Static task
static1
Behavioral task
behavioral1
Sample
fca4787b929065b6612f064146998ea5a96cbe96931b808aeee327acf94e8c92.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
fca4787b929065b6612f064146998ea5a96cbe96931b808aeee327acf94e8c92.exe
Resource
win10v2004-20231127-en
General
-
Target
fca4787b929065b6612f064146998ea5a96cbe96931b808aeee327acf94e8c92
-
Size
167KB
-
MD5
4419e73e06326f91a173810c2dc72c4f
-
SHA1
f23f16793cda2e2b0f746a9fb08876b0115ae565
-
SHA256
fca4787b929065b6612f064146998ea5a96cbe96931b808aeee327acf94e8c92
-
SHA512
fe2484d7136e741fcf72358206c156e836b1877b07fd60390e0c0770b669287a320fede89c56dc044f921bb6153ce3bbd2d22b3aa429a37679511f1b932bf636
-
SSDEEP
3072:I06Res4pNRN/bqNcpugRjrMAKkXf/E0XXFEY:b6R9yNRN/bmcpLr+kXf/nXX+Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fca4787b929065b6612f064146998ea5a96cbe96931b808aeee327acf94e8c92
Files
-
fca4787b929065b6612f064146998ea5a96cbe96931b808aeee327acf94e8c92.exe windows:6 windows x86 arch:x86
2a479615c86ee00c235dccbbd188b229
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
libcurl
ord75
ord4
ord1
ord10
ord14
ord5
ord16
ord74
ord25
ord26
ord22
libcrypto-1_1
RSA_free
PEM_read_bio_RSAPublicKey
RSA_public_decrypt
RSA_size
RSA_new
BIO_new_mem_buf
BIO_free_all
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetCurrentThreadId
qt5core
?qt_metacall@QObject@@UAEHW4Call@QMetaObject@@HPAPAX@Z
??0QString@@QAE@XZ
??1QString@@QAE@XZ
?remove@QString@@QAEAAV1@HH@Z
??4QString@@QAEAAV0@PBD@Z
??0QCoreApplication@@QAE@AAHPAPADH@Z
??1QCoreApplication@@UAE@XZ
?exec@QCoreApplication@@SAHXZ
?qsrand@@YAXI@Z
?cast@QMetaObject@@QBEPAVQObject@@PAV2@@Z
??1Connection@QMetaObject@@QAE@XZ
??0QChar@@QAE@UQLatin1Char@@@Z
??0QChar@@QAE@D@Z
??0QByteArray@@QAE@XZ
??0QByteArray@@QAE@PBDH@Z
??1QByteArray@@QAE@XZ
??0QByteArray@@QAE@$$QAV0@@Z
??4QByteArray@@QAEAAV0@$$QAV0@@Z
?data@QByteArray@@QAEPADXZ
?data@QByteArray@@QBEPBDXZ
?constData@QByteArray@@QBEPBDXZ
?indexOf@QByteArray@@QBEHPBDH@Z
?left@QByteArray@@QBE?AV1@H@Z
?toHex@QByteArray@@QBE?AV1@XZ
?fromBase64@QByteArray@@SA?AV1@ABV1@@Z
?fromHex@QByteArray@@SA?AV1@ABV1@@Z
??0QString@@QAE@ABV0@@Z
??4QString@@QAEAAV0@ABV0@@Z
??4QString@@QAEAAV0@$$QAV0@@Z
?data@QString@@QBEPBVQChar@@XZ
?constData@QString@@QBEPBVQChar@@XZ
?clear@QString@@QAEXXZ
?arg@QString@@QBE?AV1@KHHVQChar@@@Z
?arg@QString@@QBE?AV1@HHHVQChar@@@Z
?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z
?asprintf@QString@@SA?AV1@PBDZZ
?indexOf@QString@@QBEHABV1@HW4CaseSensitivity@Qt@@@Z
?left@QString@@QBE?AV1@H@Z
?right@QString@@QBE?AV1@H@Z
?mid@QString@@QBE?AV1@HH@Z
?startsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z
?trimmed@QString@@QGBE?AV1@XZ
?append@QString@@QAEAAV1@ABV1@@Z
?remove@QString@@QAEAAV1@ABV1@W4CaseSensitivity@Qt@@@Z
?split@QString@@QBE?AVQStringList@@ABV1@V?$QFlags@W4SplitBehaviorFlags@Qt@@@@W4CaseSensitivity@Qt@@@Z
?toUtf8@QString@@QGBE?AVQByteArray@@XZ
?toUtf8@QString@@QHAE?AVQByteArray@@XZ
?fromUtf8@QString@@SA?AV1@PBDH@Z
?toInt@QString@@QBEHPA_NH@Z
??0QString@@QAE@ABVQByteArray@@@Z
??4QString@@QAEAAV0@ABVQByteArray@@@Z
?prepend@QString@@QAEAAV1@PBD@Z
?fromStdString@QString@@SA?AV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
?argToQString@QtPrivate@@YA?AVQString@@VQStringView@@IPAPBUArgBase@1@@Z
?detach@QListData@@QAEPAUData@1@H@Z
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?realloc@QListData@@QAEXH@Z
?dispose@QListData@@QAEXXZ
?dispose@QListData@@SAXPAUData@1@@Z
?append@QListData@@QAEPAPAXXZ
?insert@QListData@@QAEPAPAXH@Z
?size@QListData@@QBEHXZ
?isEmpty@QListData@@QBE_NXZ
?at@QListData@@QBEPAPAXH@Z
?begin@QListData@@QBEPAPAXXZ
?end@QListData@@QBEPAPAXXZ
??0QRegExp@@QAE@ABVQString@@W4CaseSensitivity@Qt@@W4PatternSyntax@0@@Z
??1QRegExp@@QAE@XZ
?indexIn@QRegExp@@QBEHABVQString@@HW4CaretMode@1@@Z
?cap@QRegExp@@QAE?AVQString@@H@Z
?QStringList_join@QtPrivate@@YA?AVQString@@PBVQStringList@@PBVQChar@@H@Z
?QStringList_contains@QtPrivate@@YA_NPBVQStringList@@ABVQString@@W4CaseSensitivity@Qt@@@Z
??0QObject@@QAE@PAV0@@Z
??1QObject@@UAE@XZ
?moveToThread@QObject@@QAEXPAVQThread@@@Z
?sender@QObject@@IBEPAV1@XZ
?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z
??0QUrl@@QAE@XZ
??1QUrl@@QAE@XZ
?setUrl@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?clear@QUrl@@QAEXXZ
?setScheme@QUrl@@QAEXABVQString@@@Z
?scheme@QUrl@@QBE?AVQString@@XZ
?userInfo@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
?setUserName@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?setPassword@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?setHost@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
?setPort@QUrl@@QAEXH@Z
?port@QUrl@@QBEHH@Z
??1QDateTime@@QAE@XZ
?toString@QDateTime@@QBE?AVQString@@ABV2@@Z
?currentDateTime@QDateTime@@SA?AV1@XZ
?currentMSecsSinceEpoch@QDateTime@@SA_JXZ
?readAll@QIODevice@@QAE?AVQByteArray@@XZ
?write@QIODevice@@QAE_JABVQByteArray@@@Z
??0QVariant@@QAE@XZ
??1QVariant@@QAE@XZ
?toInt@QVariant@@QBEHPA_N@Z
?toString@QVariant@@QBE?AVQString@@XZ
??0QJsonValue@@QAE@W4Type@0@@Z
??0QJsonValue@@QAE@_N@Z
??0QJsonValue@@QAE@H@Z
??0QJsonValue@@QAE@ABVQString@@@Z
??1QJsonValue@@QAE@XZ
?type@QJsonValue@@QBE?AW4Type@1@XZ
?toBool@QJsonValue@@QBE_N_N@Z
?toInt@QJsonValue@@QBEHH@Z
?toString@QJsonValueRef@@QBE?AVQString@@XZ
?toObject@QJsonValueRef@@QBE?AVQJsonObject@@XZ
?toValue@QJsonValueRef@@ABE?AVQJsonValue@@XZ
??0QJsonDocument@@QAE@XZ
??1QJsonDocument@@QAE@XZ
?fromJson@QJsonDocument@@SA?AV1@ABVQByteArray@@PAUQJsonParseError@@@Z
?toJson@QJsonDocument@@QBE?AVQByteArray@@W4JsonFormat@1@@Z
?isObject@QJsonDocument@@QBE_NXZ
?object@QJsonDocument@@QBE?AVQJsonObject@@XZ
?setObject@QJsonDocument@@QAEXABVQJsonObject@@@Z
??0QJsonObject@@QAE@XZ
??1QJsonObject@@QAE@XZ
??4QJsonObject@@QAEAAV0@$$QAV0@@Z
??AQJsonObject@@QAE?AVQJsonValueRef@@ABVQString@@@Z
?contains@QJsonObject@@QBE_NABVQString@@@Z
?insert@QJsonObject@@QAE?AViterator@1@ABVQString@@ABVQJsonValue@@@Z
??0QTimer@@QAE@PAVQObject@@@Z
??1QTimer@@UAE@XZ
?setInterval@QTimer@@QAEXH@Z
?start@QTimer@@QAEXXZ
?stop@QTimer@@QAEXXZ
?timeout@QTimer@@QAEXUQPrivateSignal@1@@Z
?defaultTypeFor@QTimer@@CA?AW4TimerType@Qt@@H@Z
?singleShotImpl@QTimer@@CAXHW4TimerType@Qt@@PBVQObject@@PAVQSlotObjectBase@QtPrivate@@@Z
??0QProcess@@QAE@PAVQObject@@@Z
??1QProcess@@UAE@XZ
?start@QProcess@@QAEXV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?setProgram@QProcess@@QAEXABVQString@@@Z
?setArguments@QProcess@@QAEXABVQStringList@@@Z
?setProcessChannelMode@QProcess@@QAEXW4ProcessChannelMode@1@@Z
?setWorkingDirectory@QProcess@@QAEXABVQString@@@Z
?waitForStarted@QProcess@@QAE_NH@Z
?waitForFinished@QProcess@@QAE_NH@Z
?readAllStandardOutput@QProcess@@QAE?AVQByteArray@@XZ
?exitCode@QProcess@@QBEHXZ
?kill@QProcess@@QAEXXZ
?readyReadStandardOutput@QProcess@@QAEXUQPrivateSignal@1@@Z
?instance@QCoreApplication@@SAPAV1@XZ
?exit@QCoreApplication@@SAXH@Z
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
?aboutToQuit@QCoreApplication@@QAEXUQPrivateSignal@1@@Z
?close@QFileDevice@@UAEXXZ
??0QFile@@QAE@ABVQString@@@Z
??1QFile@@UAE@XZ
?exists@QFile@@QBE_NXZ
?remove@QFile@@SA_NABVQString@@@Z
?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
??0QDir@@QAE@ABVQString@@@Z
??1QDir@@QAE@XZ
?mkpath@QDir@@QBE_NABVQString@@@Z
?exists@QDir@@QBE_NABVQString@@@Z
??0QSettings@@QAE@ABVQString@@W4Format@0@PAVQObject@@@Z
??1QSettings@@UAE@XZ
?value@QSettings@@QBE?AVQVariant@@ABVQString@@ABV2@@Z
??0QDeadlineTimer@@QAE@W4ForeverConstant@0@W4TimerType@Qt@@@Z
??0QThread@@QAE@PAVQObject@@@Z
??1QThread@@UAE@XZ
?start@QThread@@QAEXW4Priority@1@@Z
?quit@QThread@@QAEXXZ
?wait@QThread@@QAE_NVQDeadlineTimer@@@Z
?started@QThread@@QAEXUQPrivateSignal@1@@Z
?finished@QThread@@QAEXUQPrivateSignal@1@@Z
?codecForName@QTextCodec@@SAPAV1@PBD@Z
?toUnicode@QTextCodec@@QBE?AVQString@@ABVQByteArray@@@Z
??1QMutex@@QAE@XZ
?lock@QMutex@@QAEXXZ
??1QMutexLocker@@QAE@XZ
?atEnd@QProcess@@UBE_NXZ
?bytesAvailable@QProcess@@UBE_JXZ
?bytesToWrite@QProcess@@UBE_JXZ
?canReadLine@QProcess@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?close@QProcess@@UAEXXZ
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?event@QThread@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?isSequential@QProcess@@UBE_NXZ
?metaObject@QProcess@@UBEPBUQMetaObject@@XZ
?metaObject@QThread@@UBEPBUQMetaObject@@XZ
?metaObject@QTimer@@UBEPBUQMetaObject@@XZ
?open@QProcess@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?pos@QIODevice@@UBE_JXZ
?qt_metacall@QProcess@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacall@QThread@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacall@QTimer@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QProcess@@UAEPAXPBD@Z
?qt_metacast@QThread@@UAEPAXPBD@Z
?qt_metacast@QTimer@@UAEPAXPBD@Z
?readData@QProcess@@MAE_JPAD_J@Z
?readLineData@QIODevice@@MAE_JPAD_J@Z
?reset@QIODevice@@UAE_NXZ
?run@QThread@@MAEXXZ
?seek@QIODevice@@UAE_N_J@Z
?setupChildProcess@QProcess@@MAEXXZ
?size@QIODevice@@UBE_JXZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?timerEvent@QTimer@@MAEXPAVQTimerEvent@@@Z
?waitForBytesWritten@QProcess@@UAE_NH@Z
?waitForReadyRead@QProcess@@UAE_NH@Z
?writeData@QProcess@@MAE_JPBD_J@Z
?shared_null@QListData@@2UData@1@B
?staticMetaObject@QTimer@@2UQMetaObject@@B
?staticMetaObject@QProcess@@2UQMetaObject@@B
?staticMetaObject@QCoreApplication@@2UQMetaObject@@B
?staticMetaObject@QThread@@2UQMetaObject@@B
?staticMetaObject@QObject@@2UQMetaObject@@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?qt_metacast@QObject@@UAEPAXPBD@Z
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
memset
_except_handler4_common
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
__current_exception_context
__current_exception
api-ms-win-crt-runtime-l1-1-0
terminate
system
_configure_narrow_argv
_initialize_narrow_environment
_controlfp_s
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_get_initial_narrow_environment
_initterm
_invalid_parameter_noinfo_noreturn
exit
_exit
_initterm_e
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__p__commode
_set_fmode
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ