q[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

q.exe
Size

4.4MB
MD5

f753babf050be13c213bc5d8cbca7eff
SHA1

e7d857b0eb77827657d962478111ef03f85ba2f7
SHA256

741bc988d09845cc112c8368f67839cc9bc2df7e26c00e7da806f7d86cae0403
SHA512

30c4e39418864d9bcad637cdc2ccc15254e4c5001d347e4603c0c0ea6611bc3e7301da69269d5007f1f5568251b4502cfb3b092bcdcff44900ef278db739e673
SSDEEP

49152:agMBtvDgJojrRrZH/RxPltOb6iYSwTUzLza8QIIjsNT4DcZz8Qo2ptSjR2nJbEkf:AH0def0XSFQRKFdu9CwJsv6t04eI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
q.exe

Files

q.exe
.exe windows:6 windows x64

d2a4d3e5023533117a46055b3feb3b9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcpyA
WriteConsoleW
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
SetEnvironmentVariableW
HeapReAlloc
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
GetStdHandle
FormatMessageW
LocalAlloc
LocalFree
CloseHandle
GetLastError
CreateEventW
WaitForMultipleObjects
GlobalFree
SetHandleInformation
CompareStringEx
OutputDebugStringW
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetConsoleWindow
GetCommandLineW
GetCurrentProcessId
GetSystemTime
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
SetEvent
WaitForSingleObjectEx
CreateFileW
GetFileAttributesExW
DuplicateHandle
WaitForSingleObject
Sleep
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
ResetEvent
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
GetLongPathNameW
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FlushFileBuffers
GetDriveTypeW
GetFileType
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
FindFirstFileExW
FindNextFileW
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
PeekNamedPipe
GetOverlappedResult
CancelIoEx
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
FreeLibrary
GetModuleHandleExW
LoadLibraryW
GetExitCodeProcess
OpenProcess
K32GetModuleFileNameExW
ReleaseMutex
CreateMutexW
VirtualAlloc
VirtualFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
SetLastError
LoadLibraryExW
RtlUnwind
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFileAttributesW
SetStdHandle
ExitProcess

advapi32

BuildTrusteeWithSidW
RegSetValueExW
GetUserNameA
GetUserNameW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
AccessCheck
AllocateAndInitializeSid
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
LookupAccountNameW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
LookupAccountSidW
MapGenericMask
GetLengthSid
FreeSid
DuplicateToken
CopySid

dnsapi

DnsQuery_W
DnsFree

iphlpapi

ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToGuid
ConvertInterfaceIndexToLuid
GetAdaptersAddresses
ConvertInterfaceLuidToIndex
ConvertInterfaceNameToLuidW

secur32

InitSecurityInterfaceW

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration

userenv

GetUserProfileDirectoryW

netapi32

NetShareEnum
NetWkstaGetInfo
NetApiBufferFree

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winmm

timeKillEvent
timeSetEvent

ws2_32

htonl
getnameinfo
ntohl
getsockopt
setsockopt
getaddrinfo
bind
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSANtohs
select
closesocket
listen
htons
getsockname
getpeername
freeaddrinfo
WSAGetLastError
WSAAccept
WSASocketW
WSAConnect
WSAHtonl
WSAIoctl
__WSAFDIsSet
gethostname
WSAStartup
WSACleanup
WSAAsyncSelect
WSANtohl

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
SetWindowLongPtrW
GetWindowLongPtrW
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
CharNextExA
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
DestroyWindow
GetQueueStatus

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree

oleaut32

SysFreeString
SysAllocString
GetErrorInfo
SetErrorInfo
SysStringLen

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2a4d3e5023533117a46055b3feb3b9e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

dnsapi

iphlpapi

secur32

winhttp

userenv

netapi32

version

winmm

ws2_32

user32

shell32

ole32

oleaut32

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 46KB - Virtual size: 72KB

.pdata Size: 115KB - Virtual size: 114KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 103KB - Virtual size: 103KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 46KB - Virtual size: 72KB

.pdata
Size: 115KB - Virtual size: 114KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 103KB - Virtual size: 103KB

.reloc
Size: 14KB - Virtual size: 14KB