679e21bf923bd61054077b624664ee2c6b24860299b10ec29fa3274630da2837

Sharing

Copy URL Twitter E-mail

General

Target

679e21bf923bd61054077b624664ee2c6b24860299b10ec29fa3274630da2837
Size

284KB
MD5

1f4ae7d392951114184bdc61998a91ff
SHA1

3c1be62d032d2af977ed19094fd391882c6fbfdd
SHA256

679e21bf923bd61054077b624664ee2c6b24860299b10ec29fa3274630da2837
SHA512

5ded628de4f079e5675caf3a9f33959b565e07698d43fc8c34fffc75fe7b1b8629db338413202e060f91eae1f03366f72fb585b0a3e5e8ac94c5cca40af6568b
SSDEEP

3072:gXDVYC+wZsq+Mi5nzwivywXp1Vzfoa8Pe7q0yJyeG6thmDqOKhYD2De0Q:OJsvPwi9XhAbUXmhmDqOKaAQ

Score

1^/10

Malware Config

Signatures

Files

679e21bf923bd61054077b624664ee2c6b24860299b10ec29fa3274630da2837
.dll windows:5 windows x86 arch:x86

0dd5bcf7a4b8b94a40f75ab63ececbbd

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:e5:5c:53:f7:fb:1b:ff:27:e1:34:91
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

07/05/2024, 04:03

Not After

30/07/2027, 05:36

Subject

SERIALNUMBER=68411053,CN=Emodest Technology Limited,O=Emodest Technology Limited,STREET=Rm 1003 10/F Lippo Ctr Twr 1 89 Queensway\, Admiralty,L=Central and Western,ST=Hong Kong Island,C=HK,1.2.840.113549.1.9.1=#0c1161646d696e40656d6f646573742e6e6574,1.3.6.1.4.1.311.60.2.1.3=#1302484b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

19/01/2024, 16:46

Not After

01/06/2029, 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fa:71:99:76:06:a5:7f:d2:84:d0:78:cf:a4:1c:af:95:51:aa:28:34:c5:ed:87:28:d0:a8:5a:1e:8c:1b:08:dc
Signer

Actual PE Digest

fa:71:99:76:06:a5:7f:d2:84:d0:78:cf:a4:1c:af:95:51:aa:28:34:c5:ed:87:28:d0:a8:5a:1e:8c:1b:08:dc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

qtgui4

?size@QImage@@QBE?AVQSize@@XZ
?isNull@QImage@@QBE_NXZ
?setColorTable@QImage@@QAEXV?$QVector@I@@@Z
?setDotsPerMeterX@QImage@@QAEXH@Z
?setDotsPerMeterY@QImage@@QAEXH@Z
?mirrored@QImage@@QBE?AV1@_N0@Z
??0QMatrix@@QAE@XZ
?rotate@QMatrix@@QAEAAV1@N@Z
?transformed@QImage@@QBE?AV1@ABVQMatrix@@W4TransformationMode@Qt@@@Z
?dotsPerMeterX@QImage@@QBEHXZ
?dotsPerMeterY@QImage@@QBEHXZ
?logicalDpiX@QPaintDevice@@QBEHXZ
?logicalDpiY@QPaintDevice@@QBEHXZ
?colorTable@QImage@@QBE?AV?$QVector@I@@XZ
?copy@QImage@@QBE?AV1@HHHH@Z
?scanLine@QImage@@QAEPAEH@Z
?convertToFormat@QImage@@QBE?AV1@W4Format@1@V?$QFlags@W4ImageConversionFlag@Qt@@@@@Z
?setFormat@QImageIOHandler@@QBEXABVQByteArray@@@Z
??1QImageIOHandler@@UAE@XZ
?currentImageRect@QImageIOHandler@@UBE?AVQRect@@XZ
?currentImageNumber@QImageIOHandler@@UBEHXZ
?nextImageDelay@QImageIOHandler@@UBEHXZ
?imageCount@QImageIOHandler@@UBEHXZ
?loopCount@QImageIOHandler@@UBEHXZ
?jumpToImage@QImageIOHandler@@UAE_NH@Z
?jumpToNextImage@QImageIOHandler@@UAE_NXZ
??0QImageIOHandler@@QAE@XZ
?height@QImage@@QBEHXZ
?width@QImage@@QBEHXZ
?format@QImage@@QBE?AW4Format@1@XZ
??0QImage@@QAE@HHW4Format@0@@Z
?bits@QImage@@QAEPAEXZ
??4QImage@@QAEAAV0@ABV0@@Z
??1QImage@@UAE@XZ
?device@QImageIOHandler@@QBEPAVQIODevice@@XZ
??1QImageIOPlugin@@UAE@XZ
?qt_metacall@QImageIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QImageIOPlugin@@UAEPAXPBD@Z
?metaObject@QImageIOPlugin@@UBEPBUQMetaObject@@XZ
??0QImageIOPlugin@@QAE@PAVQObject@@@Z
?setDevice@QImageIOHandler@@QAEXPAVQIODevice@@@Z
?setFormat@QImageIOHandler@@QAEXABVQByteArray@@@Z

qtcore4

?free@QVectorData@@SAXPAU1@H@Z
?qBadAlloc@@YAXXZ
?allocate@QVectorData@@SAPAU1@HH@Z
?qMemSet@@YAPAXPAXHI@Z
?reallocate@QVectorData@@SAPAU1@PAU1@HHH@Z
?qMalloc@@YAPAXI@Z
inflateInit_
inflateReset
inflateSync
inflate
deflateInit_
deflateReset
deflate
deflateEnd
inflateEnd
deflateParams
?type@QVariant@@QBE?AW4Type@1@XZ
?toInt@QVariant@@QBEHPA_N@Z
??0QVariant@@QAE@ABVQSize@@@Z
??0QVariant@@QAE@H@Z
??0QVariant@@QAE@XZ
??0QByteArray@@QAE@PBD@Z
?qWarning@@YAXPBDZZ
?peek@QIODevice@@QAE?AVQByteArray@@_J@Z
?fromRawData@QByteArray@@SA?AV1@PBDH@Z
??1QByteArray@@QAE@XZ
?write@QIODevice@@QAE_JPBD_J@Z
?read@QIODevice@@QAE_JPAD_J@Z
?append@QListData@@QAEPAPAXXZ
??1QString@@QAE@XZ
?detach3@QListData@@QAEPAUData@1@XZ
?qFree@@YAXPAX@Z
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
?free@QString@@CAXPAUData@1@@Z
??0QString@@QAE@ABV0@@Z
?changeGuard@QMetaObject@@SAXPAPAVQObject@@PAV2@@Z
?removeGuard@QMetaObject@@SAXPAPAVQObject@@@Z
?shared_null@QListData@@2UData@1@A
?disconnectNotify@QObject@@MAEXPBD@Z
?connectNotify@QObject@@MAEXPBD@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?qstrcmp@@YAHABVQByteArray@@PBD@Z
?fromLatin1_helper@QString@@CAPAUData@1@PBDH@Z

msvcr90

__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__iob_func
vfprintf
_CIatan2
_CIsqrt
_CIlog
rand
_CIexp
memset
sprintf
_malloc_crt
bsearch
fprintf
_wassert
qsort
strncmp
_CIpow
floor
memcpy
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z

kernel32

InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
GlobalSize
GlobalFree
GlobalAlloc

Exports

Exports

qt_plugin_instance
qt_plugin_query_verification_data

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0dd5bcf7a4b8b94a40f75ab63ececbbd

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

17:e5:5c:53:f7:fb:1b:ff:27:e1:34:91Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04Certificate

Extended Key Usages

Key Usages

fa:71:99:76:06:a5:7f:d2:84:d0:78:cf:a4:1c:af:95:51:aa:28:34:c5:ed:87:28:d0:a8:5a:1e:8c:1b:08:dcSigner

Headers

File Characteristics

Imports

qtgui4

qtcore4

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 130KB - Virtual size: 130KB

.rdata Size: 129KB - Virtual size: 128KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

17:e5:5c:53:f7:fb:1b:ff:27:e1:34:91
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

fa:71:99:76:06:a5:7f:d2:84:d0:78:cf:a4:1c:af:95:51:aa:28:34:c5:ed:87:28:d0:a8:5a:1e:8c:1b:08:dc
Signer

.text
Size: 130KB - Virtual size: 130KB

.rdata
Size: 129KB - Virtual size: 128KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB