Static task
static1
Behavioral task
behavioral1
Sample
qs.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
qs.exe
Resource
win10v2004-20230703-en
General
-
Target
qs.exe_
-
Size
296KB
-
MD5
9896cfba2138567c8fa94158c579fceb
-
SHA1
d59487e5ab059f9e7de10ce0a674bfc1d69cd099
-
SHA256
6caef4adc0c5813fca86223c28fd5d6676625481bf408135d91f9914fdb31ec6
-
SHA512
57f1c9d1e008058968e8b44fa5286c73a86d3d174eff7645aae0a4303aa2e67737f3d6d20a1ce725d74401b8024d9b5bb46415534ca809edddfaa9c08060961b
-
SSDEEP
3072:XODs7ssv8Emvb6Ant8vY3XDFd/bcqMayzK0qnQTQYgfXrBjXgXSona1Fl3ycGUSx:XOYfkjvRnuvY3Jd/waRpBvtjRgJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qs.exe_
Files
-
qs.exe_.exe windows x64
c4350d241b5600f7200518d0a619fc78
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileAttributesW
CreateFileW
GetFileSize
CloseHandle
LocalAlloc
LocalFree
FindFirstFileW
FindNextFileW
FindClose
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
WaitForMultipleObjects
WaitForSingleObject
SetEndOfFile
GetConsoleOutputCP
FlushFileBuffers
GetFileSizeEx
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
HeapSize
GetFileAttributesExW
ReadConsoleW
GetCurrentProcessId
HeapFree
SetFilePointerEx
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
RtlUnwind
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
WideCharToMultiByte
GetConsoleMode
MultiByteToWideChar
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcessHeap
ReadFile
HeapAlloc
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
SetLastError
EncodePointer
WriteConsoleW
user32
wsprintfW
wldap32
ord88
ord14
ord73
ord216
ord208
ord26
ord27
ord133
ord127
ord167
ord140
ord224
ord41
ord13
ord145
ws2_32
htons
select
gethostbyname
socket
ioctlsocket
connect
getsockopt
closesocket
gethostname
getnameinfo
ntohl
htonl
inet_ntoa
gethostbyaddr
WSAStartup
setsockopt
inet_addr
send
recv
netapi32
NetGroupGetUsers
NetLocalGroupEnum
NetQueryDisplayInformation
NetServerGetInfo
NetShareEnum
NetUserGetGroups
NetUserGetLocalGroups
NetUserModalsGet
NetUserGetInfo
NetWkstaUserEnum
NetApiBufferFree
NetLocalGroupGetMembers
NetGroupEnum
iphlpapi
GetAdaptersInfo
SendARP
mpr
WNetAddConnection2W
dnsapi
DnsQuery_A
DnsFree
Sections
.text Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ