Static task
static1
Behavioral task
behavioral1
Sample
msg2qm.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
msg2qm.exe
Resource
win10v2004-20231020-en
General
-
Target
msg2qm.exe
-
Size
100KB
-
MD5
93e8c17a75eca9785df075f58d6ef1db
-
SHA1
a2728caed01db383df59be37859f8a145615aa3a
-
SHA256
580d663ce799154d5d971116dbdeeb7696108c85e786bc69adb98ffbabbad219
-
SHA512
fcde8696866b83559f29282419958365eb54fa04acb3079cae887bbce21a7ad3a65cefb543938a7c73404aa2a471e7bae401b6bbd839fe4e6b9b956a21303062
-
SSDEEP
192:nLng4Yr0mbAOKdBW/IUlfUFoUQE7EqFUoynnRHUiO:nLv1mUaUsqyj0h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource msg2qm.exe
Files
-
msg2qm.exe.exe windows:4 windows x86
2fdffd415811bdf9bb0903f2ecdc6872
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
qt-mt230nc
?connectNotify@QObject@@MAEXPBD@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?initMetaObject@QTranslator@@MAEXXZ
?removeChild@QObject@@UAEXPAV1@@Z
?insertChild@QObject@@UAEXPAV1@@Z
?setName@QObject@@UAEXPBD@Z
?className@QTranslator@@UBEPBDXZ
?metaObject@QTranslator@@UBEPAVQMetaObject@@XZ
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?save@QTranslator@@QAE_NABVQString@@W4SaveMode@1@@Z
?close@QFile@@UAEXXZ
??1QTextStream@@UAE@XZ
?debug@@YAXPBDZZ
?codecForName@QTextCodec@@SAPAV1@PBDH@Z
?mid@QString@@QBE?AV1@II@Z
?disconnectNotify@QObject@@MAEXPBD@Z
??AQString@@QAE?AVQCharRef@@H@Z
??YQString@@QAEAAV0@ABV0@@Z
?null@QString@@2V1@A
?readLine@QTextStream@@QAE?AVQString@@XZ
?skipWhiteSpace@QTextStream@@QAEXXZ
?isEmpty@QString@@QBE_NXZ
?atEnd@QTextStream@@QBE_NXZ
?setCodec@QTextStream@@QAEXPAVQTextCodec@@@Z
??0QTextStream@@QAE@PAVQIODevice@@@Z
?at@QFile@@UAE_NH@Z
??0QTranslator@@QAE@PAVQObject@@PBD@Z
??1QFile@@UAE@XZ
?open@QFile@@UAE_NH@Z
??0QFile@@QAE@ABVQString@@@Z
??1QTranslator@@UAE@XZ
??8@YA_NABVQString@@PBD@Z
??1?$QArray@D@@UAE@XZ
?checkConnectArgs@QObject@@MAE_NPBDPBV1@0@Z
?find@QTranslator@@UBE?AVQString@@PBD0@Z
?isNull@QString@@QBE_NXZ
??0QString@@QAE@PBD@Z
?find@QString@@QBEHPBDH@Z
??4QString@@QAEAAV0@ABV0@@Z
?right@QString@@QBE?AV1@I@Z
?ascii@QString@@QBEPBDXZ
?contains@QTranslator@@QBE_NPBD0@Z
?qWarning@@YAXPBDZZ
?latin1@QString@@QBEPBDXZ
?insert@QTranslator@@QAEXPBD0ABVQString@@@Z
??0QString@@QAE@XZ
?contains@QString@@QBEHD_N@Z
??0QString@@QAE@ABV0@@Z
??AQString@@QBE?AVQChar@@H@Z
??0QChar@@QAE@ABV0@@Z
??BQChar@@QBEDXZ
??YQString@@QAEAAV0@D@Z
??YQString@@QAEAAV0@VQChar@@@Z
?length@QString@@QBEIXZ
?left@QString@@QBE?AV1@I@Z
??8@YA_NABVQString@@0@Z
?isSpace@QCharRef@@QBE_NXZ
??1QString@@QAE@XZ
?deleteData@QGArray@@MAEXPAUarray_data@1@@Z
?newData@QGArray@@MAEPAUarray_data@1@XZ
??1QGArray@@MAE@XZ
?qWinMain@@YAXPAUHINSTANCE__@@0PADHAAHAAV?$QArray@PAD@@@Z
??0QGArray@@IAE@H@Z
?duplicate@QGArray@@IAEAAV1@ABV1@@Z
??_7?$QArray@D@@6B@
msvcrt
strlen
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
printf
exit
??3@YAXPAX@Z
??2@YAPAXI@Z
_chkesp
strcpy
kernel32
GetStartupInfoA
GetModuleHandleA
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 614B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ