Static task
static1
Behavioral task
behavioral1
Sample
f0378bc7def432d2f81f54c458ba5d8232e17cf0b4bdf97a5c71a4febc906979.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f0378bc7def432d2f81f54c458ba5d8232e17cf0b4bdf97a5c71a4febc906979.exe
Resource
win10v2004-20230915-en
General
-
Target
f0378bc7def432d2f81f54c458ba5d8232e17cf0b4bdf97a5c71a4febc906979
-
Size
1.4MB
-
MD5
b53e323ba1d5d2c34dbef71a02ee0401
-
SHA1
93c4b6ef437c80254a2af6b08806681c19806328
-
SHA256
f0378bc7def432d2f81f54c458ba5d8232e17cf0b4bdf97a5c71a4febc906979
-
SHA512
4feab97145f74122715807087a4293001921c8f722026d325dbfa082fefc333ceb454a3cb9709c47657c188216dfd3416d5b2d0cb54600f85927e77111fcfa8b
-
SSDEEP
24576:rsaeAYRSo4JbtonqLYNJQSo5ahcIi7MHfekTpBOfyWNUtkA4csX6bf:rX5YMo6GqLYNJQS+deHWTyuUKfcsX6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0378bc7def432d2f81f54c458ba5d8232e17cf0b4bdf97a5c71a4febc906979
Files
-
f0378bc7def432d2f81f54c458ba5d8232e17cf0b4bdf97a5c71a4febc906979.exe windows:6 windows x86
4a25c3abfc92d485a9726ef67ebb5efa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5core
?qRegisterResourceData@@YA_NHPBE00@Z
?split@QString@@QBE?AVQStringList@@VQChar@@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z
?toStdString@QString@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
?detach@QListData@@QAEPAUData@1@H@Z
?dispose@QListData@@SAXPAUData@1@@Z
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
??1QVariant@@QAE@XZ
??0QVariant@@QAE@H@Z
??0QVariant@@QAE@PBD@Z
?toInt@QVariant@@QBEHPA_N@Z
??0QSettings@@QAE@ABVQString@@W4Format@0@PAVQObject@@@Z
??1QSettings@@UAE@XZ
?sync@QSettings@@QAEXXZ
?setValue@QSettings@@QAEXABVQString@@ABVQVariant@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?qt_metacast@QSettings@@UAEPAXPBD@Z
?qt_metacall@QSettings@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QSettings@@UBEPBUQMetaObject@@XZ
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?event@QSettings@@MAE_NPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?codecForName@QTextCodec@@SAPAV1@PBD@Z
?attach@QSharedMemory@@QAE_NW4AccessMode@1@@Z
?create@QSharedMemory@@QAE_NHW4AccessMode@1@@Z
??1QSharedMemory@@UAE@XZ
??0QSharedMemory@@QAE@ABVQString@@PAVQObject@@@Z
?execute@QProcess@@SAHABVQString@@@Z
?currentDateTime@QDateTime@@SA?AV1@XZ
??1QDateTime@@QAE@XZ
?setIniCodec@QSettings@@QAEXPAVQTextCodec@@@Z
?data@QArrayData@@QAEPAXXZ
?allocate@QArrayData@@SAPAU1@IIIV?$QFlags@W4AllocationOption@QArrayData@@@@@Z
?deallocate@QArrayData@@SAXPAU1@II@Z
??1QByteArray@@QAE@XZ
?data@QByteArray@@QAEPADXZ
?toLocal8Bit@QString@@QBE?AVQByteArray@@XZ
?fromWCharArray@QString@@SA?AV1@PB_WH@Z
?qWinMain@@YAXPAUHINSTANCE__@@0PADHAAHAAV?$QVector@PAD@@@Z
?shared_null@QArrayData@@2QBU1@B
?append@QString@@QAEAAV1@ABV1@@Z
??4QString@@QAEAAV0@ABV0@@Z
??1QString@@QAE@XZ
??0QString@@QAE@ABV0@@Z
??0QString@@QAE@XZ
?qUnregisterResourceData@@YA_NHPBE00@Z
?value@QSettings@@QBE?AVQVariant@@ABVQString@@ABV2@@Z
qt5widgets
?information@QMessageBox@@SAHPAVQWidget@@ABVQString@@1111HH@Z
??1QApplication@@UAE@XZ
??0QApplication@@QAE@AAHPAPADH@Z
kernel32
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
CloseHandle
Sleep
GetCommandLineW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
msvcp120
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
msvcr120
_lock
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
_commode
_fmode
_acmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
_exit
exit
__FrameUnwindFilter
memset
__set_app_type
__getmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
??2@YAPAXI@Z
memcpy
__CxxFrameHandler3
_CxxThrowException
_purecall
??_V@YAXPAX@Z
??3@YAXPAX@Z
wcstombs
memmove
mscoree
_CorExeMain
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ