360QMachine[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

360QMachine.exe
Size

679KB
MD5

76e28ebaefe5bd44f6285c9209a958ee
SHA1

42bd3349d79d347f9e718af8c226f8276594083d
SHA256

2a49fac088492090b64252531347b6f470ae518840f95b9dc05a73a9d2747816
SHA512

838b9bc03157384d671ca01ab746a0ffabb03349f1374375999f6465ac87e30ad052b56773e2b36b728777049337d54c3708fbdd031eb0cc6c6a58bee6f53240
SSDEEP

12288:YFnkRo2g6YKeIqqQgwyTdGa83yc4doD5pQRh/vKVMq5uxcEqfxQx2+:qKgQYyEaEnDQRhKVx5P

Score

1^/10

Malware Config

Signatures

Files

360QMachine.exe
.exe windows:5 windows x86 arch:x86

f34820a4c5512a20c2fd704f0b09bf54

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:69:e5:32:32:67:47:08:fd:e5:35:a7:52:fc:d2:a2:fe:b5:df:2f
Signer

Actual PE Digest

3a:69:e5:32:32:67:47:08:fd:e5:35:a7:52:fc:d2:a2:fe:b5:df:2f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\building\360project\360sd\branches\360QMachine\360QMachine\Release\360QMachine.pdb

Imports

kernel32

SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
CreateThread
GetVersion
GetVersionExW
GetModuleHandleA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpW
QueryDosDeviceW
GetLogicalDriveStringsW
LoadLibraryA
GetLongPathNameW
WideCharToMultiByte
AreFileApisANSI
GetACP
ProcessIdToSessionId
GetCurrentProcessId
GetTickCount
FindClose
FindFirstFileW
FindNextFileW
Thread32Next
SuspendThread
OpenThread
Thread32First
ResumeThread
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
CopyFileW
GetTempPathW
ReadProcessMemory
MultiByteToWideChar
ReadFile
CreateFileW
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
TlsSetValue
TlsGetValue
InterlockedCompareExchange
TlsFree
GetFileAttributesExW
CreateMutexW
SystemTimeToFileTime
FileTimeToSystemTime
GetPrivateProfileSectionW
GetFileSize
WritePrivateProfileStringW
GetWindowsDirectoryW
GetTimeZoneInformation
GetFileAttributesW
MoveFileExW
SetEnvironmentVariableW
WritePrivateProfileSectionW
GetPrivateProfileStringW
InitializeCriticalSection
Module32NextW
Module32FirstW
lstrlenA
DebugBreak
OutputDebugStringW
SetFilePointer
DeviceIoControl
SetCurrentDirectoryW
GetPrivateProfileIntW
LeaveCriticalSection
FreeLibrary
GlobalMemoryStatus
EnterCriticalSection
DeleteAtom
FindAtomW
AddAtomW
GetAtomNameW
GetSystemTime
LocalFree
GetLocalTime
FormatMessageW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
ExitProcess
HeapSize
HeapReAlloc
FatalAppExitA
HeapDestroy
HeapCreate
GetModuleFileNameA
GetStdHandle
HeapFree
InterlockedDecrement
lstrlenW
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
RaiseException
GetCurrentThreadId
SetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
ReleaseMutex
CreateMutexA
CloseHandle
Sleep
GetModuleFileNameW
GetLastError
OpenProcess
GetDriveTypeW
WriteFile
GetCurrentThread
TlsAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
VirtualAlloc
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
TerminateProcess

user32

GetClassInfoW
UnregisterClassA
CreateDialogParamW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
ShowWindow
IsDialogMessageW
RegisterClassW
FindWindowW
GetWindowThreadProcessId
SendMessageTimeoutW
DefWindowProcW
IsWindowVisible
IsIconic
LoadIconW
LoadImageW
SendMessageW
KillTimer
SetTimer
SetWindowTextW
MessageBoxW
PostQuitMessage
PtInRect
CopyRect
GetCursorPos
ScreenToClient
LoadCursorW
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
EndDialog
DialogBoxParamW
ExitWindowsEx
GetWindowLongW
GetParent
wvsprintfW
CharLowerW
BringWindowToTop
SwitchToThisWindow
SetWindowPos
EnumThreadWindows
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint
SetForegroundWindow
WaitForInputIdle
CharLowerBuffW
PostMessageW
CharNextW
SetWindowLongW
LoadStringW

advapi32

LookupPrivilegeValueW
GetTokenInformation
AllocateAndInitializeSid
IsValidSid
EqualSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
AdjustTokenPrivileges
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW

ole32

IIDFromString
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayRedim
SafeArrayCreate
SafeArrayUnlock
SafeArrayLock
SysAllocStringLen
VariantCopy
VarUI4FromStr
VariantClear
VariantInit
DispCallFunc
CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
SysFreeString

shlwapi

PathAppendW
PathCombineW
StrCmpNW
SHDeleteValueW
StrStrIW
PathFileExistsW
SHGetValueW
SHSetValueW
PathRemoveFileSpecW
PathAddBackslashW
StrCmpNIW
SHDeleteKeyW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

Sections

.text
Size: 516KB - Virtual size: 515KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34820a4c5512a20c2fd704f0b09bf54

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

3a:69:e5:32:32:67:47:08:fd:e5:35:a7:52:fc:d2:a2:fe:b5:df:2fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

wintrust

crypt32

Sections

.text Size: 516KB - Virtual size: 515KB

.rdata Size: 86KB - Virtual size: 85KB

.data Size: 9KB - Virtual size: 22KB

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 19KB - Virtual size: 19KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

3a:69:e5:32:32:67:47:08:fd:e5:35:a7:52:fc:d2:a2:fe:b5:df:2f
Signer

.text
Size: 516KB - Virtual size: 515KB

.rdata
Size: 86KB - Virtual size: 85KB

.data
Size: 9KB - Virtual size: 22KB

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 19KB - Virtual size: 19KB