eaf7b33616a480d12604a5ad37fc46bdf144b6a681414740e593b08b3284a79d

Sharing

Copy URL Twitter E-mail

General

Target

eaf7b33616a480d12604a5ad37fc46bdf144b6a681414740e593b08b3284a79d
Size

2.5MB
MD5

df1f590bd3b2b4dc3cede0dc14909d2e
SHA1

f34ae484b527e9c7273a8c0653b95ec6ee4418c2
SHA256

eaf7b33616a480d12604a5ad37fc46bdf144b6a681414740e593b08b3284a79d
SHA512

2a557c93797244a78271ed2b854344584d1f1710392e255551010570c6009be9260b035480bad9b781518bf6f6fe0fb6c10d05bee2b78e0befc1443265f36627
SSDEEP

49152:ZkoNb1EYxcjKu/Uw3XKNmaWvJFqJVOY+TfvioAm8WlGgwVZN9W/OlJF2Is4hJD6:ZDAYx4TacJFqJVOFDiZmLlGgIZ+SuIs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eaf7b33616a480d12604a5ad37fc46bdf144b6a681414740e593b08b3284a79d

Files

eaf7b33616a480d12604a5ad37fc46bdf144b6a681414740e593b08b3284a79d
.exe windows:5 windows x86 arch:x86

443ebbe57915aebb0bb5c0f08d034429

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\qnInstall\bin\Release\uninstall.pdb

Imports

kernel32

CreateFileW
WriteFile
EnterCriticalSection
LeaveCriticalSection
SetLastError
MultiByteToWideChar
MulDiv
GetModuleHandleW
GetPrivateProfileStringW
WaitForSingleObject
SetFileAttributesW
MoveFileW
MoveFileExW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetFileAttributesW
InitializeCriticalSection
TerminateThread
GetProcAddress
CreateProcessW
GetExitCodeProcess
GlobalAlloc
GlobalLock
GlobalUnlock
CreateEventW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetCurrentProcess
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetVersionExW
CreateDirectoryW
ReadConsoleW
SetFilePointerEx
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
IsValidLocale
GetFileType
GetACP
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
RtlUnwind
GetStringTypeExA
GetUserDefaultLCID
LCMapStringA
LoadLibraryA
FreeLibrary
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
TerminateProcess
OpenProcess
GetCurrentThreadId
GetDateFormatA
GetTimeFormatA
GetTickCount
GetFileAttributesA
Sleep
DeleteFileW
CloseHandle
GetModuleFileNameW
GetStringTypeW
GetLocaleInfoW
LCMapStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
WideCharToMultiByte
FindResourceExW
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetProcessHeap
GetEnvironmentVariableA
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
FindFirstFileExW
HeapFree

user32

SetCapture
LoadStringA
UnregisterClassW
IsWindow
MoveWindow
SendMessageW
ShowWindow
DestroyWindow
GetActiveWindow
GetDesktopWindow
IsWindowEnabled
EnableWindow
SetWindowPos
MapWindowPoints
GetClientRect
GetParent
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SetActiveWindow
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
GetDC
ReleaseDC
KillTimer
SetTimer
SetWindowTextW
DefWindowProcW
LoadIconW
PostThreadMessageW
CallWindowProcW
ScreenToClient
UpdateLayeredWindow
GetKeyState
GetFocus
SetFocus
SetCursor
PostMessageW
ClientToScreen
OffsetRect
NotifyWinEvent
PtInRect
InvalidateRect
GetWindowTextW
GetWindowTextLengthW
ReleaseCapture
GetDlgItem

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
LookupPrivilegeValueW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CreateStreamOnHGlobal

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHChangeNotify
ShellExecuteW

oleaut32

VariantInit
SysAllocString

shlwapi

PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW
StrCmpW
StrToIntA

gdi32

CreateRectRgnIndirect
BitBlt
SetStretchBltMode
StretchBlt
CreateFontW
CombineRgn
CreateSolidBrush
SetTextColor
GetDeviceCaps
DeleteObject
DeleteDC
SelectClipRgn
CreateCompatibleDC
CreateDIBSection
GetObjectW
SetBkMode
SelectObject
RectInRegion

comctl32

_TrackMouseEvent

gdiplus

GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipGetImageWidth
GdipGetImageHeight
GdiplusStartup
GdipCreateFromHDC
GdipDeleteGraphics
GdipLoadImageFromStream
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipCreateImageAttributes
GdipResetClip
GdipSetClipHrgn
GdipDrawString
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDrawRectangleI
GdipDeletePen
GdipCreatePen1
GdipFillRectangleI
GdipDeleteBrush
GdipCreateSolidFill
GdipSetImageAttributesWrapMode
GdipDrawImageRectRectI
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipImageGetFrameCount

psapi

GetModuleFileNameExW
EnumProcesses

oleacc

LresultFromObject

Sections

.text
Size: 458KB - Virtual size: 458KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

443ebbe57915aebb0bb5c0f08d034429

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

comctl32

gdiplus

psapi

oleacc

Sections

.text Size: 458KB - Virtual size: 458KB

.rdata Size: 125KB - Virtual size: 125KB

.data Size: 13KB - Virtual size: 17KB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 458KB - Virtual size: 458KB

.rdata
Size: 125KB - Virtual size: 125KB

.data
Size: 13KB - Virtual size: 17KB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 29KB - Virtual size: 29KB