quickassist[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

quickassist.exe
Size

758KB
MD5

e0a5164f6d058dcc068b32867e542b0a
SHA1

ae7bc4fd7a893e6cc04129584340363a5ac4f9b0
SHA256

8837ea86ad08afc73615b492ced6cf16343f0adfd78869cce30809d5df73b8d8
SHA512

a8f096b311a93f9e54912f1e7e9609f2dcc9f57d026264fb6ce670a965bbf07bf8eabd2415d0fc85e0e21fa22dadbf7110046876c14185de4507116c29c7af16
SSDEEP

12288:Xnem1Gz7V2oGlx/y8nHLOELqhsDHLVj0B/rGs/vAwil1GaQDN2Z0CbbOfpWH+EMd:Xh1Gz7V2oCVnLOELqhsbLVjqrGuvg1G7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
quickassist.exe

Files

quickassist.exe
.exe windows:10 windows x86 arch:x86

132825e8e1cc5d8af1b27f2c60d01256

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

QuickAssist.pdb

Imports

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
SizeofResource
FreeLibrary
GetModuleHandleExW
LoadResource
FreeLibraryAndExitThread
FindResourceExW
LoadLibraryExW
LockResource
LoadLibraryExA
GetModuleHandleW
GetProcAddress
LoadStringW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseSRWLockShared
WaitForSingleObject
CreateSemaphoreExW
AcquireSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateMutexExW
OpenSemaphoreW
CreateEventExW
WaitForSingleObjectEx
ReleaseMutex
CreateEventW
ResetEvent
SetEvent
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
InitializeSRWLock
TryAcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
GetCurrentProcess
TerminateProcess
OpenProcessToken
CreateProcessAsUserW
TlsSetValue
CreateThread
TlsAlloc
GetStartupInfoW
GetCurrentProcessId
TlsFree
GetCurrentThreadId
ExitThread
GetCurrentThread
ExitProcess

api-ms-win-core-localization-l1-2-0

LCMapStringW
FormatMessageW
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

oleaut32

SysAllocString
OleCreateFontIndirect
VarUI4FromStr
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
VariantChangeType
SysAllocStringLen
SysFreeString
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarBstrCmp
VariantInit
VariantClear
SysStringByteLen

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoCreateInstance
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
CoGetInterfaceAndReleaseStream
CoCreateGuid
CreateStreamOnHGlobal
CoCreateInstanceFromApp
CoInitializeEx
CoGetObjectContext
CoGetApartmentType
CoUninitialize
CLSIDFromProgID
CLSIDFromString
CoCreateFreeThreadedMarshaler
StringFromGUID2

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
CallbackMayRunLong
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolTimer
SubmitThreadpoolWork

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegGetValueW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsDeleteString
WindowsGetStringLen
WindowsCreateStringReference
WindowsDuplicateString

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoTransformError
RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalFree

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics
SystemParametersInfoW
EnumDisplayMonitors

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor
GetScaleFactorForMonitor
SetProcessDpiAwareness

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-file-l1-2-0

GetTempPathW

urlmon

URLDownloadToFileW

api-ms-win-core-file-l1-1-0

FindFirstFileExW
FindClose
FindNextFileW
CreateFileW
SetFilePointerEx
GetFileType
FlushFileBuffers
GetFileAttributesW
GetTempFileNameW
WriteFile

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetTokenInformation
AdjustTokenPrivileges
CreateRestrictedToken
CheckTokenMembership

wintrust

WinVerifyTrust

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetStdHandle
GetCommandLineA
GetCommandLineW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitializeConditionVariable
WakeConditionVariable
InitOnceExecuteOnce
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-console-l1-1-0

GetConsoleMode
GetConsoleCP
WriteConsoleW

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsGetValue
FlsAlloc
FlsSetValue

gdi32

CreateFontIndirectW
GetObjectW
DeleteDC
GetTextExtentPoint32W
BitBlt
SelectObject
SetBkMode
GetStockObject
DeleteObject
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush

ole32

CoGetObject
OleLockRunning
OleInitialize
OleUninitialize

user32

LoadIconW
GetDC
GetClientRect
GetWindowRect
BringWindowToTop
IsDialogMessageW
GetMessageW
ReleaseDC
PostQuitMessage
EnableMenuItem
GetAncestor
BeginPaint
EndPaint
TranslateMessage
InvalidateRect
CreateWindowExW
SendMessageW
GetWindowTextW
GetWindowTextLengthW
DispatchMessageW
GetClassLongW
MoveWindow
SetWindowPos
ClientToScreen
DestroyWindow
UpdateWindow
ShowWindow
SendInput
SetLayeredWindowAttributes
SetTimer
ScreenToClient
InvalidateRgn
RedrawWindow
SetCapture
UpdateLayeredWindow
SetFocus
GetWindow
KillTimer
IsChild
GetParent
GetDlgItem
IsWindow
GetClassNameW
GetClassInfoExW
LoadCursorW
GetSystemMenu
GetSysColor
DestroyAcceleratorTable
UnhookWindowsHookEx
GetFocus
GetDesktopWindow
CreateAcceleratorTableW
ReleaseCapture
RegisterWindowMessageW
UnregisterClassW
SetWindowsHookExW
MonitorFromWindow
CallWindowProcW
DefWindowProcW
SetClassLongW
CallNextHookEx
GetKeyState
SetWindowLongW
GetWindowLongW
PostMessageW
SetWindowTextW
FillRect
RegisterClassExW

comctl32

InitCommonControlsEx

uxtheme

SetWindowThemeAttribute

gdiplus

GdipCloneImage
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromScan0
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipAlloc
GdipGetImageWidth
GdipDisposeImage
GdipLoadImageFromStream
GdipDrawImageRectI
GdipDrawImageI
GdipGraphicsClear
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHDC

rpcrt4

UuidCreate

ext-ms-win-shell-shell32-l1-2-0

ShellExecuteW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

d2d1

ord1

d3d11

D3D11CreateDevice

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-shutdown-l1-1-1

InitiateShutdownW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

crypt32

CryptProtectData
CryptUnprotectData

dcomp

DCompositionCreateDevice2
DCompositionCreateSurfaceHandle

sas

SendSAS

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ext-ms-win-kernel32-windowserrorreporting-l1-1-1

RegisterApplicationRestart

Sections

.text
Size: 654KB - Virtual size: 654KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

132825e8e1cc5d8af1b27f2c60d01256

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-file-l1-2-0

urlmon

api-ms-win-core-file-l1-1-0

api-ms-win-security-base-l1-1-0

wintrust

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-fibers-l1-1-0

gdi32

ole32

user32

comctl32

uxtheme

gdiplus

rpcrt4

ext-ms-win-shell-shell32-l1-2-0

api-ms-win-core-com-l1-1-1

d2d1

d3d11

api-ms-win-core-url-l1-1-0

api-ms-win-core-shutdown-l1-1-1

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-registry-l1-1-1

crypt32

dcomp

sas

api-ms-win-core-apiquery-l1-1-0

ext-ms-win-kernel32-windowserrorreporting-l1-1-1

Sections

.text Size: 654KB - Virtual size: 654KB

.data Size: 5KB - Virtual size: 9KB

.idata Size: 13KB - Virtual size: 12KB

.rsrc Size: 46KB - Virtual size: 46KB

.text
Size: 654KB - Virtual size: 654KB

.data
Size: 5KB - Virtual size: 9KB

.idata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 38KB - Virtual size: 38KB