Static task
static1
Behavioral task
behavioral1
Sample
1728ce5961686351f6c92f778e0580831657f55b58b72522d106b1243f2e6e8c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1728ce5961686351f6c92f778e0580831657f55b58b72522d106b1243f2e6e8c.exe
Resource
win10v2004-20230915-en
General
-
Target
1728ce5961686351f6c92f778e0580831657f55b58b72522d106b1243f2e6e8c
-
Size
11.0MB
-
MD5
692077c0a42d4b14c32634cc93e7727f
-
SHA1
22ec0cb825ebcb9f6cdeec1df4220ca32d8194f9
-
SHA256
1728ce5961686351f6c92f778e0580831657f55b58b72522d106b1243f2e6e8c
-
SHA512
9a0da8e9e34ca2190eaff7dc8453a8ebe177b240a635721d1b4775ae4902425a243b112229ee1a63f3c804757b12e74449f07e2dbb80e317c1046c9b8c3a18b4
-
SSDEEP
196608:+wR0ms5uoMigCbWDTbOs2L4F/n+ZLFN7WqvV5nN5sMmvwoGso51R63qe:+S02PsGqFLDLXqqd5n3sMmv/+O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1728ce5961686351f6c92f778e0580831657f55b58b72522d106b1243f2e6e8c
Files
-
1728ce5961686351f6c92f778e0580831657f55b58b72522d106b1243f2e6e8c.exe windows x86
0540fe6a00a437a75125854b598d5a17
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?toHex@QByteArray@@QBE?AV1@XZ
?fromHex@QByteArray@@SA?AV1@ABV1@@Z
?msleep@QThread@@SAXK@Z
?startDetached@QProcess@@SA_NABVQString@@ABVQStringList@@0PA_J@Z
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
?setApplicationName@QCoreApplication@@SAXABVQString@@@Z
?arguments@QCoreApplication@@SA?AVQStringList@@XZ
??1QCoreApplication@@UAE@XZ
??0QCoreApplication@@QAE@AAHPAPADH@Z
?dispose@QListData@@SAXPAUData@1@@Z
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
?fromUtf8@QString@@SA?AV1@PBDH@Z
?append@QString@@QAEAAV1@ABV1@@Z
??1QString@@QAE@XZ
??0QString@@QAE@ABV0@@Z
??4QJsonArray@@QAEAAV0@$$QAV0@@Z
??1QJsonArray@@QAE@XZ
?array@QJsonDocument@@QBE?AVQJsonArray@@XZ
?object@QJsonDocument@@QBE?AVQJsonObject@@XZ
?isObject@QJsonDocument@@QBE_NXZ
?isArray@QJsonDocument@@QBE_NXZ
?fromJson@QJsonDocument@@SA?AV1@ABVQByteArray@@PAUQJsonParseError@@@Z
??1QJsonDocument@@QAE@XZ
?errorString@QJsonParseError@@QBE?AVQString@@XZ
?hash@QCryptographicHash@@SA?AVQByteArray@@ABV2@W4Algorithm@1@@Z
?entryInfoList@QDir@@QBE?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
??1QDir@@QAE@XZ
??0QDir@@QAE@ABVQString@@@Z
??1QFileInfo@@QAE@XZ
?size@QListData@@QBEHXZ
??4QJsonObject@@QAEAAV0@$$QAV0@@Z
??1QJsonObject@@QAE@XZ
?toStdString@QString@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??8QString@@QBE_NPBD@Z
??0QString@@QAE@ABVQByteArray@@@Z
?compare@QString@@QBEHABV1@W4CaseSensitivity@Qt@@@Z
??4QString@@QAEAAV0@$$QAV0@@Z
??4QByteRef@@QAEAAV0@D@Z
??BQByteRef@@QBEDXZ
?append@QByteArray@@QAEAAV1@ABV1@@Z
??0QByteArray@@QAE@XZ
??0QByteArray@@QAE@PBDH@Z
??0QByteArray@@QAE@HD@Z
??0QByteArray@@QAE@ABV0@@Z
??1QByteArray@@QAE@XZ
??4QByteArray@@QAEAAV0@$$QAV0@@Z
?resize@QByteArray@@QAEXH@Z
?data@QByteArray@@QAEPADXZ
?data@QByteArray@@QBEPBDXZ
?constData@QByteArray@@QBEPBDXZ
?clear@QByteArray@@QAEXXZ
?at@QByteArray@@QBEDH@Z
??AQByteArray@@QAE?AVQByteRef@@H@Z
?left@QByteArray@@QBE?AV1@H@Z
?toStdString@QByteArray@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
kernel32
WideCharToMultiByte
TerminateProcess
OpenProcess
K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SetDllDirectoryW
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCommandLineW
CloseHandle
LocalFree
GetSystemTimeAsFileTime
CreateEventA
GetModuleFileNameW
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
vcruntime140
__std_type_info_destroy_list
__CxxFrameHandler3
memchr
memmove
memcpy
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_cexit
_c_exit
_exit
terminate
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
exit
_controlfp_s
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vfprintf
_set_fmode
__acrt_iob_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
shell32
CommandLineToArgvW
user32
CharUpperBuffW
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dji0 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dji1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dji2 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE