18cf3ad8549bec46f807465331a3a567782b47e6b77a7c7bfceb547d11747d8b

Sharing

Copy URL Twitter E-mail

General

Target

18cf3ad8549bec46f807465331a3a567782b47e6b77a7c7bfceb547d11747d8b
Size

672KB
MD5

9c9bee0357a41a2966ee8f126503a431
SHA1

a6b4b7100115f74b1193656b0664c806b40b049c
SHA256

18cf3ad8549bec46f807465331a3a567782b47e6b77a7c7bfceb547d11747d8b
SHA512

4f924dc81050ac2a009cda3d5b352a519e0c73a4150bdeaa3efe50fb6a76f12d2bf14f29887750a5b185a83d64a59101a4f66e6ffcfcac6c009a805505e7acb0
SSDEEP

12288:ynHNuRW/ZLp18p/eu2vOk+Vlkdr1HL3OKNdG/ArgqCmb1AWSmfTnH9AjcGrbMIHa:uHRLg/etQviABGGAmMkI4ASG99/WoL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18cf3ad8549bec46f807465331a3a567782b47e6b77a7c7bfceb547d11747d8b

Files

18cf3ad8549bec46f807465331a3a567782b47e6b77a7c7bfceb547d11747d8b
.exe windows:5 windows x86 arch:x86

57c55715ee31a4f74d4f3013926434fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\qci_workspace\root-workspaces\__qci-pipeline-454445-1\Misc\Setup3\build\Release\Uninstall.pdb

Imports

msi

ord195
ord70

psapi

GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

htons
recv
inet_ntoa
WSACleanup
closesocket
gethostbyname
WSAStartup
inet_addr
send
socket
connect

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
CreateDirectoryW
GetLongPathNameW
GetTempPathW
GetFileAttributesW
DeleteFileW
WaitForSingleObject
GetVersionExW
Sleep
GetLastError
GetProcAddress
GetModuleHandleW
RemoveDirectoryW
MoveFileExW
GetTickCount
MoveFileW
FindFirstFileW
FindNextFileW
FindClose
CreateMutexW
LoadLibraryW
WideCharToMultiByte
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
GetCurrentProcessId
CreateProcessW
lstrcmpiW
GetExitCodeProcess
TerminateProcess
MultiByteToWideChar
SizeofResource
WriteFile
CreateFileW
LoadResource
FindResourceW
InterlockedExchangeAdd
SetUnhandledExceptionFilter
ReadFile
GetCurrentProcess
GetStdHandle
AssignProcessToJobObject
ResumeThread
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CreateEventW
InterlockedCompareExchange
GetNativeSystemInfo
SetLastError
OutputDebugStringA
GetModuleFileNameW
SetFilePointer
ReleaseMutex
HeapFree
GetFileAttributesExW
GetCurrentDirectoryW
CopyFileW
GetCommandLineW
LocalFree
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
InterlockedExchange
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
IsDebuggerPresent
GetCurrentThreadId
RaiseException
CreateThread
SetFilePointerEx
FlushFileBuffers
GetSystemDirectoryW
GetWindowsDirectoryW
SetEvent
InterlockedIncrement
ExitProcess
FreeResource
LockResource
GetTimeZoneInformation
GetFullPathNameW
GetConsoleMode
GetConsoleCP
GetFileType
SetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
RtlUnwind
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
WriteConsoleW
GetDriveTypeW
ReadConsoleW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapAlloc
CompareStringW
DecodePointer
EncodePointer
SwitchToThread
SetEnvironmentVariableA
GetProcessHeap
HeapSize
SetEndOfFile

user32

TranslateMessage
PostQuitMessage
MessageBoxW
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
PeekMessageW
SetTimer
DispatchMessageW
RegisterClassExW
SendMessageW
FindWindowW
WaitMessage
KillTimer
UnregisterClassW
DefWindowProcW
PostMessageW
DestroyWindow
CreateWindowExW

advapi32

RegCreateKeyExW
RegEnumValueW
CreateProcessAsUserW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyW
DeleteService
ControlService
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenServiceW

shell32

SHChangeNotify
SHGetSpecialFolderLocation
SHGetFolderPathW
CommandLineToArgvW
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
StringFromCLSID
CLSIDFromProgID
CoTaskMemFree
CoInitialize

oleaut32

SysAllocString
SysFreeString

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

shlwapi

PathStripToRootW
wnsprintfW
SHDeleteKeyW
PathCanonicalizeW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

Sections

.text
Size: 479KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57c55715ee31a4f74d4f3013926434fb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

psapi

version

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

shlwapi

winmm

Sections

.text Size: 479KB - Virtual size: 478KB

.rdata Size: 134KB - Virtual size: 133KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 27KB - Virtual size: 26KB

.text
Size: 479KB - Virtual size: 478KB

.rdata
Size: 134KB - Virtual size: 133KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 27KB - Virtual size: 26KB