe
SHA512

670d1045ecf0ad78546bad8dd1e7c49f8029e30c6cba922fa948373ee6ff16da8ffe09f2a646f9ed5b23c77f07eafc1a669782aa38868dc21214754eccfdebd1
SSDEEP

192:JIZ7O78X37mVE8X3pETtXiA3Fh7xe3VjASPtqKprCDS:JK7Gj28ETtBT7oDP5CDS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zqsexr.dll

Files

zqsexr.dll
.dll windows x86

7fd46a7f56c0e23d5f7b090d08198d6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCmpNIW

kernel32

EnumSystemCodePagesW
VirtualProtect
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation

wsock32

ord1105
WSAAsyncGetHostByName
ord1114
ord1109
WSASetLastError
ord1104
MigrateWinsockConfiguration

winmm

midiOutGetID
waveInReset
CloseDriver
timeKillEvent
mixerGetNumDevs
timeGetTime

msacm32

acmDriverDetailsW
acmMessage32
acmFilterDetailsA
acmFormatEnumW
acmFormatChooseW

rtm

RtmCloseEnumerationHandle
RtmLookupIPDestination

shell32

DragQueryFileA
SHFileOperationW
ExtractAssociatedIconExA
ShellHookProc

loadperf

UnloadPerfCounterTextStringsA
LoadPerfCounterTextStringsA
LoadPerfCounterTextStringsW

Exports

Exports

JKbtgdfd
_AddDays@8
_DaysBetweenDates@8
_GetEasterSunday@8
_GetFirstWeekdayOfMonth@8
_GetLastWeekday@8
_GetLastWeekdayOfMonth@8
_GetNextWeekday@8
_GetNthDayOfWeekInMonth@20
_GetNthWeekdayOfMonth@12
_GetTimeZoneOffsetInMinutes@0
_IsSameWeek@8
_IsWeekend@4
_fDaysInMonth@8

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fd46a7f56c0e23d5f7b090d08198d6d

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

wsock32

winmm

msacm32

rtm

shell32

loadperf

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 92B

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 92B