2c2c8cb98b70c409e49520488047cdd35f6bf10f48d560dfabb789bb4a5ce5ea

Sharing

Copy URL Twitter E-mail

General

Target

2c2c8cb98b70c409e49520488047cdd35f6bf10f48d560dfabb789bb4a5ce5ea
Size

1.0MB
MD5

afcf43fc2fcbe59fa930901d99434c78
SHA1

da167585cf2d1d072c5905ba9f756076bc81f1f3
SHA256

2c2c8cb98b70c409e49520488047cdd35f6bf10f48d560dfabb789bb4a5ce5ea
SHA512

d274c7a5185761df5a0a8e54d32e02b473709aac7eb382ba6c9fb575fb87bc355b7d7f75405705a075f4e1c2a01a10a5e30a3e6cb5000c10f00d81e9311d58e2
SSDEEP

24576:2kmW545YyrV0CD5nwEwf1uwAZJgK8gHwfV1l:2tWBv91l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c2c8cb98b70c409e49520488047cdd35f6bf10f48d560dfabb789bb4a5ce5ea

Files

2c2c8cb98b70c409e49520488047cdd35f6bf10f48d560dfabb789bb4a5ce5ea
.dll windows:6 windows x86 arch:x86

2bf910110b70062f1c4c58279b9a907a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\projects\vs\qq_info\qDll\Release\qDll.pdb

Imports

minhook.x86

MH_DisableHook
MH_Uninitialize
MH_CreateHook
MH_Initialize
MH_EnableHook
MH_StatusToString

kernel32

Sleep
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
InitializeSListHead
SizeofResource
GetConsoleScreenBufferInfo
HeapFree
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
WriteFile
GetDynamicTimeZoneInformation
InitializeCriticalSectionEx
GetCurrentThreadId
HeapSize
MultiByteToWideChar
GetConsoleMode
GetLastError
LockResource
HeapReAlloc
CloseHandle
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateFileW
LoadLibraryW
SystemTimeToFileTime
FreeLibrary
GetSystemTime
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
EnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
GetFileAttributesW
UnmapViewOfFile
HeapValidate
IsDebuggerPresent
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
GetSystemInfo
HeapCompact
UnlockFile
LocalFree
LockFileEx
GetFileSize
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetModuleHandleW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

MessageBoxA

msvcp140

??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
_Cnd_signal
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Thrd_id
_Xtime_get_ticks
_Thrd_join
_Mtx_unlock
_Cnd_destroy_in_situ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ

shlwapi

PathFileExistsW

vcruntime140

_CxxThrowException
_except_handler4_common
__std_type_info_destroy_list
__current_exception
__CxxFrameHandler3
memset
memmove
__current_exception_context
memcpy
memchr
__std_exception_copy
strrchr
__std_terminate
__std_exception_destroy

api-ms-win-crt-string-l1-1-0

wmemcpy_s
isdigit
strncmp
strcspn
isspace

api-ms-win-crt-heap-l1-1-0

_msize
malloc
calloc
_callnewh
realloc
free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vswprintf
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vswprintf_s

api-ms-win-crt-time-l1-1-0

_gmtime64_s
strftime
_localtime64_s

api-ms-win-crt-math-l1-1-0

_dclass
_fdclass
_ldclass
_dsign
_ldsign
ceil
_fdsign

api-ms-win-crt-runtime-l1-1-0

_cexit
_invalid_parameter_noinfo_noreturn
_errno
_initterm_e
_initterm
_crt_atexit
_invalid_parameter_noinfo
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_endthreadex
_beginthreadex
terminate

api-ms-win-crt-environment-l1-1-0

_wgetenv

Sections

.text
Size: 885KB - Virtual size: 884KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bf910110b70062f1c4c58279b9a907a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

minhook.x86

kernel32

user32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 885KB - Virtual size: 884KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 16KB - Virtual size: 49KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 885KB - Virtual size: 884KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 16KB - Virtual size: 49KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 29KB - Virtual size: 28KB