f215cfdc9cfdb31e8c946e9b1ef52dbab761e046d56e3f3f9c2c5f12691b29a7

Sharing

Copy URL

Twitter E-mail

General

Target

f215cfdc9cfdb31e8c946e9b1ef52dbab761e046d56e3f3f9c2c5f12691b29a7
Size

4.3MB
MD5

2b6f2e3211b949b93b3f29e728c88ec1
SHA1

dd07b3c7ff5126ab1f85e0d753cf228076d2f676
SHA256

f215cfdc9cfdb31e8c946e9b1ef52dbab761e046d56e3f3f9c2c5f12691b29a7
SHA512

d0aadf1975d8a40bd88533b653e60a79a1e5fb764141de104f5f8b82f7fc8a2ab482165cfa32853a85a593462e6ac61c005e5b3b167cc1e49a4bbd26dffa28e8
SSDEEP

49152:Ria5G2HL0PxO1E0SbFAaEcV3ueUhC+KVxOOuY74:91HL2UO0aU4DON

Score

1^/10

Malware Config

Signatures

Files

f215cfdc9cfdb31e8c946e9b1ef52dbab761e046d56e3f3f9c2c5f12691b29a7
.dll windows:4 windows x86 arch:x86

9a836d33504b292bf654f56c3d8eaa0c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:60:05:c1:eb:b9:75:b9:5d:40:c6:fe:ca:12:64:05
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

28-02-2023 00:00

Not After

27-02-2026 23:59

Subject

SERIALNUMBER=91440300695594115R,CN=SHENZHEN QIXINGSHI TECHNOLOGY CO.\,LTD,O=SHENZHEN QIXINGSHI TECHNOLOGY CO.\,LTD,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:d6:0f:98:ce:0e:53:e6:de:d6:fa:70:ff:82:6e:1b:37:49:af:ff:bf:bc:a5:12:ad:e4:8b:e4:86:62:ed:13
Signer

Actual PE Digest

c8:d6:0f:98:ce:0e:53:e6:de:d6:fa:70:ff:82:6e:1b:37:49:af:ff:bf:bc:a5:12:ad:e4:8b:e4:86:62:ed:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libiconv-2

libiconv
libiconv_close
libiconv_open

libboost_regex-mgw44-mt-1_46_1

_ZN5boost11regex_errorC1ERKSsNS_15regex_constants10error_typeEi
_ZN5boost11regex_errorD1Ev
_ZN5boost24scoped_static_mutex_lockC1ERNS_12static_mutexEb
_ZN5boost24scoped_static_mutex_lockD1Ev
_ZN5boost9re_detail11raw_storage6insertEjj
_ZN5boost9re_detail11raw_storage6resizeEj
_ZN5boost9re_detail13get_mem_blockEv
_ZN5boost9re_detail13put_mem_blockEPv
_ZN5boost9re_detail14verify_optionsEjNS_15regex_constants12_match_flagsE
_ZN5boost9re_detail19raise_runtime_errorERKSt13runtime_error
_ZN5boost9re_detail24get_default_error_stringENS_15regex_constants10error_typeE
_ZN5boost9re_detail27cpp_regex_traits_char_layerIcE4initEv
_ZN5boost9re_detail27lookup_default_collate_nameERKSs
_ZNK5boost11regex_error5raiseEv

kernel32

CloseHandle
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
ReleaseSemaphore
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

_fdopen
_fstat
_lseek
_read
_strdup
_write
__dllonexit
__lc_codepage
__mb_cur_max
_assert
_errno
_filbuf
_flsbuf
_iob
_winmajor
abort
atoi
calloc
fclose
fflush
fopen
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
getwc
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putwc
realloc
setlocale
setvbuf
sprintf
strcmp
strcoll
strcpy
strerror
strftime
strlen
strxfrm
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm

libgcc_s_dw2-1

_Unwind_DeleteException
_Unwind_GetDataRelBase
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__deregister_frame_info
__emutls_get_address
__register_frame_info
__udivdi3
__umoddi3

qx_tool.1.0.0

QXGetRunDirectory
QXIsFileOrDirExists
QXMkdir
QXfopen

Exports

Exports

CreateMobiService
FreeMobiService
GetMobiCopyright

Sections

.text
Size: 560KB - Virtual size: 559KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/71
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/83
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/96
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/107
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/118
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a836d33504b292bf654f56c3d8eaa0c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

6e:60:05:c1:eb:b9:75:b9:5d:40:c6:fe:ca:12:64:05Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

c8:d6:0f:98:ce:0e:53:e6:de:d6:fa:70:ff:82:6e:1b:37:49:af:ff:bf:bc:a5:12:ad:e4:8b:e4:86:62:ed:13Signer

Headers

File Characteristics

Imports

libiconv-2

libboost_regex-mgw44-mt-1_46_1

kernel32

msvcrt

libgcc_s_dw2-1

qx_tool.1.0.0

Exports

Exports

Sections

.text Size: 560KB - Virtual size: 559KB

.data Size: 25KB - Virtual size: 25KB

.rdata Size: 42KB - Virtual size: 42KB

/4 Size: 90KB - Virtual size: 89KB

.bss Size: - Virtual size: 3KB

.edata Size: 512B - Virtual size: 139B

.idata Size: 4KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 24KB - Virtual size: 24KB

/14 Size: 18KB - Virtual size: 17KB

/29 Size: 140KB - Virtual size: 139KB

/45 Size: 1.7MB - Virtual size: 1.7MB

/57 Size: 94KB - Virtual size: 93KB

/71 Size: 162KB - Virtual size: 162KB

/83 Size: 66KB - Virtual size: 66KB

/96 Size: 62KB - Virtual size: 62KB

/107 Size: 328KB - Virtual size: 328KB

/118 Size: 149KB - Virtual size: 149KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

6e:60:05:c1:eb:b9:75:b9:5d:40:c6:fe:ca:12:64:05
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

c8:d6:0f:98:ce:0e:53:e6:de:d6:fa:70:ff:82:6e:1b:37:49:af:ff:bf:bc:a5:12:ad:e4:8b:e4:86:62:ed:13
Signer

.text
Size: 560KB - Virtual size: 559KB

.data
Size: 25KB - Virtual size: 25KB

.rdata
Size: 42KB - Virtual size: 42KB

/4
Size: 90KB - Virtual size: 89KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 512B - Virtual size: 139B

.idata
Size: 4KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 24KB - Virtual size: 24KB

/14
Size: 18KB - Virtual size: 17KB

/29
Size: 140KB - Virtual size: 139KB

/45
Size: 1.7MB - Virtual size: 1.7MB

/57
Size: 94KB - Virtual size: 93KB

/71
Size: 162KB - Virtual size: 162KB

/83
Size: 66KB - Virtual size: 66KB

/96
Size: 62KB - Virtual size: 62KB

/107
Size: 328KB - Virtual size: 328KB

/118
Size: 149KB - Virtual size: 149KB