QBFree[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

QBFree.exe
Size

1.4MB
MD5

eeedc36ca1875b1bcfe7309a0628875f
SHA1

4107605972f169f8e7784e40679f213d3b933cdc
SHA256

98b1344f6dbf7a672a3a29bcbacdf11084c2ffc446d5681d9bb2ebc1df1d7511
SHA512

9d544364e6def747ea6b279394479e9663022f149d98558e405b4ee76de7c0b011b9a0b1456e0469e00f427d20426667f2262328cf9cd8ec19cda2a3c06fd7f0
SSDEEP

24576:fmSi43BHOXYzhUP+xRvShY7q0b95ilJAIINvpJKZ7QR3qC5:a2zeWKafb95XpIlC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
QBFree.exe

Files

QBFree.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

oQMAgzVg
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Xerin
Size: 512B - Virtual size: 141B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ