508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206

General

Target
508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206
Size 136KB
Sample240219-3lphkafe3t
SHA256 508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206
MD5 654b4830d4d247a02b3312446575468f
SHA1 0d2895c4ccdda9eec52c78e2c77f073073a66029
SHA512 fd4421ee6e71d352d20ed66eae5e8bdc0602c6c403d2875f0c4ce9ddd3b4bd5d49c2a2003e62357fe46c848db39377d65c3a2c3756c2e1895fa8fa78d9da9a2d
SSDEEP 3072:6x9xG/YTtMSlwcDHRuFCdF7hNAN2oWfuznY:Q9rMAwqRuF+DNAUoWfuznY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206

File Explorer

508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206

.exe 136KB

508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206

IMPHASH 4e728483442719b19ff6ed0d82061df8
SHA256 508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206
MD5 654b4830d4d247a02b3312446575468f
SHA1 0d2895c4ccdda9eec52c78e2c77f073073a66029
SHA512 fd4421ee6e71d352d20ed66eae5e8bdc0602c6c403d2875f0c4ce9ddd3b4bd5d49c2a2003e62357fe46c848db39377d65c3a2c3756c2e1895fa8fa78d9da9a2d
SSDEEP 3072:6x9xG/YTtMSlwcDHRuFCdF7hNAN2oWfuznY:Q9rMAwqRuF+DNAUoWfuznY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\devops\workspace\p-37d34ce895ed4865ac95061b653d796f\Output\BinFinal\QQScLauncher.pdb

kernel32

FindFirstFileW FindClose GetModuleFileNameW GetStartupInfoW CloseHandle InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId IsDebuggerPresent CreateProcessW QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW

user32

SendMessageW ReleaseDC GetDC FindWindowW

gdi32

GetDeviceCaps

vcruntime140

wcsrchr memset _except_handler4_common _CxxThrowException __std_exception_destroy __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _initterm _initterm_e _exit _get_wide_winmain_command_line _register_onexit_function _crt_atexit _controlfp_s terminate _configure_wide_argv _c_exit _set_app_type _initialize_onexit_table _register_thread_local_exe_atexit_callback _seh_filter_exe __p___wargv __p___argc exit _cexit

api-ms-win-crt-string-l1-1-0

wcsncmp wcslen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

Sharing

General

Malware Config

Signatures

File Explorer

508b3193605b48211af0087d68941b08825258a30f32509506d8b62c6e8e6206

kernel32

user32

gdi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic