QQBrowserSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

QQBrowserSetup.exe
Size

112.0MB
MD5

b97cf949985532ee53547e4030d275ef
SHA1

f00f2d36a5b45d05d6e45c751a5b07a5dd863fc0
SHA256

f114623a1e23f9d84ee1887b9a6ab9dc1f89f3e404067c375d31cd5bc2dabaf7
SHA512

568b5a5c0dbc79db19396015a02e0985fb053527e22c4c0e65c59673ef9cc4224b7be9f274146d3f06c8cd4aa67e922bb612bc07b183c559bfc4ffcf4d2d0cdc
SSDEEP

3145728:RPlFLgdufqLyOwllBdxi7zTO/pL9WnxRz9rWEort:RLNCL0d4rO/pL0Rprirt

Score

1^/10

Malware Config

Signatures

Files

QQBrowserSetup.exe
.exe windows:6 windows x64 arch:x64

af2792e9620ef734c5946439067e2492

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:7e:15:f2:fd:54:98:29:8d:3b:f6:31:33:b1:96:ea:d6:bf:b8:9c:e6:ff:a0:01:a3:97:f4:d7:99:d8:b1:59
Signer

Actual PE Digest

7d:7e:15:f2:fd:54:98:29:8d:3b:f6:31:33:b1:96:ea:d6:bf:b8:9c:e6:ff:a0:01:a3:97:f4:d7:99:d8:b1:59

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Git-repo\qb10frame\chrome\src\qb\features\setup\bin\Intermediate\QBSetupNew\Release_x64\QBSetupNew.pdb

Imports

kernel32

GetSystemDirectoryW
VerSetConditionMask
VerifyVersionInfoW
WriteFile
DecodePointer
LoadLibraryW
FreeLibrary
SetCurrentDirectoryW
lstrcmpiW
VirtualQueryEx
VirtualProtectEx
SetThreadContext
GetThreadContext
WriteProcessMemory
ReadProcessMemory
VirtualAllocEx
VirtualQuery
GetVersionExW
GetTickCount
CreateProcessW
SuspendThread
OpenThread
GetCurrentThreadId
SwitchToThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
WaitForMultipleObjects
CreateEventW
LeaveCriticalSection
OpenEventW
InitializeCriticalSection
CreateMutexW
GetDiskFreeSpaceExW
GetBinaryTypeW
DeleteTimerQueue
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
CreateTimerQueue
LocalFree
GetSystemPowerStatus
FreeResource
CreateFileMappingW
TerminateThread
Sleep
OpenMutexW
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
GetFileAttributesW
CompareFileTime
Module32NextW
Module32FirstW
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GlobalFree
GetLocalTime
SetErrorMode
SetUnhandledExceptionFilter
DuplicateHandle
GetTempPathW
GetCommandLineW
LoadLibraryExW
GetProcAddress
CopyFileW
DeleteFileW
GetPrivateProfileStringW
lstrlenW
SetLastError
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
GlobalLock
GlobalUnlock
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleW
GetModuleFileNameW
FindResourceExW
UnmapViewOfFile
MapViewOfFile
EnterCriticalSection
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetTimeZoneInformation
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentThread
ReadFile
GetFileSize
CreateFileW
ExitProcess
PeekNamedPipe
GetDriveTypeW
FindFirstFileExW
VirtualProtect
WriteConsoleW
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetLocaleInfoEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
QueryPerformanceFrequency
LCMapStringEx
GetCPInfo
CompareStringEx
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetStringTypeW
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
DeviceIoControl
K32GetMappedFileNameW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
Process32NextW
Process32FirstW
ResumeThread
AssignProcessToJobObject
GetSystemDefaultLangID
FlushFileBuffers
QueryPerformanceCounter
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
LockFileEx
UnlockFile
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
RtlUnwind
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
LocalAlloc
ExpandEnvironmentStringsW
FormatMessageW
WritePrivateProfileStringW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
InitializeCriticalSectionEx
MulDiv
VirtualFree
VirtualAlloc
MoveFileExW
CreateDirectoryW
SetFilePointer
GetFileInformationByHandle
SetFileTime
SetEndOfFile
GetStdHandle
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
GetSystemInfo
GlobalMemoryStatusEx
GetWindowsDirectoryW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetShortPathNameW
GetCurrentDirectoryW
SearchPathW
GetTempFileNameW
FindCloseChangeNotification
FindFirstChangeNotificationW
GetLogicalDriveStringsW
lstrcpynW
OpenProcess
GetExitCodeProcess
QueryDosDeviceW
lstrcpyW
lstrcatW

user32

GetParent
PtInRect
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
CharNextW
PostQuitMessage
EndDialog
GetClientRect
GetWindowRect
ScreenToClient
MapWindowPoints
FillRect
GetWindowTextW
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetDC
EnableWindow
GetActiveWindow
SendMessageW
SetWindowTextW
ShowWindow
SendMessageTimeoutW
CopyRect
PostThreadMessageW
LoadStringW
CreateIconFromResourceEx
MessageBoxW
GetWindowThreadProcessId
FindWindowExW
FindWindowW
GetDlgItem
RedrawWindow
MoveWindow
CharLowerW
CharPrevExA
CharUpperW
FrameRect
IsWindowVisible
SendInput
GetForegroundWindow
SetForegroundWindow
EnumWindows
InvalidateRect
LoadCursorW
DefWindowProcW
PostMessageW
GetSysColor
SetWindowLongPtrW
GetWindowLongPtrW
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
IsZoomed
IsIconic
GetDesktopWindow
DrawTextW
DrawFocusRect
SetFocus
SetCaretPos
CreateCaret
ShowCaret
GetWindowLongW
GetWindowTextLengthW
SetWindowPos
LoadImageW
SetWindowRgn
DestroyIcon
GetIconInfo
SetRectEmpty
GetSystemMetrics
ReleaseDC
IsRectEmpty
EqualRect
OffsetRect
KillTimer
SetTimer
SetCapture
ReleaseCapture
UnionRect
GetCursorPos
IntersectRect
IsWindowEnabled
BeginPaint
EndPaint
EnumChildWindows
SetCursor
UpdateWindow
GetAsyncKeyState
SetWindowLongW
GetFocus
ClientToScreen
GetWindowDC
UpdateLayeredWindow

gdi32

GetObjectA
CreateCompatibleDC
SetViewportOrgEx
CreateDIBSection
BitBlt
CreateRectRgnIndirect
SelectClipRgn
RectVisible
GetClipBox
GetViewportOrgEx
RestoreDC
SaveDC
CreateFontIndirectW
MoveToEx
SelectObject
LineTo
DeleteObject
CreatePen
ExtTextOutW
SetBkColor
DeleteDC
GetStockObject
CreateSolidBrush
GetTextMetricsW
SetBkMode
SetTextColor
CreateCompatibleBitmap
CreatePatternBrush
ExtSelectClipRgn
GetBitmapBits
SetBitmapBits
GetTextExtentExPointW
GetTextExtentPoint32W
GetCurrentObject
SetDIBColorTable
CombineRgn
GetDeviceCaps
GetPixel
CreateBitmap
GetDIBits
GetObjectW

advapi32

LookupAccountNameW
RegOpenKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
ConvertSidToStringSidW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceEvent
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
CheckTokenMembership
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegEnumValueW
RegNotifyChangeKeyValue
RegEnumKeyW
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
GetLengthSid
GetSidIdentifierAuthority
GetUserNameW
RegQueryValueExA

shell32

SHGetFolderPathW
SHParseDisplayName
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderPathW
SHFileOperationW
ord75
SHGetFolderLocation
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc
ord165
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteExW
CommandLineToArgvW

ole32

CoCreateGuid
OleInitialize
OleUninitialize
PropVariantClear
CoCreateInstance
CoTaskMemFree
CoInitialize
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

VariantCopy
SysAllocStringByteLen
VariantInit
VarUI4FromStr
SysAllocString
VariantClear
SysFreeString

shlwapi

PathRemoveExtensionW
PathRenameExtensionW
PathFindExtensionW
PathFindFileNameW
StrRetToBufW
PathRemoveBackslashW
PathCombineW
SHCopyKeyW
PathCanonicalizeW
PathRemoveFileSpecW
SHDeleteValueW
PathIsDirectoryEmptyW
SHDeleteKeyW
PathIsDirectoryW
SHGetValueW
PathAppendW
PathMatchSpecW
PathRemoveBlanksW
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

psapi

GetProcessImageFileNameW

urlmon

URLDownloadToCacheFileW

wininet

DeleteUrlCacheEntryW

gdiplus

GdipDeleteBrush
GdipCreateSolidFill
GdipCreateLineBrush
GdipCloneBrush
GdipDeletePen
GdipSetPenWidth
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawEllipseI
GdipFree
GdipAlloc
GdipCreatePen1
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipFillEllipseI
GdiplusShutdown
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetImageAttributesWrapMode
GdipDisposeImage
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawImageRectRectI
GdipCloneImage
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromResource
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageThumbnail
GdipCreateBitmapFromHICON
GdipCreateHICONFromBitmap
GdipBitmapGetPixel
GdiplusStartup
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawString
GdipMeasureString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFontSize
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipDrawPath
GdipFillPath
GdipCreateHBITMAPFromBitmap
GdipCreateLineBrushFromRect
GdipFillRectangle
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCloneBitmapAreaI

netapi32

NetWkstaTransportEnum
NetApiBufferFree
NetGetJoinInformation
Netbios

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSendRequest

ws2_32

ntohs
htonl
ntohl
htons

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 737KB - Virtual size: 737KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af2792e9620ef734c5946439067e2492

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

7d:7e:15:f2:fd:54:98:29:8d:3b:f6:31:33:b1:96:ea:d6:bf:b8:9c:e6:ff:a0:01:a3:97:f4:d7:99:d8:b1:59Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

psapi

urlmon

wininet

gdiplus

netapi32

winhttp

ws2_32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 737KB - Virtual size: 737KB

.data Size: 36KB - Virtual size: 158KB

.pdata Size: 169KB - Virtual size: 169KB

_RDATA Size: 512B - Virtual size: 244B

.detourc Size: 9KB - Virtual size: 8KB

.detourd Size: 512B - Virtual size: 24B

.rsrc Size: 174KB - Virtual size: 174KB

.reloc Size: 16KB - Virtual size: 16KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

7d:7e:15:f2:fd:54:98:29:8d:3b:f6:31:33:b1:96:ea:d6:bf:b8:9c:e6:ff:a0:01:a3:97:f4:d7:99:d8:b1:59
Signer

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 737KB - Virtual size: 737KB

.data
Size: 36KB - Virtual size: 158KB

.pdata
Size: 169KB - Virtual size: 169KB

_RDATA
Size: 512B - Virtual size: 244B

.detourc
Size: 9KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

.rsrc
Size: 174KB - Virtual size: 174KB

.reloc
Size: 16KB - Virtual size: 16KB