Z:\j\projects\qbot4\Release\Win32\qd_x86.pdb
Static task
static1
Behavioral task
behavioral1
Sample
qd_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
qd_x86.exe
Resource
win10v2004-20240412-en
General
-
Target
qd_x86.exe
-
Size
522KB
-
MD5
31b1a881401e0ba0cad4c56f1e32c48e
-
SHA1
19e491a4c69de056c77d05ba671870818d4f7f80
-
SHA256
7215d9421e0a6d1a7cfde3f6d742670550fed009585ab35b53cbb845f63c5f74
-
SHA512
459d6e38e633f22877add0b862319aa65484a015225e24cfea64d3bbebcde171d75857c063033035897a1d848b7c87833d0e3581d57558c0663b433db8b0154c
-
SSDEEP
6144:7TjAuWlcEz3grAQFAaQe0j+TE7xrJmRPnZJUdFwnKjMFtsBzlgnySHpgB:fjAuWlJ0AQqe0j+WuaFMKjMfmSH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qd_x86.exe
Files
-
qd_x86.exe.exe windows:6 windows x86 arch:x86
14e3d57d9f86b144f92a9d94ef2c3bb8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shell32
CommandLineToArgvW
kernel32
lstrlenA
GetFileAttributesW
GetModuleHandleA
DisconnectNamedPipe
Sleep
GetLastError
lstrcpyW
lstrcmpW
ConnectNamedPipe
GetNumberFormatA
FindFirstFileW
FindNextFileW
SetFileAttributesW
GetFileAttributesA
MoveFileW
lstrcatA
MultiByteToWideChar
lstrcatW
lstrcpyA
WideCharToMultiByte
HeapCreate
HeapFree
HeapAlloc
HeapDestroy
SetNamedPipeHandleState
CreateNamedPipeA
FlushFileBuffers
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime
lstrlenW
GetCommandLineW
GetCommandLineA
GetVersionExA
GetSystemInfo
GetCurrentDirectoryW
GetWindowsDirectoryW
GetCurrentProcessId
LocalAlloc
GetCurrentThread
lstrcmpiW
Thread32Next
Thread32First
GetCurrentThreadId
lstrcmpA
SuspendThread
GetExitCodeProcess
CreateFileW
ReadConsoleW
CloseHandle
HeapReAlloc
ReadFile
WriteConsoleW
CallNamedPipeA
InitializeSListHead
HeapSize
SetFilePointerEx
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetTempPathW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
OutputDebugStringW
FindClose
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
SetConsoleCtrlHandler
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
user32
CharUpperBuffA
CharUpperBuffW
advapi32
RegDeleteKeyA
GetUserNameW
SetFileSecurityA
ole32
CoCreateInstance
Sections
.text Size: 408KB - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ