Q3[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Q3.exe
Size

36KB
MD5

625ac05fd47adc3c63700c3b30de79ab
SHA1

9369d80106dd245938996e245340a3c6f17587fe
SHA256

0fa1498340fca6c562cfa389ad3e93395f44c72fd128d7ba08579a69aaf3b126
SHA512

2c1ded32a5978810012e2d6b9dd7ffc70a59decf513b93fe7faf1b1097b4b23c1a30a4c514aa8c383046e2e4194ef7be2ef229dc5353e9e0f4fcd3e1a900b19f
SSDEEP

96:TF0MgAr71nxY9AAIvqZ2ZNHHsP4oynLKcm5OzG38U6p2WL4P4oyn:iJaPLjC2ZNHMP4oynLKL38jp2VP4oyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Q3.exe

Files

Q3.exe
.exe windows:4 windows x86

Password: infected

aade0ea6fbdcd9b8e96fe999cae6f603

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
WinExec
WriteFile
CreateFileA
SizeofResource
CreateRemoteThread
FindResourceA
GetModuleHandleA
GetWindowsDirectoryA
MoveFileA
GetTempPathA
GetCurrentProcess
OpenProcess
CloseHandle
LoadResource

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

msvcrt

_snprintf
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_stricmp

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ