qappsrv[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

qappsrv.exe
Size

20KB
MD5

ff6066dc9d9c07324731ddd2337b301b
SHA1

90d24b175704a5060af44bc8b5cf0c49f0f402a3
SHA256

a17e6e3ef7dcfed272a02e962c009a4eb2394b853c7584a55163ddd72b21c743
SHA512

3519b93492caff889f782d787fae1d121856b7ac8cba9a6cf9ba1f7cb297780ed191e313ce77d5e0ba88fc35f4c0d7f0e8922479a932c9404797db12c1cfcff0
SSDEEP

384:UyFo0xErt7IRU9CPWb/AeaEXusR3D5N9B9WxlWPaWlW:UyFBSICL/us9Axic

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
qappsrv.exe

Files

qappsrv.exe
.exe windows:10 windows x86

9a3f9b8db2e0b61df89230bef806d0e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharToOemW
LoadStringW

netapi32

NetServerEnum
NetServerTransportEnum
NetApiBufferFree
NetServerGetInfo

kernel32

GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetConsoleScreenBufferInfo
GetConsoleOutputCP
SetConsoleMode
SetThreadUILanguage
CreateFileW
GetConsoleMode
ReadConsoleInputW
HeapSetInformation
SetLastError
GetStdHandle
MultiByteToWideChar
FormatMessageW
GetLastError
LoadLibraryW
WriteConsoleW
GetModuleHandleW
FreeLibrary
GetFileType
GetCommandLineW
LocalAlloc
LocalFree
GetOEMCP
GetACP
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
GetSystemTimeAsFileTime
Sleep

msvcrt

vswprintf_s
wcschr
vfwprintf
fwprintf
memmove
wprintf
printf
wcstol
wcstoul
_wcsnicmp
_wcsdup
_wcslwr
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
?terminate@@YAXXZ
_controlfp
_except_handler4_common
_ultoa
malloc
free
_wsetlocale
swprintf_s
wcscpy_s
_wcsupr
_wcsicmp
setlocale
wcscat_s
__iob_func
memset

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a3f9b8db2e0b61df89230bef806d0e5

Headers

DLL Characteristics

File Characteristics

Imports

user32

netapi32

kernel32

msvcrt

Sections

.text Size: 13KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 5KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 904B

.text
Size: 13KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 5KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 904B