D:\qci_workspace\root-workspaces\__qci-pipeline-902063-1\Source\HRTX\QiDianPlugins\Output\QDPFUpdate\PdbFinal\QDPFUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
37ca6e8388ceff6e6bad96a6659892a1e53275557b16ca5e228e5f2339a30fbc.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
37ca6e8388ceff6e6bad96a6659892a1e53275557b16ca5e228e5f2339a30fbc.exe
Resource
win10v2004-20240611-en
General
-
Target
37ca6e8388ceff6e6bad96a6659892a1e53275557b16ca5e228e5f2339a30fbc
-
Size
1.0MB
-
MD5
5cc1854addfa89261b7f84a77f098aa5
-
SHA1
b01969be136c88dd632cbc9f1e624ab3d817bb74
-
SHA256
37ca6e8388ceff6e6bad96a6659892a1e53275557b16ca5e228e5f2339a30fbc
-
SHA512
60cd45fed1af7412b1cff9b33a8507426155798eaf9e836f307f12c1570c075bd26c1ab7fb683313d5c469f6cb5b0c73efb2609fbe983d5ccb8a897cb09aa8c4
-
SSDEEP
12288:QFYll/0zEIGmvPmA2TCfH6QYUgitwv9tMUgitwv9tigS:QFYf/0zTG8OALHsiEt6iEtp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37ca6e8388ceff6e6bad96a6659892a1e53275557b16ca5e228e5f2339a30fbc
Files
-
37ca6e8388ceff6e6bad96a6659892a1e53275557b16ca5e228e5f2339a30fbc.exe windows:5 windows x86 arch:x86
084b88af0fa46b32d7a29e8255b47f1f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
qidianplugincommon
?ToBool@CVariant@QDPF@@QBE_NPA_N@Z
??0?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@$$T@Z
??0?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@XZ
?get@?$_Ptr_base@VILogicChannel@QDPF@@@std@@IBEPAVILogicChannel@QDPF@@XZ
??0ILogicChannelEvent@QDPF@@QAE@XZ
??ACVariantMap@QDPF@@QBE?AVCVariant@1@PBD@Z
?Copy@IObject@QDPF@@UAEPAV12@XZ
?IsEqual@IObject@QDPF@@UAE_NPAV12@@Z
?IsLessThan@IObject@QDPF@@UAE_NPAV12@@Z
?ToArray@CVariant@QDPF@@QBE?AVCVariantArray@2@PA_N@Z
?HsMember@CVariantMap@QDPF@@QBE_NPBD@Z
??1CVariantArray@QDPF@@UAE@XZ
?ToString@CVariant@QDPF@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_N@Z
??ACVariantMap@QDPF@@QAEAAVCVariant@1@PBD@Z
??0CVariant@QDPF@@QAE@ABH@Z
??ACVariantArray@QDPF@@QAEAAVCVariant@1@ABI@Z
?Size@CVariantArray@QDPF@@QBEIXZ
??0CVariant@QDPF@@QAE@ABV01@@Z
??4CVariant@QDPF@@QAEAAV01@ABV01@@Z
??0CVariant@QDPF@@QAE@AB_N@Z
??1ILogicChannelEvent@QDPF@@UAE@XZ
??0CVariant@QDPF@@QAE@ABVCVariantMap@1@@Z
?GetInstance@QDPF@@YAPAVIApplication@1@XZ
??1IObject@QDPF@@UAE@XZ
?ToInt32@CVariant@QDPF@@QBEHPA_N@Z
??1?$shared_ptr@VILogicChannel@QDPF@@@std@@QAE@XZ
??4?$shared_ptr@VILogicChannel@QDPF@@@std@@QAEAAV01@$$QAV01@@Z
??B?$shared_ptr@VILogicChannel@QDPF@@@std@@QBE_NXZ
?CreateLogicChannel@QDPF@@YA?AV?$shared_ptr@VILogicChannel@QDPF@@@std@@XZ
??0CVariant@QDPF@@QAE@PBD@Z
??1?$pair@PBDVCVariant@QDPF@@@std@@QAE@XZ
??0?$initializer_list@U?$pair@PBDVCVariant@QDPF@@@std@@@std@@QAE@PBU?$pair@PBDVCVariant@QDPF@@@1@0@Z
??0CVariantMap@QDPF@@QAE@XZ
??0CVariantMap@QDPF@@QAE@ABV?$initializer_list@U?$pair@PBDVCVariant@QDPF@@@std@@@std@@@Z
??1CVariantMap@QDPF@@UAE@XZ
?ToJson@CVariantMap@QDPF@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ToMap@CVariant@QDPF@@QBE?AVCVariantMap@2@PA_N@Z
??1CVariant@QDPF@@UAE@XZ
??4CVariant@QDPF@@QAEAAV01@PBD@Z
??4CVariant@QDPF@@QAEAAV01@AB_N@Z
??4CVariant@QDPF@@QAEAAV01@ABH@Z
??4CVariantMap@QDPF@@QAEAAV01@ABV01@@Z
??0CVariantMap@QDPF@@QAE@ABV01@@Z
?FromJson@CVariantMap@QDPF@@QAE_NPBD@Z
??0IObject@QDPF@@QAE@XZ
common
?DeleteFileW@FS@@YAHPB_W@Z
??1CHttpClient@@QAE@XZ
?DownloadToFile@CHttpClient@@QAEHPB_W_K0PAVIHttpClientSink_@@@Z
?ExtractZipFile@Zip@Util@@YAHPB_W0@Z
??0CHttpClient@@QAE@XZ
?RenameFile@FS@@YAHPB_W0@Z
?RenameDirectory@FS@@YAHPB_W0@Z
?DeleteDirectory@FS@@YAHPB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?IsFileExist@FS@@YAHPB_W@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
??0CTXSpinLock@Util@@QAE@XZ
??1CTXSpinLock@Util@@QAE@XZ
?Lock@CTXSpinLock@Util@@QAEXXZ
?UnLock@CTXSpinLock@Util@@QAEXXZ
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
??0CTXStringW@@QAE@ABV0@@Z
??M@YA_NABVCTXStringW@@0@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
??BCTXStringW@@QBEPB_WXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?TXAssert@@YAHPB_W0H@Z
??0CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@PBD@Z
??1CTXStringA@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
?GetString@CTXStringA@@QBEPBDXZ
?Append@CTXStringA@@QAEXABV1@@Z
??BCTXStringA@@QBEPBDXZ
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??7CTXStringW@@QBE_NXZ
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
?AnsiToUnicode@Convert@Util@@YA_NAAVCTXStringW@@PBDH@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?GetRegulatedTime@Time@Util@@YA_NAA_J@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?Base64Encode@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@H@Z
?CreateDirectoryW@FS@@YAHPB_W@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
??0CTXStringW@@QAE@PA_W@Z
?GetString@CTXStringW@@QBEPB_WXZ
ord30
?SetWriteFileOpt@TXLog@@YAXH@Z
?GetSession@TXLog@@YAKXZ
?SetMainAndLogicMsgLoop@Misc@Util@@YAXPAVMessageLoopForUI@AsyncTask@@PAVMessageLoop@4@@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?InitArkHttp@HttpClientUtil@@SAHXZ
??0CTXStringA@@QAE@ABV0@@Z
??M@YA_NABVCTXStringA@@0@Z
?GetLength@CTXStringA@@QBEHXZ
?CompareNoCase@CTXStringA@@QBEHPBD@Z
?Replace@CTXStringA@@QAEHPBD0@Z
?ReverseFind@CTXStringA@@QBEHD@Z
?MakeLower@CTXStringA@@QAEAAV1@XZ
?Right@CTXStringA@@QBE?AV1@H@Z
?Left@CTXStringA@@QBE?AV1@H@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?AppendFormat@CTXStringW@@QAAXPB_WZZ
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?GetMainThreadLoop@Misc@Util@@YAPAVMessageLoopForUI@AsyncTask@@XZ
?IsInitAsyncMsgLoop@Misc@Util@@YAHXZ
?GetMainAndLogicThreadId@Misc@Util@@YAXAAK0@Z
?LogTaskStart@Misc@Util@@YAKPB_W@Z
?LogTaskEnd@Misc@Util@@YAXK@Z
?UnicodeToGBK@Convert@Util@@YA_NAAVCTXStringA@@PB_WH@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
?oi_symmetry_encrypt2_len@@YAHH@Z
?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z
?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z
asynctask
?Release@Lock@AsyncTask@@QAEXXZ
?Acquire@Lock@AsyncTask@@QAEXXZ
??1Lock@AsyncTask@@QAE@XZ
??0Lock@AsyncTask@@QAE@XZ
?ThreadMain@Thread@AsyncTask@@EAEXXZ
?Init@Thread@AsyncTask@@MAEXXZ
?CleanUpAfterMessageLoopDestruction@Thread@AsyncTask@@MAEXXZ
?CleanUp@Thread@AsyncTask@@MAEXXZ
?Run@Thread@AsyncTask@@MAEXPAVMessageLoop@2@@Z
?AssertAcquired@Lock@AsyncTask@@QBEXXZ
?message_loop@Thread@AsyncTask@@QBEPAVMessageLoop@2@XZ
?Stop@Thread@AsyncTask@@QAEXXZ
?StartWithOptions@Thread@AsyncTask@@QAE_NABUOptions@12@@Z
??1Thread@AsyncTask@@UAE@XZ
??0Thread@AsyncTask@@QAE@PBD@Z
??1MessageLoopForUI@AsyncTask@@UAE@XZ
?Run@MessageLoopForUI@AsyncTask@@QAEXXZ
??0MessageLoopForUI@AsyncTask@@QAE@XZ
?SetWorkerFactory@MessageLoop@AsyncTask@@QAEXPAVWorkerFactory@12@@Z
?PostTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@@Z
?PostDelayedTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@_J@Z
?QueryTaskCount@MessageLoop@AsyncTask@@QAEIXZ
?Start@Thread@AsyncTask@@QAE_NXZ
?IsRunning@Thread@AsyncTask@@QBE_NXZ
?thread_id@Thread@AsyncTask@@QBEKXZ
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
kernel32
FormatMessageW
GetFileSize
ReadFile
CreateFileA
IsDebuggerPresent
OutputDebugStringW
LocalFree
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
SetLastError
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateEventW
InterlockedExchange
MultiByteToWideChar
GetCommandLineA
CreateProcessA
HeapAlloc
HeapFree
GetProcessHeap
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
GetSystemInfo
GetProcAddress
VirtualQuery
VirtualAllocEx
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
OpenThread
SetErrorMode
ReadProcessMemory
WriteProcessMemory
SuspendThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CloseHandle
DuplicateHandle
GetSystemTimeAsFileTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
GetStartupInfoW
CreateFileMappingW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
CreateFileW
SearchPathW
QueryPerformanceCounter
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Module32FirstW
Module32NextW
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
WideCharToMultiByte
CreateMutexA
user32
PostQuitMessage
advapi32
GetUserNameW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
ole32
OleInitialize
CoCreateGuid
OleUninitialize
shlwapi
PathFileExistsW
msvcp140
?_Winerror_message@std@@YAKKPADK@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_signal
_Cnd_wait
_Cnd_destroy
_Cnd_init
_Mtx_unlock
_Mtx_lock
_Mtx_destroy
_Mtx_init
_Thrd_start
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
wintrust
WTHelperGetProvCertFromChain
CryptCATAdminAcquireContext
WinVerifyTrust
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
WTHelperProvDataFromStateData
crypt32
CertGetNameStringW
vcruntime140
__std_terminate
memmove
__std_exception_destroy
__std_exception_copy
memcpy
__CxxFrameHandler3
_CxxThrowException
memset
memchr
memcmp
_except_handler4_common
_purecall
__std_type_info_name
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_exit
exit
_controlfp_s
_set_app_type
_initterm_e
_seh_filter_exe
terminate
_cexit
_initterm
_configure_wide_argv
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_get_wide_winmain_command_line
__p___wargv
__p___argc
_errno
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
_callnewh
free
realloc
_recalloc
calloc
_set_new_mode
malloc
api-ms-win-crt-string-l1-1-0
strlen
_wcslwr
wcslen
wcscpy_s
wcscat_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
_set_fmode
__stdio_common_vswprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__p__commode
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 449KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ