3c992cbdd9e7938373d322049c97ac6935f5b7fbb818b46b88316ff406e243bf

Sharing

Copy URL Twitter E-mail

General

Target

3c992cbdd9e7938373d322049c97ac6935f5b7fbb818b46b88316ff406e243bf
Size

975KB
MD5

4656d5d0e4effee0d436dc5a3df8ebbc
SHA1

6bb270f7a1d8689b4d63929166582703fa5f8357
SHA256

3c992cbdd9e7938373d322049c97ac6935f5b7fbb818b46b88316ff406e243bf
SHA512

5e11d720b4a9ff9165516b5a56b4344df7d916e179eb3c6ec78cab41642abbd3b1cafa999aa583be8b132de1bc0d10958f7786772a0928bd42672ba645a0f54e
SSDEEP

12288:fSOPiXad4W0sgN3oAbMKYHZZ62XbF0snE6Md/1sqn6hTAGJAvRzHLMf1ga:fTiXaVhPAs+6hTrAv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c992cbdd9e7938373d322049c97ac6935f5b7fbb818b46b88316ff406e243bf

Files

3c992cbdd9e7938373d322049c97ac6935f5b7fbb818b46b88316ff406e243bf
.dll windows:5 windows x86 arch:x86

032c21029d9ccddb486c8eecb594c38e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\devwork\com\qex\branches\qex.2013.1205.2120.4.1.2.3199\Release\qex.pdb

Imports

kernel32

DeleteCriticalSection
FreeLibrary
GetCurrentProcessId
DeviceIoControl
CloseHandle
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
CreateFileW
GetProcAddress
lstrlenW
GetFileSize
HeapAlloc
HeapFree
GetCurrentProcess
GetStdHandle
InterlockedCompareExchange
Sleep
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
DeleteFileW
GetLastError
FindClose
lstrcatW
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExW
SetFileTime
CreateDirectoryW
GetFullPathNameW
SetFileAttributesW
FileTimeToSystemTime
lstrcmpiA
GetCurrentThreadId
LeaveCriticalSection
GetModuleFileNameA
GetEnvironmentVariableW
GetFileAttributesW
lstrcmpW
GlobalMemoryStatusEx
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
GetFileSizeEx
OutputDebugStringW
FormatMessageW
SetLastError
LocalFree
GetSystemTime
CreateMutexW
TlsGetValue
SetEnvironmentVariableW
WaitForSingleObject
GetProcessHeap
TlsSetValue
OpenThread
ReleaseMutex
TlsAlloc
TlsFree
GetStringTypeW
EncodePointer
DecodePointer
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
ReadConsoleW
GetOEMCP
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
CopyFileW
lstrlenA
InterlockedDecrement
GetACP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
InitializeCriticalSectionAndSpinCount
GetCommandLineA
InterlockedIncrement
GetFileType
AreFileApisANSI
GetModuleHandleExW
ExitProcess
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc

user32

CharUpperW

advapi32

RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExA

shell32

SHFileOperationW

oleaut32

VariantCopy
VariantInit
SysAllocString
VariantClear

shlwapi

SHGetValueW
StrCmpNW
StrStrIW
StrStrW
StrCmpNIA
StrCmpNA
PathFileExistsW
StrCmpNIW
StrStrIA
PathRemoveBackslashW

Exports

Exports

CreateInstance
QEXCreateInstance

Sections

.text
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

032c21029d9ccddb486c8eecb594c38e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 434KB - Virtual size: 433KB

.rdata Size: 248KB - Virtual size: 247KB

.data Size: 40KB - Virtual size: 69KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 243KB - Virtual size: 242KB

.text
Size: 434KB - Virtual size: 433KB

.rdata
Size: 248KB - Virtual size: 247KB

.data
Size: 40KB - Virtual size: 69KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 243KB - Virtual size: 242KB