QI[.]EXE | Triage

Sharing

General

Target

QI.EXE
Size

5.9MB
MD5

352c1cd1b44a666a3535c9b1f2c578d0
SHA1

e335a89a43596ce4bc1e25a1a63a8ec5a480f9ab
SHA256

70d313b32680b46843d8bb85d3c38f60a0907aee88cc5ac7f446e7809375e447
SHA512

d82f18300789a4110d7f3f509e5171fea5ef86760125c877a5577f0747b29024bb4f7af7ebbbb066c5d39501c89f115ba83808183aa1609b324f1441bca85e94
SSDEEP

98304:JFJ895z6ubxEWOUkEE8vT5epqdse9dHCkvRvCgJWGu78JDaKX2O6RJXTg:J72N6u6WOh8vlfdzvRvrJ1uYBaGmXX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
QI.EXE

Files

QI.EXE
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ