GetProcessPixel
RegisterGetMousePosHook
RegisterKeyboardHook
SetPositionOffset
UnRegisterGetMousePosHook
UnRegisterKeyboardHook
Behavioral task
behavioral1
Sample
QQT/QMacro.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
QQT/QMacro.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
QQT/qmacro.chm
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
QQT/qmacro.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
QQT/qmh.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
QQT/qmh.dll
Resource
win10v2004-20231222-en
Target
356d57d3c8caf4187f47f03bad197cd5
Size
333KB
MD5
356d57d3c8caf4187f47f03bad197cd5
SHA1
128faed6b2e3e7ce0da1423793d89074fad2d906
SHA256
30de45ac763f6fdbe746787b483f0fc18dac7786343fce9a1baf1b56900908fd
SHA512
39039b05e6679acc76889e9629bbdaa1934735d16a6a7fe7358e63ef9f899a2fd163fb2130e055019fc5e93e53ebd7c07a357569083088730685c7094777366c
SSDEEP
6144:ddF2PqeJfAEiKnxXrtBnavCDkPlkewhWrZHwJCip+CuPhI6WTiTAw55P:ddFkJfAEiKnNJBa6IGewhWrZHguPhITy
resource | yara_rule |
---|---|
static1/unpack001/QQT/QMacro.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/QQT/QMacro.exe |
unpack001/QQT/qmh.dll |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateEventA
OpenEventA
SetEvent
WaitForSingleObject
GetFileType
FreeEnvironmentStringsW
WideCharToMultiByte
GetStringTypeW
GetStringTypeA
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
CloseHandle
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
LeaveCriticalSection
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
GetOEMCP
GetACP
HeapAlloc
GetCPInfo
GetProcAddress
LoadLibraryA
VirtualAlloc
HeapReAlloc
CallNextHookEx
PostMessageA
GetCursorPos
GetKeyState
SetWindowsHookExA
keybd_event
UnhookWindowsHookEx
CreateDCA
DeleteDC
GetPixel
GetProcessPixel
RegisterGetMousePosHook
RegisterKeyboardHook
SetPositionOffset
UnRegisterGetMousePosHook
UnRegisterKeyboardHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ