Static task
static1
Behavioral task
behavioral1
Sample
09f6a3a9f656916067a21919e2e55cd103ffb779446277d7d96e3a8b2ab62087.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
09f6a3a9f656916067a21919e2e55cd103ffb779446277d7d96e3a8b2ab62087.exe
Resource
win10v2004-20230915-en
General
-
Target
09f6a3a9f656916067a21919e2e55cd103ffb779446277d7d96e3a8b2ab62087
-
Size
947KB
-
MD5
d628b3f38bd6cef4cff25b27a44c5d9b
-
SHA1
b6354f3827839df579b69750d0a3b369dcfaba64
-
SHA256
09f6a3a9f656916067a21919e2e55cd103ffb779446277d7d96e3a8b2ab62087
-
SHA512
0c552ee2e402261faae29c0978d8cf3964a039461a34524e090936fd35648bd425b29eb4839bf8cd88fe1d5fe5d893380843e852185fe2e7e03792aa25885388
-
SSDEEP
12288:3b+5f604ukCdl02KUgitwv9tMUgitwv9tukcK+OzXc:3b+xP4ukCl02ciEt6iEtu3MXc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09f6a3a9f656916067a21919e2e55cd103ffb779446277d7d96e3a8b2ab62087
Files
-
09f6a3a9f656916067a21919e2e55cd103ffb779446277d7d96e3a8b2ab62087.exe windows:5 windows x86
bd34113ea87adce6d305efdaa668cbb5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qidianplugincommon
??0CVariant@QDPF@@QAE@AB_N@Z
??0CVariant@QDPF@@QAE@ABV01@@Z
?IsLessThan@IObject@QDPF@@UAE_NPAV12@@Z
?IsEqual@IObject@QDPF@@UAE_NPAV12@@Z
?Copy@IObject@QDPF@@UAEPAV12@XZ
??ACVariantMap@QDPF@@QBE?AVCVariant@1@PBD@Z
?ToMap@CVariant@QDPF@@QBE?AVCVariantMap@2@PA_N@Z
??1CVariant@QDPF@@UAE@XZ
??0CVariant@QDPF@@QAE@ABVCVariantMap@1@@Z
??0IObject@QDPF@@QAE@XZ
??1IObject@QDPF@@UAE@XZ
?GetInstance@QDPF@@YAPAVIApplication@1@XZ
??0CVariant@QDPF@@QAE@ABH@Z
??ACVariantMap@QDPF@@QAEAAVCVariant@1@PBD@Z
?ToString@CVariant@QDPF@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_N@Z
??4CVariant@QDPF@@QAEAAV01@ABV01@@Z
??4CVariant@QDPF@@QAEAAV01@PBD@Z
??4CVariant@QDPF@@QAEAAV01@ABH@Z
??4CVariantMap@QDPF@@QAEAAV01@ABV01@@Z
??0CVariantMap@QDPF@@QAE@ABV01@@Z
?FromJson@CVariantMap@QDPF@@QAE_NPBD@Z
?ToJson@CVariantMap@QDPF@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ToBool@CVariant@QDPF@@QBE_NPA_N@Z
?HsMember@CVariantMap@QDPF@@QBE_NPBD@Z
??0?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@XZ
?get@?$_Ptr_base@VILogicChannel@QDPF@@@std@@IBEPAVILogicChannel@QDPF@@XZ
??1CVariantMap@QDPF@@UAE@XZ
??0CVariantMap@QDPF@@QAE@ABV?$initializer_list@U?$pair@PBDVCVariant@QDPF@@@std@@@std@@@Z
??0CVariantMap@QDPF@@QAE@XZ
??0?$initializer_list@U?$pair@PBDVCVariant@QDPF@@@std@@@std@@QAE@PBU?$pair@PBDVCVariant@QDPF@@@1@0@Z
??1?$pair@PBDVCVariant@QDPF@@@std@@QAE@XZ
??0CVariant@QDPF@@QAE@PBD@Z
??0?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@$$T@Z
??1?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@XZ
??4?$shared_ptr@VILogicChannel@QDPF@@@std@@QAEAAV01@$$QAV01@@Z
??B?$shared_ptr@VILogicChannel@QDPF@@@std@@QBE_NXZ
??0ILogicChannelEvent@QDPF@@QAE@XZ
?ToInt32@CVariant@QDPF@@QBEHPA_N@Z
??1ILogicChannelEvent@QDPF@@UAE@XZ
?CreateLogicChannel@QDPF@@YA?AV?$shared_ptr@VILogicChannel@QDPF@@@std@@XZ
common
?ExtractZipFile@Zip@Util@@YAHPB_W0@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?DownloadToFile@CHttpClient@@QAEHPB_W_K0PAVIHttpClientSink_@@@Z
??1CHttpClient@@QAE@XZ
??0CHttpClient@@QAE@XZ
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?RenameFile@FS@@YAHPB_W0@Z
?DeleteFileW@FS@@YAHPB_W@Z
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
??0CTXStringW@@QAE@ABV0@@Z
??M@YA_NABVCTXStringW@@0@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
??BCTXStringW@@QBEPB_WXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??0CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@PBD@Z
??1CTXStringA@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
?Append@CTXStringA@@QAEXABV1@@Z
??BCTXStringA@@QBEPBDXZ
??0CTXStringW@@QAE@XZ
?AnsiToUnicode@Convert@Util@@YA_NAAVCTXStringW@@PBDH@Z
?GetRegulatedTime@Time@Util@@YA_NAA_J@Z
?GetString@CTXStringA@@QBEPBDXZ
?CreateDirectoryW@FS@@YAHPB_W@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?TXAssert@@YAHPB_W0H@Z
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?GetString@CTXStringW@@QBEPB_WXZ
??7CTXStringW@@QBE_NXZ
?SetWriteFileOpt@TXLog@@YAXH@Z
?GetSession@TXLog@@YAKXZ
?SetMainAndLogicMsgLoop@Misc@Util@@YAXPAVMessageLoopForUI@AsyncTask@@PAVMessageLoop@4@@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?InitArkHttp@HttpClientUtil@@SAHXZ
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
??0CTXStringA@@QAE@ABV0@@Z
??8@YA_NABVCTXStringA@@PBD@Z
??M@YA_NABVCTXStringA@@0@Z
?GetLength@CTXStringA@@QBEHXZ
?CompareNoCase@CTXStringA@@QBEHPBD@Z
?Replace@CTXStringA@@QAEHPBD0@Z
?ReverseFind@CTXStringA@@QBEHD@Z
?MakeLower@CTXStringA@@QAEAAV1@XZ
?Right@CTXStringA@@QBE?AV1@H@Z
?Left@CTXStringA@@QBE?AV1@H@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
?IsEmpty@CTXStringW@@QBE_NXZ
??0CTXBSTR@@QAE@XZ
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
??ICTXBSTR@@QAEPAPA_WXZ
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?IsFileExist@FS@@YAHPB_W@Z
?AsyncIsTencentTrusted@Misc@Util@@YAXPB_WPAUITXCallbackKey@@K@Z
?AsyncCheckFileTrusted@Misc@Util@@YAXPB_W0PAUITXCallbackKey@@K@Z
?GetMainThreadLoop@Misc@Util@@YAPAVMessageLoopForUI@AsyncTask@@XZ
?IsInitAsyncMsgLoop@Misc@Util@@YAHXZ
?GetMainAndLogicThreadId@Misc@Util@@YAXAAK0@Z
?LogTaskStart@Misc@Util@@YAKPB_W@Z
?LogTaskEnd@Misc@Util@@YAXK@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?DeleteDirectory@FS@@YAHPB_W@Z
?RenameDirectory@FS@@YAHPB_W0@Z
asynctask
?AssertAcquired@Lock@AsyncTask@@QBEXXZ
?PostDelayedTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@_J@Z
?Acquire@Lock@AsyncTask@@QAEXXZ
?PostTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@@Z
?QueryTaskCount@MessageLoop@AsyncTask@@QAEIXZ
?Start@Thread@AsyncTask@@QAE_NXZ
?IsRunning@Thread@AsyncTask@@QBE_NXZ
?Release@Lock@AsyncTask@@QAEXXZ
??0Lock@AsyncTask@@QAE@XZ
??1Lock@AsyncTask@@QAE@XZ
?SetWorkerFactory@MessageLoop@AsyncTask@@QAEXPAVWorkerFactory@12@@Z
?ThreadMain@Thread@AsyncTask@@EAEXXZ
?Init@Thread@AsyncTask@@MAEXXZ
?CleanUpAfterMessageLoopDestruction@Thread@AsyncTask@@MAEXXZ
?CleanUp@Thread@AsyncTask@@MAEXXZ
?Run@Thread@AsyncTask@@MAEXPAVMessageLoop@2@@Z
?thread_id@Thread@AsyncTask@@QBEKXZ
?message_loop@Thread@AsyncTask@@QBEPAVMessageLoop@2@XZ
?Stop@Thread@AsyncTask@@QAEXXZ
?StartWithOptions@Thread@AsyncTask@@QAE_NABUOptions@12@@Z
??1Thread@AsyncTask@@UAE@XZ
??0Thread@AsyncTask@@QAE@PBD@Z
??1MessageLoopForUI@AsyncTask@@UAE@XZ
?Run@MessageLoopForUI@AsyncTask@@QAEXXZ
??0MessageLoopForUI@AsyncTask@@QAE@XZ
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
CreateEventW
CreateFileMappingW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
CreateFileW
SearchPathW
QueryPerformanceCounter
UnmapViewOfFile
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Module32FirstW
Module32NextW
GetModuleFileNameA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
CreateMutexA
CreateProcessA
GetCommandLineA
MultiByteToWideChar
InterlockedExchange
FindClose
FindFirstFileA
FindNextFileA
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
MapViewOfFile
GetTickCount
GetSystemTimeAsFileTime
DuplicateHandle
GetProcAddress
VirtualQuery
VirtualAllocEx
HeapAlloc
HeapFree
GetStartupInfoW
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
RaiseException
SetUnhandledExceptionFilter
GetCurrentThreadId
OpenThread
GetLastError
SetErrorMode
ReadProcessMemory
WriteProcessMemory
SuspendThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForMultipleObjects
CloseHandle
user32
PostQuitMessage
advapi32
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
ole32
OleInitialize
OleUninitialize
CoCreateGuid
shlwapi
PathFileExistsW
msvcp140
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
_CxxThrowException
__CxxFrameHandler3
memset
memcpy
memmove
memchr
_purecall
__std_type_info_name
_except_handler4_common
__std_exception_copy
__std_exception_destroy
memcmp
api-ms-win-crt-runtime-l1-1-0
terminate
_controlfp_s
__p___argc
_invalid_parameter_noinfo
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
__p___wargv
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_errno
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
_recalloc
_callnewh
_set_new_mode
free
malloc
calloc
realloc
api-ms-win-crt-string-l1-1-0
wcscat_s
_wcslwr
wcscpy_s
wcslen
strlen
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__p__commode
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vsprintf_s
_set_fmode
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 13KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 449KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 78KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE