q-sync[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

q-sync.exe
Size

4.8MB
MD5

1e1be0093a9eb7022f35740e525df006
SHA1

b05b0ef8a4f00d2488381da978357ffece033a56
SHA256

3f6868de0123abbdb98408b9236b94ef55a09fe2b5761ae7101bf45f3d20672d
SHA512

b8aea35ef7fb24fddbf46a686d8e528718fd5ce5b867bf55c96652a7f6c728529c131cb95b994218ba98c7b81a97318af42b0cf53508d1e422989cc454659a8a
SSDEEP

98304:VTVnVW6TMr0w+MFNxaw/BwMr/rFerGrEoUKnL2Oh:BVZ1LwZNynCL5h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
q-sync.exe

Files

q-sync.exe
.exe windows:4 windows x86

266b4a4084c965cb94fbaef2ab71f581

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary
GetModuleFileNameA

advapi32

GetUserNameA

msvcrt

sprintf
strcmp
strtok
strlen
strstr
__p__environ
memmove
malloc
realloc
strncpy
strncmp
_errno
_mkdir
free
_pctype
_isctype
__mb_cur_max
memcpy
memset
_rmdir
_findclose
_findnext
_unlink
_findfirst
fprintf
_iob
_strdup
_access
_stat
_strnicmp
_getpid
_close
_read
_lseek
_open
_spawnvpe
_chmod
_write
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 932KB - Virtual size: 930KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE