2638a149837fa2f497281ce3e08dfc54f19690541f1e3e8fc6243f3cd749d0f3

Sharing

Copy URL Twitter E-mail

General

Target

2638a149837fa2f497281ce3e08dfc54f19690541f1e3e8fc6243f3cd749d0f3
Size

24KB
MD5

9cf27ef5299f313b580e5e058337ce8d
SHA1

94396d54056995a352916c1c57a6211900a956ef
SHA256

2638a149837fa2f497281ce3e08dfc54f19690541f1e3e8fc6243f3cd749d0f3
SHA512

9db726e233821aad6d4c75c431abf9c4acc4100a351879be6502dd89f59ab52f4849bb9455baac848066592c47b69e104dc53dc36795b6b49a701e7698209452
SSDEEP

192:QbnN9lt7bjkhOv1nshoIhsIGfBjU00ruZkxd6P+PoY7GxHZkxqfseQ9AsOK8cnt0:enN/tvbvV2oSW1U8ZkUHZkEsEsOQot

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2638a149837fa2f497281ce3e08dfc54f19690541f1e3e8fc6243f3cd749d0f3

Files

2638a149837fa2f497281ce3e08dfc54f19690541f1e3e8fc6243f3cd749d0f3
.dll windows:6 windows x64 arch:x64

4339eab83ab234445f746576a75b5fcc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

qt6gui

?nextImageDelay@QImageIOHandler@@UEBAHXZ
?imageCount@QImageIOHandler@@UEBAHXZ
?loopCount@QImageIOHandler@@UEBAHXZ
?jumpToImage@QImageIOHandler@@UEAA_NH@Z
?jumpToNextImage@QImageIOHandler@@UEAA_NXZ
?setOption@QImageIOHandler@@UEAAXW4ImageOption@1@AEBVQVariant@@@Z
?allocateImage@QImageIOHandler@@SA_NVQSize@@W4Format@QImage@@PEAV4@@Z
?currentImageNumber@QImageIOHandler@@UEBAHXZ
?setFormat@QImageIOHandler@@QEBAXAEBVQByteArray@@@Z
?device@QImageIOHandler@@QEBAPEAVQIODevice@@XZ
??1QImageIOHandler@@UEAA@XZ
??0QImageIOHandler@@QEAA@XZ
?convertToFormat_helper@QImage@@IEBA?AV1@W4Format@1@V?$QFlags@W4ImageConversionFlag@Qt@@@@@Z
?invertPixels@QImage@@QEAAXW4InvertMode@1@@Z
?fill@QImage@@QEAAXI@Z
?staticMetaObject@QImageIOPlugin@@2UQMetaObject@@B
?colorTable@QImage@@QEBA?AV?$QList@I@@XZ
?constScanLine@QImage@@QEBAPEBEH@Z
?scanLine@QImage@@QEAAPEAEH@Z
?height@QImage@@QEBAHXZ
?width@QImage@@QEBAHXZ
?format@QImage@@QEBA?AW4Format@1@XZ
?isNull@QImage@@QEBA_NXZ
??4QImage@@QEAAAEAV0@$$QEAV0@@Z
??4QImage@@QEAAAEAV0@AEBV0@@Z
??1QImage@@UEAA@XZ
??0QImage@@QEAA@$$QEAV0@@Z
??0QImage@@QEAA@AEBV0@@Z
??0QImage@@QEAA@XZ
??1QImageIOPlugin@@UEAA@XZ
??0QImageIOPlugin@@QEAA@PEAVQObject@@@Z
?qt_metacall@QImageIOPlugin@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@QImageIOPlugin@@UEAAPEAXPEBD@Z
?setFormat@QImageIOHandler@@QEAAXAEBVQByteArray@@@Z
?currentImageRect@QImageIOHandler@@UEBA?AVQRect@@XZ

qt6core

??0QVariant@@QEAA@H@Z
??0QVariant@@QEAA@XZ
?getChar@QIODevice@@QEAA_NPEAD@Z
?putChar@QIODevice@@QEAA_ND@Z
?write@QIODevice@@QEAA_JPEBD_J@Z
?read@QIODevice@@QEAA_JPEAD_J@Z
??0QByteArray@@QEAA@PEBD_J@Z
?warning@QMessageLogger@@QEBAXPEBDZZ
??0QMessageLogger@@QEAA@PEBDH0@Z
?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
??0QVariant@@QEAA@VQSize@@@Z
?isEmpty@QByteArray@@QEBA_NXZ
?data@QByteArray@@QEBAPEBDXZ
?size@QByteArray@@QEBA_JXZ
?isNull@QByteArray@@QEBA_NXZ
?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ
?isOpen@QIODevice@@QEBA_NXZ
?isReadable@QIODevice@@QEBA_NXZ
?isWritable@QIODevice@@QEBA_NXZ
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPEAU12@PEBVQObject@@@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
??1QByteArray@@QEAA@XZ

vcruntime140

memcpy
memcmp
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_seh_filter_dll
_initterm_e
_initterm
_cexit
_crt_atexit

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata_v2

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 512B - Virtual size: 126B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4339eab83ab234445f746576a75b5fcc

Headers

DLL Characteristics

File Characteristics

Imports

qt6gui

qt6core

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 792B

.pdata Size: 1024B - Virtual size: 768B

.qtmetad Size: 512B - Virtual size: 126B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 176B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 792B

.pdata
Size: 1024B - Virtual size: 768B

.qtmetad
Size: 512B - Virtual size: 126B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 176B