0330042[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
0330042.exe
Size 302KB
Sample240319-lrrfnsgf47
SHA256 4d625b4783af22d7e421ad6ef1596a0fef18ab7636776c93212201add00df162
MD5 363dfb0bb8f4341362ed9f00b3aa8604
SHA1 9aed8dc52684c8d5e607ae63ae6b017c5444010d
SHA512 faec352f15eb5454201a0805efd5aad627a9fa75e1cf389efe7914dc08861037795048f096cdde44cc8e989c13f85382aaadf6aac6d7ce465123c2b319112f4a
SSDEEP 6144:booEac1YJvP9/AV6IHXW5ISNNr6oNCaAbG3Aye3o:XEac14GVnXW5FNrjCaAbG3Ay
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
sample	agile_net

File Explorer

0330042.exe

.exe 302KB

0330042.exe

IMPHASH 24776cbb8355169b7f48920eebe947e2
SHA256 4d625b4783af22d7e421ad6ef1596a0fef18ab7636776c93212201add00df162
MD5 363dfb0bb8f4341362ed9f00b3aa8604
SHA1 9aed8dc52684c8d5e607ae63ae6b017c5444010d
SHA512 faec352f15eb5454201a0805efd5aad627a9fa75e1cf389efe7914dc08861037795048f096cdde44cc8e989c13f85382aaadf6aac6d7ce465123c2b319112f4a
SSDEEP 6144:booEac1YJvP9/AV6IHXW5ISNNr6oNCaAbG3Aye3o:XEac14GVnXW5FNrjCaAbG3Ay
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

PE Signature issue

Digest

81:f7:87:14:d2:0d:50:63:00:c3:a5:96:e5:c3:38:b5:66:ff:5a:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology (Shenzhen) Company Limited

Chains

Mar 13, 2024

Minor OS version

Major OS version

Entry point

47562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Documents\Visual Studio 2015\Projects\QQScLauncher\Release\QQScLauncher.pdb

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?width@ios_base@std@@QAE_J_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?good@ios_base@std@@QBE_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

kernel32

MultiByteToWideChar WideCharToMultiByte GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException Process32Next QueryFullProcessImageNameA Process32First CreateToolhelp32Snapshot SetConsoleTitleA SetErrorMode CreateMutexA SetLastError CloseHandle GetSystemInfo OpenProcess VirtualQueryEx ReadProcessMemory GetLocalTime LoadLibraryW LoadLibraryA Sleep lstrlenA lstrcatA lstrcpyA GetModuleHandleA WinExec IsDebuggerPresent

vcruntime140

__CxxUnregisterExceptionObject __CxxDetectRethrow memset __CxxRegisterExceptionObject __CxxExceptionFilter __FrameUnwindFilter memmove memchr memcpy memcmp strstr __std_type_info_destroy_list _except_handler4_common __CxxQueryExceptionSize __CxxFrameHandler3 __std_exception_destroy __std_exception_copy _CxxThrowException __vcrt_GetModuleFileNameW __vcrt_LoadLibraryExW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsprintf_s __p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _cexit _register_thread_local_exe_atexit_callback abort _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _controlfp_s terminate _seh_filter_exe _set_app_type _c_exit _invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

netapi32

Netbios

wininet

HttpQueryInfoA InternetCloseHandle HttpAddRequestHeadersA HttpSendRequestA InternetCrackUrlA FindCloseUrlCache HttpOpenRequestA InternetConnectA InternetReadFile FindNextUrlCacheEntryA FindFirstUrlCacheEntryA InternetOpenA DeleteUrlCacheEntry

ws2_32

WSACleanup gethostname WSAStartup ntohs

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

api-ms-win-crt-string-l1-1-0

strcpy strtok strlen _stricmp strcat

api-ms-win-crt-time-l1-1-0

_time64 _mktime64

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-convert-l1-1-0

atoi

mscoree

_CorExeMain