c0fd4fb7da4c9ec0780abc1d5ae7846c970a56067dc6b586f1dc824c99d57f58

Sharing

Copy URL Twitter E-mail

General

Target

c0fd4fb7da4c9ec0780abc1d5ae7846c970a56067dc6b586f1dc824c99d57f58
Size

28KB
MD5

55554e5e9fa1a31f393a553616bbf863
SHA1

f1ad3d63dc559f359f4f64bea49e442c4fae0dd5
SHA256

c0fd4fb7da4c9ec0780abc1d5ae7846c970a56067dc6b586f1dc824c99d57f58
SHA512

e15791751eb3c039cbcfd304015df1a1ec862843df8fc8d644331a1a60df6e1c6d7de76e3c2bc519935c6230f51792606cd29b364373bc4e0713cd28b3613c42
SSDEEP

384:jZ5UVKDxCLnQcuTZDqVzz5ZAKGUdhYm3Au2eMUOVBv9vvPhks4GkOH2FgVEsVg8s:jNkLQ3TxPSs4Gkwz7C8x4asqmRZr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0fd4fb7da4c9ec0780abc1d5ae7846c970a56067dc6b586f1dc824c99d57f58

Files

c0fd4fb7da4c9ec0780abc1d5ae7846c970a56067dc6b586f1dc824c99d57f58
.dll windows x86

234d09901e23af49d0910ca9d35745ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

qt5core

??0QMutex@@QAE@W4RecursionMode@0@@Z
??1QMutex@@QAE@XZ
??4QLocale@@QAEAAV0@$$QAV0@@Z
??1QMutexLocker@@QAE@XZ
??0QMutexLocker@@QAE@PAVQBasicMutex@@@Z
??8QString@@QBE_NPBD@Z
??0QString@@QAE@ABV0@@Z
?fromUtf8@QString@@SA?AV1@PBDH@Z
??YQString@@QAEAAV0@ABV0@@Z
??1QFile@@UAE@XZ
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?close@QFileDevice@@UAEXXZ
?isNull@QString@@QBE_NXZ
??0QLocale@@QAE@XZ
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
??0QLocale@@QAE@W4Language@0@W4Country@0@@Z
?sharedNull@QArrayData@@SAPAU1@XZ
??4QString@@QAEAAV0@$$QAV0@@Z
??0QString@@QAE@PBD@Z
??0QString@@QAE@XZ
??1QString@@QAE@XZ
?allocate@QArrayData@@SAPAU1@IIIV?$QFlags@W4AllocationOption@QArrayData@@@@@Z
?qBadAlloc@@YAXXZ
??8@YA_NABVQString@@0@Z
?deallocate@QArrayData@@SAXPAU1@II@Z
?toUInt@QString@@QBEIPA_NH@Z
?country@QLocale@@QBE?AW4Country@1@XZ
?system@QLocale@@SA?AV1@XZ
?language@QLocale@@QBE?AW4Language@1@XZ
?toInt@QString@@QBEHPA_NH@Z
?exists@QFileInfo@@SA_NABVQString@@@Z
??4QString@@QAEAAV0@ABV0@@Z
??1QLocale@@QAE@XZ
??0QFile@@QAE@ABVQString@@@Z

qt5gui

??0QFont@@QAE@XZ
?setFamily@QFont@@QAEXABVQString@@@Z
?setPointSize@QFont@@QAEXH@Z
?setStyleHint@QFont@@QAEXW4StyleHint@1@W4StyleStrategy@1@@Z
??1QFont@@QAE@XZ

qt5xml

?isText@QDomNode@@QBE_NXZ
?toText@QDomNode@@QBE?AVQDomText@@XZ
?data@QDomCharacterData@@QBE?AVQString@@XZ
??1QDomText@@QAE@XZ
??1QDomElement@@QAE@XZ
?count@QDomNodeList@@QBEHXZ
?nextSibling@QDomNode@@QBE?AV1@XZ
??4QDomNode@@QAEAAV0@ABV0@@Z
?firstChild@QDomNode@@QBE?AV1@XZ
?hasChildNodes@QDomNode@@QBE_NXZ
?isNull@QDomNode@@QBE_NXZ
?documentElement@QDomDocument@@QBE?AVQDomElement@@XZ
?setContent@QDomDocument@@QAE_NPAVQIODevice@@PAVQString@@PAH2@Z
??0QDomDocument@@QAE@XZ
??0QDomElement@@QAE@XZ
??1QDomNode@@QAE@XZ
?item@QDomNodeList@@QBE?AVQDomNode@@H@Z
??4QDomDocument@@QAEAAV0@ABV0@@Z
??4QDomElement@@QAEAAV0@ABV0@@Z
??1QDomNodeList@@QAE@XZ
?elementsByTagName@QDomElement@@QBE?AVQDomNodeList@@ABVQString@@@Z
??0QDomDocument@@QAE@ABV0@@Z
??0QDomElement@@QAE@ABV0@@Z
?toElement@QDomNode@@QBE?AVQDomElement@@XZ
?isElement@QDomNode@@QBE_NXZ
??1QDomDocument@@QAE@XZ

vcruntime140

memcpy
__CxxFrameHandler3
__std_type_info_destroy_list
__vcrt_InitializeCriticalSectionEx
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_except_handler4_common
memset

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate

kernel32

CloseHandle
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

Exports

Exports

?$TSS0@?1??Instance@?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@SAAAVCMultiLanguageMgr@3@XZ@4HA
?$TSS1@?1??Instance@?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@SAAAVCMultiLanguageMgr@3@XZ@4HA
??0?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@IAE@XZ
??0?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@QAE@ABV01@@Z
??0CMultiLanguageMgr@MultiLanguagePlugin@@AAE@XZ
??0CMultiLanguageMgr@MultiLanguagePlugin@@QAE@$$QAV01@@Z
??0CMultiLanguageMgr@MultiLanguagePlugin@@QAE@ABV01@@Z
??1?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@MAE@XZ
??1CMultiLanguageMgr@MultiLanguagePlugin@@UAE@XZ
??4?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@QAEAAV01@ABV01@@Z
??4CMultiLanguageMgr@MultiLanguagePlugin@@QAEAAV01@$$QAV01@@Z
??4CMultiLanguageMgr@MultiLanguagePlugin@@QAEAAV01@ABV01@@Z
??_7?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@6B@
??_7CMultiLanguageMgr@MultiLanguagePlugin@@6B@
?GetBestDiplayFontForUI@CMultiLanguageMgr@MultiLanguagePlugin@@QBE?AVQFont@@VQString@@@Z
?GetLanguageName@CMultiLanguageMgr@MultiLanguagePlugin@@QAE?AVQString@@V3@@Z
?GetLocaleByLanuguage@CMultiLanguageMgr@MultiLanguagePlugin@@QBE?AVQLocale@@VQString@@@Z
?GetSystemLanguage@CMultiLanguageMgr@MultiLanguagePlugin@@QAE?AVQString@@XZ
?Init@CMultiLanguageMgr@MultiLanguagePlugin@@QAE_NXZ
?Instance@?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@SAAAVCMultiLanguageMgr@2@XZ
?m_mutex@?1??Instance@?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@SAAAVCMultiLanguageMgr@3@XZ@4VQMutex@@A
?s_instance@?1??Instance@?$CLanguageSingleton@VCMultiLanguageMgr@MultiLanguagePlugin@@@MultiLanguagePlugin@@SAAAVCMultiLanguageMgr@3@XZ@4V?$auto_ptr@VCMultiLanguageMgr@MultiLanguagePlugin@@@std@@A

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

234d09901e23af49d0910ca9d35745ec

Headers

DLL Characteristics

File Characteristics

Imports

qt5core

qt5gui

qt5xml

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 76B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 76B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB