1ef3b7ba64c1364c472a9afe68887ca1cf38b34564529a1179affee57d414119

Sharing

Copy URL Twitter E-mail

General

Target

1ef3b7ba64c1364c472a9afe68887ca1cf38b34564529a1179affee57d414119
Size

594KB
MD5

a2261eb5185ab87596f28fcfae238c96
SHA1

3ca6af6c46ed9326b41c84280dcef5713a7ceba6
SHA256

1ef3b7ba64c1364c472a9afe68887ca1cf38b34564529a1179affee57d414119
SHA512

0e461a1ed56ab9da45551e3055727a2267ab21af83db2135c78ebde2b7620be1c1e3406b5a358b7305d4c61561f45a2244a352faba12cf2cb7c2043ead8fff3a
SSDEEP

12288:NmjZD16ZOkBsdmfFFcxhNbBaOAN1OzQBkf0vyC2Zu/Ro4HD+4R2:e5JhNCN1YfhZu/Rz2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ef3b7ba64c1364c472a9afe68887ca1cf38b34564529a1179affee57d414119

Files

1ef3b7ba64c1364c472a9afe68887ca1cf38b34564529a1179affee57d414119
.exe windows:6 windows x86 arch:x86

4fcc8c319273f0d2184d3b7bf48a73e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\app_compile\pub\bin\Publish\QyPlayer.pdb

Imports

gbase

??1AtExitManager@base@@QAE@XZ
?SetMessageFilter@MessagePumpForUI@base@@QAEXV?$scoped_ptr@VMessageFilter@MessagePumpForUI@base@@U?$DefaultDeleter@VMessageFilter@MessagePumpForUI@base@@@3@@@@Z
??0MessageLoop@base@@QAE@W4Type@01@@Z
?current@MessageLoop@base@@SAPAV12@XZ
?Init@CommandLine@@SA_NHPBQBD@Z
?ForCurrentProcess@CommandLine@@SAPAV1@XZ
??0AtExitManager@base@@QAE@XZ
?GetSwitchValueASCII@CommandLine@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?GetCurrentProcId@base@@YAKXZ
??0ScopedNativeLibrary@base@@QAE@PAUHINSTANCE__@@@Z
??1ScopedNativeLibrary@base@@QAE@XZ
?GetFunctionPointer@ScopedNativeLibrary@base@@QBEPAXPBD@Z
??1LogMessage@logging@@QAE@XZ
??0LogMessage@logging@@QAE@PBDHHPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0LogMessage@logging@@QAE@PBDHH@Z
?get_dcheck_state@logging@@YA?AW4DcheckState@1@XZ
?GetMinLogLevel@logging@@YAHXZ
?SetName@PlatformThread@base@@SAXPBD@Z
?WaitForDebugger@debug@base@@YA_NH_N@Z
?HasSwitch@CommandLine@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

utility

?ppstream@config@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Cleanup@local@utility@@YAXXZ
??1ScopedOleInitializer@@UAE@XZ
?InitializeMF@base@@YA_NXZ
?SetAppID@IEnv@system@utility@@SAXXZ
?StopLog@log@utility@@YA_NXZ
?StartLog@log@utility@@YA_NXZ
?stream@LogMessage@glog@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
??1LogMessage@glog@@QAE@XZ
??0LogMessage@glog@@QAE@PBD0HH@Z
?ULoadLibrary@@YAPAUHINSTANCE__@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?WritePrivateProfileInt64@IFile@file@utility@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_J0@Z
?WritePrivateProfileInt@IFile@file@utility@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0H0@Z
??0ScopedOleInitializer@@QAE@XZ

quilib

?TranslateMessage@CPaintManagerUI@DuiLib@@SA_NQAUtagMSG@@@Z

kernel32

GetCurrentProcessId
lstrcmpiW
RaiseException
GetLastError
EnterCriticalSection
GetStartupInfoW
InitializeCriticalSectionEx
DeleteCriticalSection
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
OutputDebugStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LeaveCriticalSection
GetCurrentProcess

user32

CharNextW
PeekMessageW

gdi32

SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
GetObjectW
SetDIBColorTable

advapi32

RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

VarUI4FromStr

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

gdiplus

GdipCreateBitmapFromStreamICM
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette

vcruntime140

_except_handler4_common
wcsstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
__current_exception_context
__current_exception
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_exit
exit
_initterm_e
_c_exit
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_controlfp_s
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_errno
_register_onexit_function
_resetstkoflw
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

malloc
_recalloc
_callnewh
free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcsncpy_s

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 446KB - Virtual size: 446KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4fcc8c319273f0d2184d3b7bf48a73e1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gbase

utility

quilib

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp140

gdiplus

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 51KB - Virtual size: 50KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 446KB - Virtual size: 446KB

.reloc Size: 67KB - Virtual size: 68KB

.text
Size: 51KB - Virtual size: 50KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 446KB - Virtual size: 446KB

.reloc
Size: 67KB - Virtual size: 68KB