General

  • Target

    8b716d8c41b5c5e3504da69a7fad30652a7f5590664092c0a9a410867b893635

  • Size

    5.4MB

  • MD5

    6bab888a9ee40d47ba8d394129d6830c

  • SHA1

    39fd4c2bdb8a06c3673fb6cba99a8a7ab97fa668

  • SHA256

    8b716d8c41b5c5e3504da69a7fad30652a7f5590664092c0a9a410867b893635

  • SHA512

    1506186c21afe36a330b4969719ddee754c1414b6b3a2077a453c9e963ff1e2f681f5c778bb01b828f63369b81dd319b17dcda505629ed666b5170e65e5fc160

  • SSDEEP

    98304:CdZwiEfYvaTrWGlGC0tEK4Xpr6PctsLk7tfp3NBl4fMcNvb:KwDgvoHQEKwhXIyRRNzi

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • 8b716d8c41b5c5e3504da69a7fad30652a7f5590664092c0a9a410867b893635
    .zip
  • QQScreenShotNT-Plus/MMMojoCall.dll
    .dll windows:6 windows x64 arch:x64

    25bf9dd933cf3958c64d9932927246e8


    Headers

    Imports

    Exports

    Sections

  • QQScreenShotNT-Plus/NTLauncher.exe
    .exe windows:6 windows x64 arch:x64

    9f990d308401ca66062ae75f451d4aba


    Headers

    Imports

    Sections

  • QQScreenShotNT-Plus/NTViewer64.exe
    .exe windows:6 windows x64 arch:x64

    286a6b426529825e7df289c431d3f6be


    Headers

    Imports

    Sections

  • QQScreenShotNT-Plus/README.md
  • QQScreenShotNT-Plus/config.ini
  • QQScreenShotNT-Plus/ntplugin/baidusearch.py
  • QQScreenShotNT-Plus/ntplugin/baidusoutu.py
  • QQScreenShotNT-Plus/ntplugin/baidutran.py
  • QQScreenShotNT-Plus/ntplugin/googlesearch.py
  • QQScreenShotNT-Plus/ntplugin/googletran.py
  • QQScreenShotNT-Plus/ntplugin/saveocr.py
  • QQScreenShotNT-Plus/ntplugin/yandexsoutu.py
  • QQScreenShotNT-Plus/ntplugin/youdaotran.py
  • QQScreenShotNT-Plus/parent-ipc-core-x64.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    c1a5d6b218f18af863c2aa58d356b421


    Headers

    Imports

    Exports

    Sections

  • QQScreenShotNT-Plus/python311.dll
    .dll windows:6 windows x64 arch:x64

    5714829f48aacde8f83e3e5f0ead1f49


    Code Sign

    Headers

    Imports

    Exports

    Sections