JQMain[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

JQMain.exe
Size

2.1MB
MD5

13f110ff07d295c9a1c2e923e6ce6cb0
SHA1

5924fee270ebde70ae17773d11d3cf99cadc4cf1
SHA256

81367f397cd0c29c29f2288655d4708a5c139192ec09f20593b9ac32c7e44057
SHA512

d3ad5b5ce7c13202b4d5f925c2d7a1c1d8487cd95ff477654afe8308aa2ffb11f96ef798c0b554f34856c79bcc9d81d0cd0b7c12067b4a9f464a3f14b6795f4d
SSDEEP

49152:/hQXJDV9bPb5XpmQ38Ebek9rET/MzAvEQWlLYzjo+WYKXK:uJDV9bD55mTEbek9rEdMQWlLYzjod

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JQMain.exe

Files

JQMain.exe
.exe windows:5 windows x86 arch:x86

052a42c495a0aeaeca141d0e9c942b5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\VCtest\Projects\SpeedNEWdrPXH\Release\JQMain.pdb

Imports

mfc140u

ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12220
ord8965
ord14588
ord11936
ord3838
ord12089
ord9132
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2761
ord8210
ord3302
ord3305
ord13756
ord6220
ord4225
ord8464
ord4323
ord1526
ord7495
ord462
ord8470
ord8386
ord12865
ord8324
ord5357
ord2486
ord12541
ord7923
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord3941
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord10433
ord12251
ord12219
ord12928
ord5249
ord5549
ord5760
ord6877
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord1113
ord6489
ord1111
ord1070
ord1447
ord6559
ord6566
ord3882
ord2304
ord1133
ord1066
ord1180
ord4092
ord13911
ord7313
ord13442
ord952
ord2205
ord7997
ord1472
ord995
ord7653
ord12542
ord14596
ord10379
ord280
ord5110
ord2477
ord3372
ord3371
ord3265
ord12168
ord5790
ord5984
ord10255
ord6589
ord4219
ord3145
ord9126
ord6129
ord6490
ord9139
ord6549
ord968
ord3872
ord2993
ord8744
ord4222
ord3147
ord1511
ord2409
ord8360
ord12921
ord14405
ord11717
ord5718
ord5289
ord12131
ord9040
ord11015
ord11396
ord3296
ord4886
ord1002
ord4815
ord290
ord2996
ord286
ord1045
ord296
ord265
ord266
ord3404
ord3403
ord3164
ord2682
ord6218
ord13752
ord2760
ord12173
ord9235
ord9210
ord6533
ord5935
ord13703
ord2990
ord5882
ord9350
ord13646
ord2458
ord2457
ord13656
ord8067
ord14364
ord8062
ord3605
ord11038
ord1391
ord890
ord3833
ord14234
ord12793
ord5419
ord13800
ord13628
ord8817
ord14137
ord10472
ord13806
ord1523
ord5813
ord5850
ord7820
ord14377
ord4885
ord2526
ord3932
ord6607
ord4227
ord8746
ord7447
ord7481
ord3697
ord2246
ord2215
ord4360
ord12124
ord6497
ord11983
ord9128
ord1513

kernel32

SetWaitableTimer
WideCharToMultiByte
SetEvent
CreateToolhelp32Snapshot
CreateProcessA
LockResource
GetTickCount
CreateWaitableTimerA
CloseHandle
LoadResource
FindResourceW
Process32FirstW
OpenFileMappingW
UnmapViewOfFile
Process32NextW
OpenProcess
MapViewOfFile
CreateFileMappingA
CreateEventA
CreateDirectoryA
WritePrivateProfileStringW
CreateDirectoryW
GetFileAttributesW
VirtualProtect
GetCurrentProcessId
GetModuleHandleW
GetProcAddress
SetCurrentDirectoryW
GetCurrentDirectoryW
SizeofResource
CancelWaitableTimer
GetProcessTimes
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
VirtualQuery
GetLastError
GetTempPathA
CreateFileW
DeviceIoControl
Sleep
CreateFileA
GetVolumeInformationA
OutputDebugStringW
CreateMutexW
GetFileAttributesA
GetPrivateProfileStringW
GetPrivateProfileIntA
GetPrivateProfileIntW
TerminateThread
WritePrivateProfileStringA
CreateThread
GetPrivateProfileStringA
GlobalSize
GlobalLock
GlobalUnlock
GetFileSize
ReadFile
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
CreateEventW
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemInfo
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
DeleteCriticalSection
LoadLibraryW

user32

GetClientRect
IsIconic
GetSystemMetrics
DrawIcon
GetWindowRect
GetParent
MoveWindow
UpdateWindow
GetWindow
GetDesktopWindow
AppendMenuW
IsWindowVisible
GetWindowTextA
SendMessageA
GetWindowTextW
OpenClipboard
GetClipboardData
CloseClipboard
GetSystemMenu
PostMessageA
GetCursorPos
GetSubMenu
LoadMenuW
MessageBoxW
LoadIconW
MessageBoxA
EnableWindow
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
SetWindowLongA
CallWindowProcW
GetWindowThreadProcessId
SendMessageW

advapi32

CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenSCManagerA
OpenServiceA
DeleteService
CreateServiceA
StartServiceA
ControlService

shell32

ShellExecuteW
SHFileOperationW
DragQueryFileA
SHGetSpecialFolderPathA
SHGetFolderPathA
SHGetSpecialFolderPathW

comctl32

InitCommonControlsEx

shlwapi

StrCmpW

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

ws2_32

shutdown
WSAStartup
WSASocketW
select
WSAGetLastError
closesocket
inet_ntoa
ioctlsocket
gethostbyname
inet_addr
WSASend
WSARecv
WSAIoctl
setsockopt
connect
bind
htons

plfl32

P_UserReg
P_GetDataValue
P_GetLoginValue
P_UserLogin
P_LoadSystem
P_CardReCharge

psapi

GetProcessImageFileNameA

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenW
InternetCloseHandle

iphlpapi

GetAdaptersInfo

vcruntime140

__std_terminate
memmove
memchr
strstr
memset
__CxxFrameHandler3
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
_CxxThrowException
memcpy

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
fopen
fwrite
fclose
__stdio_common_vsprintf_s
feof
fgets
_set_fmode
__p__commode

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

remove
_access

api-ms-win-crt-string-l1-1-0

strtok
toupper

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv
_initterm
_initterm_e
_exit
_beginthreadex
_get_wide_winmain_command_line
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_set_app_type
_initialize_onexit_table
system
_c_exit
_initialize_wide_environment
_register_onexit_function
_crt_atexit
terminate
_controlfp_s
_cexit
_seh_filter_exe
exit

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free

api-ms-win-crt-convert-l1-1-0

_wtol
atoll
_wtoll

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

052a42c495a0aeaeca141d0e9c942b5e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc140u

kernel32

user32

advapi32

shell32

comctl32

shlwapi

msvcp140

ws2_32

plfl32

psapi

wininet

iphlpapi

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 74KB - Virtual size: 73KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 14KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 74KB - Virtual size: 73KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 14KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 9KB - Virtual size: 9KB