D:\qci_workspace\root-workspaces\__qci-pipeline-414467-1\Source\HRTX\QiDianPlugins\Output\QDPFUpdate\PdbFinal\QDPFUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5d80de927c53470b4e61edb557fb3ce3ef178f8833af767dea5430a0a51a64ab.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
5d80de927c53470b4e61edb557fb3ce3ef178f8833af767dea5430a0a51a64ab.exe
Resource
win10v2004-20240611-en
General
-
Target
5d80de927c53470b4e61edb557fb3ce3ef178f8833af767dea5430a0a51a64ab
-
Size
1.0MB
-
MD5
f38cab6a0061fd28b25f18d838214053
-
SHA1
d4c7673632f69a8bb228e8c4d443bc7a4617299a
-
SHA256
5d80de927c53470b4e61edb557fb3ce3ef178f8833af767dea5430a0a51a64ab
-
SHA512
0edca32916f686cd258f461f0d21b74faeeefecf3d3eb9ba60b15e1291d39018fde09a43bb32d9e2b6f0daccc9d4cb37e8d79a9e6ad861760d4ef9bad5b79d71
-
SSDEEP
12288:SYZaCERFSFGC2lnpSZYnM3UYUgitwv9tMUgitwv9tJgL:SYZXERFcG9ppCYMtiEt6iEt2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d80de927c53470b4e61edb557fb3ce3ef178f8833af767dea5430a0a51a64ab
Files
-
5d80de927c53470b4e61edb557fb3ce3ef178f8833af767dea5430a0a51a64ab.exe windows:5 windows x86 arch:x86
084b88af0fa46b32d7a29e8255b47f1f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
qidianplugincommon
?ToBool@CVariant@QDPF@@QBE_NPA_N@Z
??0?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@$$T@Z
??0?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@XZ
?get@?$_Ptr_base@VILogicChannel@QDPF@@@std@@IBEPAVILogicChannel@QDPF@@XZ
??0ILogicChannelEvent@QDPF@@QAE@XZ
??ACVariantMap@QDPF@@QBE?AVCVariant@1@PBD@Z
?Copy@IObject@QDPF@@UAEPAV12@XZ
?IsEqual@IObject@QDPF@@UAE_NPAV12@@Z
?IsLessThan@IObject@QDPF@@UAE_NPAV12@@Z
?ToArray@CVariant@QDPF@@QBE?AVCVariantArray@2@PA_N@Z
?HsMember@CVariantMap@QDPF@@QBE_NPBD@Z
??1CVariantArray@QDPF@@UAE@XZ
?ToString@CVariant@QDPF@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_N@Z
??ACVariantMap@QDPF@@QAEAAVCVariant@1@PBD@Z
??0CVariant@QDPF@@QAE@ABH@Z
??ACVariantArray@QDPF@@QAEAAVCVariant@1@ABI@Z
?Size@CVariantArray@QDPF@@QBEIXZ
??0CVariant@QDPF@@QAE@ABV01@@Z
??4CVariant@QDPF@@QAEAAV01@ABV01@@Z
??0CVariant@QDPF@@QAE@AB_N@Z
??1ILogicChannelEvent@QDPF@@UAE@XZ
??0CVariant@QDPF@@QAE@ABVCVariantMap@1@@Z
?GetInstance@QDPF@@YAPAVIApplication@1@XZ
??1IObject@QDPF@@UAE@XZ
?ToInt32@CVariant@QDPF@@QBEHPA_N@Z
??1?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@XZ
??4?$shared_ptr@VILogicChannel@QDPF@@@std@@QAEAAV01@$$QAV01@@Z
??B?$shared_ptr@VILogicChannel@QDPF@@@std@@QBE_NXZ
?CreateLogicChannel@QDPF@@YA?AV?$shared_ptr@VILogicChannel@QDPF@@@std@@XZ
??0CVariant@QDPF@@QAE@PBD@Z
??1?$pair@PBDVCVariant@QDPF@@@std@@QAE@XZ
??0?$initializer_list@U?$pair@PBDVCVariant@QDPF@@@std@@@std@@QAE@PBU?$pair@PBDVCVariant@QDPF@@@1@0@Z
??0CVariantMap@QDPF@@QAE@XZ
??0CVariantMap@QDPF@@QAE@ABV?$initializer_list@U?$pair@PBDVCVariant@QDPF@@@std@@@std@@@Z
??1CVariantMap@QDPF@@UAE@XZ
?ToJson@CVariantMap@QDPF@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ToMap@CVariant@QDPF@@QBE?AVCVariantMap@2@PA_N@Z
??1CVariant@QDPF@@UAE@XZ
??4CVariant@QDPF@@QAEAAV01@PBD@Z
??4CVariant@QDPF@@QAEAAV01@AB_N@Z
??4CVariant@QDPF@@QAEAAV01@ABH@Z
??4CVariantMap@QDPF@@QAEAAV01@ABV01@@Z
??0CVariantMap@QDPF@@QAE@ABV01@@Z
?FromJson@CVariantMap@QDPF@@QAE_NPBD@Z
??0IObject@QDPF@@QAE@XZ
common
?DeleteFileW@FS@@YAHPB_W@Z
??1CHttpClient@@QAE@XZ
?DownloadToFile@CHttpClient@@QAEHPB_W_K0PAVIHttpClientSink_@@@Z
?ExtractZipFile@Zip@Util@@YAHPB_W0@Z
??0CHttpClient@@QAE@XZ
?RenameFile@FS@@YAHPB_W0@Z
?RenameDirectory@FS@@YAHPB_W0@Z
?DeleteDirectory@FS@@YAHPB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?IsFileExist@FS@@YAHPB_W@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
??0CTXSpinLock@Util@@QAE@XZ
??1CTXSpinLock@Util@@QAE@XZ
?Lock@CTXSpinLock@Util@@QAEXXZ
?UnLock@CTXSpinLock@Util@@QAEXXZ
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
??0CTXStringW@@QAE@ABV0@@Z
??M@YA_NABVCTXStringW@@0@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
??BCTXStringW@@QBEPB_WXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?TXAssert@@YAHPB_W0H@Z
??0CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@PBD@Z
??1CTXStringA@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
?GetString@CTXStringA@@QBEPBDXZ
?Append@CTXStringA@@QAEXABV1@@Z
??BCTXStringA@@QBEPBDXZ
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??7CTXStringW@@QBE_NXZ
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
?AnsiToUnicode@Convert@Util@@YA_NAAVCTXStringW@@PBDH@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?GetRegulatedTime@Time@Util@@YA_NAA_J@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?Base64Encode@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@H@Z
?CreateDirectoryW@FS@@YAHPB_W@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
??0CTXStringW@@QAE@PA_W@Z
?GetString@CTXStringW@@QBEPB_WXZ
ord30
?SetWriteFileOpt@TXLog@@YAXH@Z
?GetSession@TXLog@@YAKXZ
?SetMainAndLogicMsgLoop@Misc@Util@@YAXPAVMessageLoopForUI@AsyncTask@@PAVMessageLoop@4@@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?InitArkHttp@HttpClientUtil@@SAHXZ
??0CTXStringA@@QAE@ABV0@@Z
??M@YA_NABVCTXStringA@@0@Z
?GetLength@CTXStringA@@QBEHXZ
?CompareNoCase@CTXStringA@@QBEHPBD@Z
?Replace@CTXStringA@@QAEHPBD0@Z
?ReverseFind@CTXStringA@@QBEHD@Z
?MakeLower@CTXStringA@@QAEAAV1@XZ
?Right@CTXStringA@@QBE?AV1@H@Z
?Left@CTXStringA@@QBE?AV1@H@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?AppendFormat@CTXStringW@@QAAXPB_WZZ
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?GetMainThreadLoop@Misc@Util@@YAPAVMessageLoopForUI@AsyncTask@@XZ
?IsInitAsyncMsgLoop@Misc@Util@@YAHXZ
?GetMainAndLogicThreadId@Misc@Util@@YAXAAK0@Z
?LogTaskStart@Misc@Util@@YAKPB_W@Z
?LogTaskEnd@Misc@Util@@YAXK@Z
?UnicodeToGBK@Convert@Util@@YA_NAAVCTXStringA@@PB_WH@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
?oi_symmetry_encrypt2_len@@YAHH@Z
?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z
?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z
asynctask
?Release@Lock@AsyncTask@@QAEXXZ
?Acquire@Lock@AsyncTask@@QAEXXZ
??1Lock@AsyncTask@@QAE@XZ
??0Lock@AsyncTask@@QAE@XZ
?ThreadMain@Thread@AsyncTask@@EAEXXZ
?Init@Thread@AsyncTask@@MAEXXZ
?CleanUpAfterMessageLoopDestruction@Thread@AsyncTask@@MAEXXZ
?CleanUp@Thread@AsyncTask@@MAEXXZ
?Run@Thread@AsyncTask@@MAEXPAVMessageLoop@2@@Z
?AssertAcquired@Lock@AsyncTask@@QBEXXZ
?message_loop@Thread@AsyncTask@@QBEPAVMessageLoop@2@XZ
?Stop@Thread@AsyncTask@@QAEXXZ
?StartWithOptions@Thread@AsyncTask@@QAE_NABUOptions@12@@Z
??1Thread@AsyncTask@@UAE@XZ
??0Thread@AsyncTask@@QAE@PBD@Z
??1MessageLoopForUI@AsyncTask@@UAE@XZ
?Run@MessageLoopForUI@AsyncTask@@QAEXXZ
??0MessageLoopForUI@AsyncTask@@QAE@XZ
?SetWorkerFactory@MessageLoop@AsyncTask@@QAEXPAVWorkerFactory@12@@Z
?PostTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@@Z
?PostDelayedTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@_J@Z
?QueryTaskCount@MessageLoop@AsyncTask@@QAEIXZ
?Start@Thread@AsyncTask@@QAE_NXZ
?IsRunning@Thread@AsyncTask@@QBE_NXZ
?thread_id@Thread@AsyncTask@@QBEKXZ
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
kernel32
FormatMessageW
GetFileSize
ReadFile
CreateFileA
IsDebuggerPresent
OutputDebugStringW
LocalFree
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
SetLastError
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateEventW
InterlockedExchange
MultiByteToWideChar
GetCommandLineA
CreateProcessA
HeapAlloc
HeapFree
GetProcessHeap
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
GetSystemInfo
GetProcAddress
VirtualQuery
VirtualAllocEx
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
OpenThread
SetErrorMode
ReadProcessMemory
WriteProcessMemory
SuspendThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CloseHandle
DuplicateHandle
GetSystemTimeAsFileTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
GetStartupInfoW
CreateFileMappingW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
CreateFileW
SearchPathW
QueryPerformanceCounter
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Module32FirstW
Module32NextW
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
WideCharToMultiByte
CreateMutexA
user32
PostQuitMessage
advapi32
GetUserNameW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
ole32
OleInitialize
CoCreateGuid
OleUninitialize
shlwapi
PathFileExistsW
msvcp140
?_Winerror_message@std@@YAKKPADK@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_signal
_Cnd_wait
_Cnd_destroy
_Cnd_init
_Mtx_unlock
_Mtx_lock
_Mtx_destroy
_Mtx_init
_Thrd_start
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
wintrust
WTHelperGetProvCertFromChain
CryptCATAdminAcquireContext
WinVerifyTrust
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
WTHelperProvDataFromStateData
crypt32
CertGetNameStringW
vcruntime140
__std_terminate
memmove
__std_exception_destroy
__std_exception_copy
memcpy
__CxxFrameHandler3
_CxxThrowException
memset
memchr
memcmp
_except_handler4_common
_purecall
__std_type_info_name
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_exit
exit
_controlfp_s
_set_app_type
_initterm_e
_seh_filter_exe
terminate
_cexit
_initterm
_configure_wide_argv
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_get_wide_winmain_command_line
__p___wargv
__p___argc
_errno
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
_callnewh
free
realloc
_recalloc
calloc
_set_new_mode
malloc
api-ms-win-crt-string-l1-1-0
strlen
_wcslwr
wcslen
wcscpy_s
wcscat_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
_set_fmode
__stdio_common_vswprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__p__commode
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 449KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ