qb64[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

qb64.exe
Size

8.1MB
MD5

d1693a668ea04db19f7cf688a8a19066
SHA1

7b55f3ae3554486d8158d8e02ec51c05e00d2a16
SHA256

f0758fd0abee5cedde774a025b9970b16267be9516a7b1999045a956732d7129
SHA512

0a26b25dfa95f1414b5c684339f27975827c78c48551fe41f89b95bbcf4f605b42175da86715aed110bcc838d0c90ccdb3137fccc69ad1499c053d24a9293b6f
SSDEEP

98304:hWKSbEeXM1iRMZDRt+IEWBqYOvuI5aDosQkwO7+ve4fvkr4cHk/vy5gdpp:RSbbC1Z7+IEjaknO7+veX5gdz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
qb64.exe

Files

qb64.exe
.exe windows:4 windows x64 arch:x64

fe9d8a6e4e3b4f06e14920bed42178ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA

gdi32

ChoosePixelFormat
CreateBitmap
CreateDCA
CreateDIBSection
DeleteDC
DeleteObject
DescribePixelFormat
GetDeviceCaps
GetPixelFormat
SetPixelFormat
SwapBuffers

glu32

gluBuild2DMipmaps
gluOrtho2D
gluPerspective

kernel32

AllocConsole
BuildCommDCBA
ClearCommError
CloseHandle
CreateFileA
CreateMutexA
CreateProcessA
CreateSemaphoreW
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FlushConsoleInputBuffer
FlushFileBuffers
FormatMessageA
FreeConsole
FreeLibrary
GetCommState
GetCommTimeouts
GetConsoleCursorInfo
GetConsoleMode
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCurrentDirectoryA
GetCurrentThreadId
GetDiskFreeSpaceExA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetLastError
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetTempPathA
GlobalAlloc
GlobalLock
GlobalUnlock
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
MultiByteToWideChar
RaiseException
ReadConsoleInputA
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterA
ReadFile
ReleaseMutex
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetCommState
SetCommTimeouts
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleTitleA
SetConsoleWindowInfo
SetCurrentConsoleFontEx
SetFilePointer
SetLastError
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_cexit
_close
_commode
_chdir
_environ
_errno
_fdopen
_filelengthi64
_fileno
_fileno
_fmode
_fstat64
_getpid
_initterm
_localtime64
_lock
_lseeki64
_onexit
_mkdir
_putenv
_putenv_s
_read
_rmdir
_setjmp
_snprintf
_strdup
_time64
_unlock
_wfopen
abort
acos
asin
atan
atol
calloc
clock
exit
fclose
fflush
fgetc
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
_write
localeconv
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
putc
putwc
qsort
realloc
rename
setlocale
setvbuf
signal
strcat
strchr
strcmp
strcoll
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtok
strtol
strtoul
strxfrm
system
tan
tolower
towlower
towupper
ungetc
vfprintf
ungetwc
wcscoll
wcscpy
wcsftime
wcslen
wcsxfrm

opengl32

glAlphaFunc
glBegin
glBindTexture
glBitmap
glBlendFunc
glClear
glColor4f
glColor4fv
glCullFace
glDeleteTextures
glDepthMask
glDisable
glDisableClientState
glDrawArrays
glDrawBuffer
glEnable
glEnableClientState
glEnd
glFlush
glFrontFace
glGenTextures
glGetBooleanv
glGetError
glGetIntegerv
glGetString
glLoadIdentity
glMatrixMode
glOrtho
glPixelStorei
glPopAttrib
glPopClientAttrib
glPopMatrix
glPushAttrib
glPushClientAttrib
glPushMatrix
glRasterPos2i
glReadBuffer
glScalef
glTexCoordPointer
glTexImage2D
glTexParameterf
glTexParameteri
glTranslatef
glVertex2f
glVertex2i
glVertexPointer
glViewport
wglCreateContext
wglDeleteContext
wglGetCurrentContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent

shell32

DragAcceptFiles
DragFinish
DragQueryFileA
SHGetFolderPathA
ShellExecuteExA

user32

BeginPaint
ChangeDisplaySettingsExA
ClientToScreen
CloseClipboard
CreateIconIndirect
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EmptyClipboard
EndPaint
EnumDisplayMonitors
EnumDisplaySettingsA
GetAsyncKeyState
GetClassInfoA
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetForegroundWindow
GetKeyState
GetKeyboardState
GetMessageA
GetMonitorInfoA
GetRawInputData
GetSystemMetrics
GetWindowLongA
GetWindowRect
IsClipboardFormatAvailable
IsIconic
LoadCursorA
LoadIconA
LoadImageA
MessageBoxA
MonitorFromRect
MoveWindow
MsgWaitForMultipleObjects
OpenClipboard
PeekMessageA
RedrawWindow
RegisterClassA
RegisterRawInputDevices
ReleaseCapture
ReleaseDC
ScreenToClient
SendInput
SendMessageA
SetCapture
SetClassLongPtrA
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowCursor
ShowWindow
ToAscii
TranslateMessage
UnregisterClassA
UpdateWindow
VkKeyScanA
keybd_event

winmm

joyGetDevCapsA
joyGetPosEx
timeBeginPeriod
timeEndPeriod
timeGetTime

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyname
htons
ioctlsocket
listen
recv
send
shutdown
socket

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe9d8a6e4e3b4f06e14920bed42178ce

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

glu32

kernel32

msvcrt

opengl32

shell32

user32

winmm

ws2_32

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.data Size: 31KB - Virtual size: 31KB

.rdata Size: 568KB - Virtual size: 568KB

.pdata Size: 79KB - Virtual size: 79KB

.xdata Size: 97KB - Virtual size: 96KB

.bss Size: - Virtual size: 6.5MB

.idata Size: 13KB - Virtual size: 13KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 99KB - Virtual size: 99KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 7.2MB - Virtual size: 7.2MB

.data
Size: 31KB - Virtual size: 31KB

.rdata
Size: 568KB - Virtual size: 568KB

.pdata
Size: 79KB - Virtual size: 79KB

.xdata
Size: 97KB - Virtual size: 96KB

.bss
Size: - Virtual size: 6.5MB

.idata
Size: 13KB - Virtual size: 13KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 99KB - Virtual size: 99KB

.reloc
Size: 13KB - Virtual size: 12KB