fcc84f352ecda9eba04d53a19254ba33cdba4a56d17944bedce235930172ee70

Sharing

Copy URL Twitter E-mail

General

Target

fcc84f352ecda9eba04d53a19254ba33cdba4a56d17944bedce235930172ee70
Size

661KB
MD5

5d873c188bc5c5e9b528b23e2da8399d
SHA1

9bcd9a3d5eceb0e692167a5438b7eb825718e50d
SHA256

fcc84f352ecda9eba04d53a19254ba33cdba4a56d17944bedce235930172ee70
SHA512

3bb51dab76b45bfb5cc6a5c83d0b22ee19c3a79d150307584dcaaeb0c637a1b4ef56a8bb108404e009d837052cbc3463a42556cb633597472feafe4335b892af
SSDEEP

6144:0nR/aeao7/7Ijo0n/nRypK+/2kJ7zagZmDhdtt5ymJW2G8k39Vfjcm/wKwHtgIwx:0VTqmF2Yu9Ht5yztGmoHwxWRFIcVg1F

Score

1^/10

Malware Config

Signatures

Files

fcc84f352ecda9eba04d53a19254ba33cdba4a56d17944bedce235930172ee70
.exe windows:6 windows x64 arch:x64

4a67ffbbeae36da3c50814bbb952b47a

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:cc:cd:c5:6f:ff:27:ff:a2:7d:ba:5f:30:e7:ab:ce
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

23/08/2023, 00:00

Not After

22/08/2024, 23:59

Subject

CN=Autodesk\, Inc.,O=Autodesk\, Inc.,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:08:30:35:95:86:82:57:ba:57:a6:13:34:ac:9a:c7:28:43:bd:63:b9:24:5e:ab:33:23:93:85:18:25:7c:45
Signer

Actual PE Digest

13:08:30:35:95:86:82:57:ba:57:a6:13:34:ac:9a:c7:28:43:bd:63:b9:24:5e:ab:33:23:93:85:18:25:7c:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Z:\qt\qtbase\bin\QtWebEngineProcess.pdb

Imports

kernel32

SetUnhandledExceptionFilter
QueryDosDeviceW
GetLongPathNameW
GetFileAttributesW
SetCurrentDirectoryW
RtlCaptureStackBackTrace
FormatMessageA
GetLocalTime
OutputDebugStringA
GetCurrentDirectoryW
GetModuleHandleExW
QueryThreadCycleTime
UnmapViewOfFile
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
RtlVirtualUnwind
RtlLookupFunctionEntry
TlsGetValue
WideCharToMultiByte
SleepConditionVariableSRW
WakeConditionVariable
InitializeConditionVariable
AcquireSRWLockExclusive
CreateNamedPipeW
WriteFile
GetCommandLineW
GetProcessHeaps
SetThreadAffinityMask
VirtualFree
GetCurrentProcessorNumber
HeapSetInformation
GetThreadId
TlsFree
TlsAlloc
GetThreadPriority
SetThreadPriority
GetCurrentThread
Sleep
RaiseException
IsDebuggerPresent
TlsSetValue
SetHandleInformation
GetFileType
FreeLibrary
AssignProcessToJobObject
MapViewOfFile
CreateFileMappingW
WriteProcessMemory
ReadProcessMemory
CreateFileW
LocalFree
LoadLibraryW
GetModuleHandleA
IsWow64Process
GetProductInfo
GetNativeSystemInfo
GetVersionExW
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
LoadLibraryExW
UnregisterWaitEx
ExpandEnvironmentStringsW
GetProcAddress
GetModuleHandleW
VirtualAlloc
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnumSystemLocalesEx
GetUserDefaultLocaleName
GetUserDefaultLCID
GetUserDefaultLangID
GetTickCount
HeapDestroy
TerminateProcess
UnregisterWait
RegisterWaitForSingleObject
SetInformationJobObject
TerminateJobObject
GetCurrentThreadId
CreateThread
GetCurrentProcess
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
DuplicateHandle
SetLastError
CreateMutexW
CloseHandle
GetProcessHandleCount
VirtualAllocEx
VirtualProtectEx
VirtualFreeEx
CreateJobObjectW
QueryInformationJobObject
GetSystemInfo
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
InitOnceExecuteOnce
DebugBreak
lstrlenW
CreateRemoteThread
GetLogicalProcessorInformation
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObjectEx
RtlCaptureContext
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
GetModuleFileNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetCurrentProcessId
GetLastError

qt6webenginecore

?staticSandboxInterfaceInfo@QtWebEngineSandbox@@YAPEAUSandboxInterfaceInfo@sandbox@@PEAU23@@Z
?processMain@QtWebEngineCore@@YAHHPEAPEBD@Z
?qWebEngineChromiumVersion@@YAPEBDXZ
?qWebEngineVersion@@YAPEBDXZ

qt6core

?Windows8_1@QOperatingSystemVersion@@2V1@B
?current@QOperatingSystemVersion@@SA?AV1@XZ
?compare@QOperatingSystemVersionBase@@KAHV1@0@Z
?setFileName@QLibrary@@QEAAXAEBVQString@@@Z
?load@QLibrary@@QEAA_NXZ
?resolve@QLibrary@@QEAAP6AXXZPEBD@Z
??0QMessageLogger@@QEAA@PEBDH0@Z
?info@QMessageLogger@@QEBAXPEBDZZ
??1QByteArray@@QEAA@XZ
?constData@QByteArray@@QEBAPEBDXZ
??0QLibrary@@QEAA@PEAVQObject@@@Z
?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ
??0QCoreApplication@@QEAA@AEAHPEAPEADH@Z
??1QCoreApplication@@UEAA@XZ
?applicationName@QCoreApplication@@SA?AVQString@@XZ
?warning@QMessageLogger@@QEBAXPEBDZZ
?qErrnoWarning@@YAXHPEBDZZ
?deallocate@QArrayData@@SAXPEAU1@_J1@Z
??1QString@@QEAA@XZ
??0QString@@QEAA@$$QEAU?$QArrayDataPointer@_S@@@Z
??1QLibrary@@UEAA@XZ

msvcp140

_Thrd_yield
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Xtime_get_ticks
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

vcruntime140

memset
memcpy
_purecall
memcmp
memmove
__C_specific_handler
memchr
strrchr
strstr
strchr
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
_callnewh
realloc
malloc

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_configure_narrow_argv
terminate
_initialize_narrow_environment
_crt_atexit
abort
_errno
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_exit
_invoke_watson
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

round
ceilf
exp
log
floor
ceil
__setusermatherr
_dclass

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
_write
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf
__stdio_common_vsscanf
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

isxdigit
_wcsdup
wcscmp
_wcsnicmp
_strdup
_wcsicmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

advapi32

GetSidSubAuthority
GetLengthSid
EqualSid
CreateWellKnownSid
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDisablePredefinedCache
RegCloseKey
RevertToSelf
IsValidSid
ConvertSidToStringSidW
ConvertStringSidToSidW
SetEntriesInAclW
GetNamedSecurityInfoW
SetSecurityInfo
BuildTrusteeWithSidW
CreateProcessAsUserW
SetThreadToken
OpenProcessToken
DuplicateToken
GetTokenInformation
AccessCheck
DuplicateTokenEx
GetAce
GetKernelObjectSecurity
GetSecurityDescriptorSacl
MapGenericMask
SetKernelObjectSecurity
SetTokenInformation
InitializeAcl
EventRegister
EventUnregister
EventWrite
AddMandatoryAce
GetSecurityInfo
GetSecurityDescriptorDacl
SystemFunction036
FreeSid
ImpersonateLoggedOnUser
AdjustTokenPrivileges
CreateRestrictedToken
LookupPrivilegeValueW
InitializeSid

shell32

CommandLineToArgvW

user32

CreateWindowStationW
SetProcessWindowStation
GetProcessWindowStation
CreateDesktopW
CloseDesktop
CloseWindowStation
GetThreadDesktop
GetUserObjectInformationW

winmm

timeGetTime

ole32

CoTaskMemFree

Exports

Exports

GetHandleVerifier
IsSandboxedProcess
TargetCreateNamedPipeW
TargetCreateNamedPipeW64
TargetCreateThread
TargetCreateThread64
TargetGdiDllInitialize
TargetGdiDllInitialize64
TargetGetStockObject
TargetGetStockObject64
TargetNtCreateFile
TargetNtCreateFile64
TargetNtCreateSection
TargetNtCreateSection64
TargetNtMapViewOfSection
TargetNtMapViewOfSection64
TargetNtOpenFile
TargetNtOpenFile64
TargetNtOpenProcess
TargetNtOpenProcess64
TargetNtOpenProcessToken
TargetNtOpenProcessToken64
TargetNtOpenProcessTokenEx
TargetNtOpenProcessTokenEx64
TargetNtOpenThread
TargetNtOpenThread64
TargetNtOpenThreadToken
TargetNtOpenThreadToken64
TargetNtOpenThreadTokenEx
TargetNtOpenThreadTokenEx64
TargetNtQueryAttributesFile
TargetNtQueryAttributesFile64
TargetNtQueryFullAttributesFile
TargetNtQueryFullAttributesFile64
TargetNtSetInformationFile
TargetNtSetInformationFile64
TargetNtSetInformationThread
TargetNtSetInformationThread64
TargetNtUnmapViewOfSection
TargetNtUnmapViewOfSection64
TargetRegisterClassW
TargetRegisterClassW64
g_current_mitigations
g_handles_to_close
g_interceptions
g_nt
g_originals
g_sentinel_value_end
g_sentinel_value_start
g_shared_IPC_size
g_shared_delayed_integrity_level
g_shared_delayed_mitigations
g_shared_policy_size
g_shared_section
g_shared_startup_mitigations

Sections

.text
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a67ffbbeae36da3c50814bbb952b47a

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

02:cc:cd:c5:6f:ff:27:ff:a2:7d:ba:5f:30:e7:ab:ceCertificate

Extended Key Usages

Key Usages

13:08:30:35:95:86:82:57:ba:57:a6:13:34:ac:9a:c7:28:43:bd:63:b9:24:5e:ab:33:23:93:85:18:25:7c:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

qt6webenginecore

qt6core

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

shell32

user32

winmm

ole32

Exports

Exports

Sections

.text Size: 514KB - Virtual size: 514KB

.rdata Size: 97KB - Virtual size: 96KB

.data Size: 6KB - Virtual size: 29KB

.pdata Size: 27KB - Virtual size: 27KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

02:cc:cd:c5:6f:ff:27:ff:a2:7d:ba:5f:30:e7:ab:ce
Certificate

13:08:30:35:95:86:82:57:ba:57:a6:13:34:ac:9a:c7:28:43:bd:63:b9:24:5e:ab:33:23:93:85:18:25:7c:45
Signer

.text
Size: 514KB - Virtual size: 514KB

.rdata
Size: 97KB - Virtual size: 96KB

.data
Size: 6KB - Virtual size: 29KB

.pdata
Size: 27KB - Virtual size: 27KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB