254df2d046d554c1329cd4ca3c2cfc171513b125bd11d19b737a625ffb3a27be

Sharing

Copy URL Twitter E-mail

General

Target

254df2d046d554c1329cd4ca3c2cfc171513b125bd11d19b737a625ffb3a27be
Size

3.4MB
MD5

6f67975b830948c3417e232ad8dca037
SHA1

59c4d7e468d9b3cae5d56922cbd5357a0f312f8b
SHA256

254df2d046d554c1329cd4ca3c2cfc171513b125bd11d19b737a625ffb3a27be
SHA512

d1ddfee78600cb6502045484060eda4a2fa6e78eb73fc4bfcfb5fca88115ccd51862946020cea35072cbc03306855f3e39a634d186cdc4105a23ac98e7cf49be
SSDEEP

3072:EymmlXYjTw6kb/r2CYoTKPclkUA/wxRR59ex0Xzk2gP+zQC7XuXOwHM:N9Yg7b/SCYoTKEk/WLMUktmzQ0u3s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
254df2d046d554c1329cd4ca3c2cfc171513b125bd11d19b737a625ffb3a27be

Files

254df2d046d554c1329cd4ca3c2cfc171513b125bd11d19b737a625ffb3a27be
.exe windows:5 windows x86 arch:x86

1b8fde3333b5f4140f829255594ad553

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\landun\p-f3a1f6da12794a4eb621c9a7b3c1d836\qqlivepc16\Symbol\FinalRelease\QQLiveService.pdb

Imports

common

?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?RemoveFileSystem@FS@@YAHPB_W@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
??0CTXStringW@@QAE@XZ
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
??0CTXStringW@@QAE@PA_W@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?AppendFormat@CTXStringW@@QAAXPB_WZZ
?Format@CTXStringW@@QAAXPB_WZZ
?Append@CTXStringW@@QAEXPB_W@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnUninitCom@Misc@Util@@YAXXZ
??BCTXStringW@@QBEPB_WXZ
?TrimRight@CTXStringW@@QAEAAV1@PB_W@Z
?Find@CTXStringW@@QBEHPB_WH@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@_WABV0@@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??0CTXStringW@@QAE@ABV0@@Z
??0CTXStringW@@QAE@PB_W@Z
??1CTXStringW@@QAE@XZ
?TXAssert@@YAHPB_W0H@Z

gf

?SetDPIAdaptFlag@DPI@GF@Util@@YAXH@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
?InitDPI@DPI@GF@Util@@YAXXZ

beacon_sdk

?UninitSDK@BeaconClient@@SAXXZ
?IsInitSdkFinish@BeaconClient@@SA_NXZ
?InitSDK@BeaconClient@@SAXABUBeaconConfig@@@Z
?Report@BeaconClient@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4RequestPriority@Beacon@@@Z

qqlivebase

?IsDirectoryExist@base@@YAHPB_W@Z
?CreateAllDirectory@base@@YAHPB_W@Z
?IsEnableUAC@base@@YAHXZ
?GetProcessPrivateUsage@ProcessMetrics@base@@QAEIXZ
?GetChannelInfoNoCache@base@@YA?BV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PAV23@0@Z
?GetQQLiveFriendlyVersion@base@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
??1ProcessMetrics@base@@QAE@XZ
?CreateCurrentProcessMetrics@ProcessMetrics@base@@SA?AV?$unique_ptr@VProcessMetrics@base@@U?$default_delete@VProcessMetrics@base@@@std@@@std@@XZ
?GetProcessIndependentCPUUsage@ProcessMetrics@base@@QAENXZ
?GetProcessWorkSetUsage@ProcessMetrics@base@@QAEIXZ
?FormUrlEncode@base@@YAXAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetModuleFolder@base@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PAUHINSTANCE__@@@Z
?SetDNSStatus@base@@YAXW4DNS_STATUS@1@@Z
?RegLocalVideoFile@base@@YAXABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetRegQQLiveRootPath@base@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ

kernel32

GetStartupInfoW
UnhandledExceptionFilter
GetProcAddress
VirtualProtect
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
GetLastError
WaitForSingleObject
CloseHandle
DuplicateHandle
QueryPerformanceCounter
CreateProcessW
IsBadReadPtr
InterlockedExchange
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
LockResource
LoadResource
SizeofResource
FindResourceW
FindResourceExW
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateDirectoryW
GetFileAttributesW
MultiByteToWideChar
GetSystemTimeAsFileTime
GetCommandLineW
RaiseException
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
Sleep
CreateMutexW
DeleteFileW
FreeLibrary
HeapCreate
SetProcessWorkingSetSize
SetEvent
ResetEvent
GetFileSize
DeviceIoControl
MapViewOfFile
UnmapViewOfFile
WaitForSingleObjectEx
ReadFileEx
CreateEventW
CreateFileMappingW
WideCharToMultiByte
LoadLibraryExA
GetSystemDirectoryW
SetCurrentDirectoryA
CreateFileA
CreateFileW
VirtualLock
VirtualUnlock
LocalAlloc
LocalFree
FindClose
lstrcmpW
OpenFileMappingW
FindFirstFileW
FindNextFileW
DecodePointer
WritePrivateProfileStringW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
DeleteCriticalSection
LoadLibraryW

user32

SetWindowLongW
KillTimer
SetTimer
DestroyWindow
CreateWindowExW
GetClassInfoExW
LoadCursorW
RegisterClassExW
UnregisterClassW
PostQuitMessage
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterWindowMessageW
DefWindowProcW
CallWindowProcW
GetWindowLongW

advapi32

RegSetValueExW
QueryServiceConfigW
OpenServiceW
RegCloseKey
RegCreateKeyExW
RegOpenKeyW
RegQueryValueExW
ChangeServiceConfigW
CloseServiceHandle
OpenSCManagerW

shell32

SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHChangeNotify

ole32

CoUninitialize
OleUninitialize
OleInitialize
CoInitialize
CoCreateInstance

oleaut32

SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
SysAllocString

shlwapi

PathCombineW
PathCombineA
PathAppendW
PathFileExistsW

comctl32

InitCommonControlsEx

msvcp140

??1_Lockit@std@@QAE@XZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1facet@locale@std@@MAE@XZ
??0_Lockit@std@@QAE@H@Z
??0facet@locale@std@@IAE@I@Z
??Bid@locale@std@@QAEIXZ
??1_Locinfo@std@@QAE@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Incref@facet@locale@std@@UAEXXZ
?id@?$numpunct@_W@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
_Getcvt
_Mbrtowc

livelog

?TestDNSConnection@@YAXXZ
?GetUserGuid@@YAXPADAAH@Z
?GetOmgIdStr@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?GetStatisticInst@@YAJPAPAUIStatistic@@@Z
?GetConfigInt@@YAJABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0JW4tagQQLIVE_CONFIG_TYPE@@@Z
?PathRemoveBackslashEx@@YAXAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetQLInstallDir@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?split@@YA?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z
?IsPortingAppPack@@YAHXZ
?GetAppDataPath@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?SetInstallStartupFlag@@YAX_N@Z
?SetStartSource@@YAXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?FileCoCreateInstance@@YAJPB_WABU_GUID@@PAUIUnknown@@K1PAPAXPAUHINSTANCE__@@@Z

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

logmanager

ReleaseLogManager
QQLogOutToFileFMTW
QQLogOutToFileW
OpenLogManager

business

?GetUserIniFilePath@business@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?GetChannelInfo@business@@YA?BV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryW

vcruntime140

__std_exception_copy
__std_exception_destroy
_except_handler4_common
memcpy
memmove
memset
wcsstr
wcsrchr
wcschr
memcmp
_CxxThrowException
__std_terminate
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_errno
_controlfp_s
_set_invalid_parameter_handler

api-ms-win-crt-string-l1-1-0

strlen
_wcsicmp
wcscpy_s
wmemcpy_s
wcscmp
wcsnlen
wcslen

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsprintf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__p__commode
__stdio_common_vsnprintf_s

api-ms-win-crt-convert-l1-1-0

_ultow_s

api-ms-win-crt-time-l1-1-0

_mktime64
_time64
_localtime64_s

api-ms-win-crt-heap-l1-1-0

_recalloc
free
calloc
_callnewh
_set_new_mode
malloc

api-ms-win-crt-math-l1-1-0

_dtest
__setusermatherr
_fdtest
_dsign
_ldsign
_fdsign
_ldtest

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1b8fde3333b5f4140f829255594ad553

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

common

gf

beacon_sdk

qqlivebase

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcp140

livelog

version

logmanager

business

urlmon

wininet

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 2KB - Virtual size: 3KB

.gfids Size: 512B - Virtual size: 76B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 71KB - Virtual size: 72KB

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 2KB - Virtual size: 3KB

.gfids
Size: 512B - Virtual size: 76B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 71KB - Virtual size: 72KB