Static task
static1
Behavioral task
behavioral1
Sample
qiang_0.4.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
qiang_0.4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
d45e5fcc29204073e1c1cc30cc563d24
-
Size
141KB
-
MD5
d45e5fcc29204073e1c1cc30cc563d24
-
SHA1
008deaf741d5a85b9302b9067cc4f875740b7afe
-
SHA256
1802ea7a4f2832252018ceadd704e311a1d3ca267a4b2d6ecd7529fdbbab2c66
-
SHA512
a318b2e8dbe31cee16113f7cb41b977a7cda211d6d0d454f84331e1861700a6b6daf391894c167eb27c98255b982b3b11ac3eb186a9b512e3a6fffd8c5b28f89
-
SSDEEP
3072:QosPiEOaxZ0KWzX4wliNAC1hRRTazlNhvCUPvPuyygPcF:QpXFx+1XcTHGNpjfu8cF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/qiang_0.4.exe
Files
-
d45e5fcc29204073e1c1cc30cc563d24.rar
-
qiang_0.4.exe.exe windows:4 windows x86 arch:x86
f34ac1e55abbbd37ca64ae2de0ea4b24
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
SetEndOfFile
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
FlushFileBuffers
SetFilePointer
ReadFile
CloseHandle
GetProcAddress
WriteFile
GetFileType
GetStdHandle
InterlockedDecrement
GetEnvironmentStringsW
InitializeCriticalSection
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
HeapSize
RaiseException
HeapReAlloc
HeapAlloc
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
GetCurrentProcess
TerminateProcess
ExitProcess
RtlUnwind
HeapFree
GetLastError
MoveFileExA
WideCharToMultiByte
GetModuleFileNameA
SetHandleCount
ResumeThread
GetCurrentThread
SuspendThread
DeleteFileA
GetLongPathNameA
GetTempFileNameA
EnterCriticalSection
LeaveCriticalSection
CreateThread
Sleep
GetTempPathA
GetEnvironmentStrings
user32
PostMessageA
ShowWindow
FindWindowA
PostQuitMessage
SetForegroundWindow
CreateDialogParamA
LoadMenuA
GetSubMenu
GetCursorPos
TrackPopupMenu
DestroyMenu
KillTimer
CreateWindowExA
RegisterClassExA
LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
IsDialogMessageA
TranslateMessage
DispatchMessageA
IsWindow
GetWindowLongA
GetWindow
MapWindowPoints
SetWindowPos
LoadIconA
IsDlgButtonChecked
SetFocus
GetDlgItemInt
SetTimer
CheckDlgButton
SetDlgItemInt
InvalidateRect
SetWindowTextA
SetWindowLongA
SendMessageA
SetPropA
GetPropA
GetWindowTextA
GetDC
DrawTextA
ReleaseDC
GetWindowRect
GetParent
ScreenToClient
MoveWindow
DefWindowProcA
BeginPaint
GetClientRect
EndPaint
DestroyCursor
SetCursor
LoadCursorA
TrackMouseEvent
GetDlgItem
GetWindowTextLengthA
GetDlgItemTextA
SetDlgItemTextA
EnableWindow
MessageBoxA
DestroyWindow
SystemParametersInfoA
gdi32
SelectObject
SetBkMode
SetTextColor
CreateFontIndirectA
comdlg32
GetSaveFileNameA
advapi32
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegCloseKey
shell32
Shell_NotifyIconA
ShellExecuteA
ole32
OleInitialize
CoInitialize
CoCreateGuid
StringFromGUID2
OleRun
CoCreateInstance
CoUninitialize
oleaut32
VariantClear
GetErrorInfo
SysFreeString
comctl32
ImageList_Create
ord17
ImageList_ReplaceIcon
wininet
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
InternetCanonicalizeUrlA
InternetReadFile
HttpSendRequestA
HttpQueryInfoA
Sections
.text Size: 236KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
新云软件.url.url