14d6d569e7c2406d4e2a7dab5b88c9190b68a0664af97190f4915b11a7bdd5b7

Sharing

Copy URL Twitter E-mail

General

Target

14d6d569e7c2406d4e2a7dab5b88c9190b68a0664af97190f4915b11a7bdd5b7
Size

3.6MB
MD5

b767fdffa97fef267e1abb34c17e5efc
SHA1

5af3cbfa6da32a22b250c3db6507599e6c1f350c
SHA256

14d6d569e7c2406d4e2a7dab5b88c9190b68a0664af97190f4915b11a7bdd5b7
SHA512

f46845c65969eb14329dba94ec957be9ec89048829e0cb7f196e3501e5e8b7de899a1d5fc3a6f040529d8ce9358243fa32f07dd5d7ab7bcfd9cb376c61c47b76
SSDEEP

49152:O3eXuXwuqncFt1FjxaTPNdMcorYZnEXL6sLTzj/Tqh6qxX/E2srHqGXG6K+FwCMk:OuwqncFZdaz1xa76sLT3EsrHqm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14d6d569e7c2406d4e2a7dab5b88c9190b68a0664af97190f4915b11a7bdd5b7

Files

14d6d569e7c2406d4e2a7dab5b88c9190b68a0664af97190f4915b11a7bdd5b7
.exe windows:5 windows x86 arch:x86

646ec2728cada0a83938fc783dbb50e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins\workspace\pc-qncleaner-build\QNCleaner\Bin\Win32\Release_Static\QnCleaner.pdb

Imports

kernel32

GetComputerNameW
SetEndOfFile
DeleteFileW
GlobalMemoryStatusEx
SetLastError
InterlockedExchangeAdd
GetPrivateProfileStringW
ExpandEnvironmentStringsW
GetCurrentProcess
GetEnvironmentVariableW
GlobalFree
FlushFileBuffers
FormatMessageA
LockFileEx
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapReAlloc
DeleteFileA
GetVersionExA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA
HeapCreate
AreFileApisANSI
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
VirtualQueryEx
OpenThread
CreateSemaphoreW
CreateThread
TerminateThread
SuspendThread
GetProcessId
ReleaseSemaphore
RtlCaptureContext
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
TlsSetValue
GetModuleHandleExW
IsProcessorFeaturePresent
EncodePointer
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
GetFileSizeEx
LoadLibraryA
DeviceIoControl
MoveFileW
GetTempFileNameW
MoveFileExW
GetWindowsDirectoryW
SetFileAttributesW
GetTempPathW
RemoveDirectoryW
GetFullPathNameW
GetSystemTime
FindClose
FindNextFileW
TerminateProcess
LoadLibraryExW
QueryDosDeviceW
GetProcessHeap
HeapAlloc
HeapFree
GetLogicalDriveStringsW
GetDiskFreeSpaceW
GetVolumeInformationW
ReleaseMutex
GetExitCodeProcess
CreateProcessW
InitializeCriticalSection
ResumeThread
GetFileTime
SearchPathW
GetSystemInfo
lstrcatW
GetFileAttributesExW
GetLongPathNameW
FindFirstFileW
GetFileType
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
TlsFree
TlsGetValue
TlsAlloc
GetStringTypeW
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
TryEnterCriticalSection
ResetEvent
LeaveCriticalSection
EnterCriticalSection
InterlockedCompareExchange
InterlockedExchange
OpenFileMappingW
MapViewOfFile
SetEvent
CreateEventW
UnmapViewOfFile
OpenMutexW
GetVersionExW
CreateFileMappingW
FreeLibrary
FileTimeToSystemTime
GetDriveTypeW
GetSystemDirectoryW
VirtualQuery
lstrcpyW
InterlockedDecrement
InterlockedIncrement
lstrcpynW
lstrcmpiW
GlobalAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
FormatMessageW
LocalFree
GetFileAttributesW
CreateDirectoryW
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFilePointer
WriteFile
VerifyVersionInfoW
MulDiv
GetCurrentProcessId
OpenProcess
VerSetConditionMask
MultiByteToWideChar
GetACP
ExitProcess
FindResourceW
GetExitCodeThread
SizeofResource
LoadResource
LockResource
FreeResource
WideCharToMultiByte
CreateFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
lstrlenW
ReadFile
GetFileSize
GlobalUnlock
GlobalLock
GetProcAddress
GetLocalTime
GetStdHandle
CloseHandle
CreateMutexW
GetModuleHandleA
VirtualAlloc
VirtualProtect
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetConsoleCP
WaitForMultipleObjects
GetTickCount
GetLastError
Sleep
GetCurrentThreadId
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExW
WaitForSingleObject
IsValidCodePage
GetOEMCP
GetCommandLineA
EnumResourceNamesW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW

user32

CreateIconFromResourceEx
GetClientRect
GetWindowThreadProcessId
AttachThreadInput
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
GetGUIThreadInfo
InvalidateRgn
GetIconInfo
PrivateExtractIconsW
DestroyIcon
LookupIconIdFromDirectoryEx
CreateAcceleratorTableW
DrawTextA
wsprintfA
IsWindowEnabled
GetWindowTextLengthW
SetWindowTextW
EqualRect
PostThreadMessageW
UpdateWindow
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetRect
FillRect
DrawTextW
CharPrevW
GetWindowRgn
MoveWindow
UpdateLayeredWindow
MonitorFromPoint
MessageBoxA
InflateRect
SetCursor
LoadCursorW
GetPropW
SetPropW
GetSystemMetrics
EnableWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
wsprintfW
MessageBoxW
SetWindowRgn
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetWindow
GetParent
PtInRect
IsRectEmpty
OffsetRect
UnionRect
IntersectRect
GetSysColor
MapWindowPoints
ScreenToClient
GetCursorPos
GetWindowRect
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetCapture
GetKeyState
GetFocus
GetActiveWindow
CharNextW
IsZoomed
IsIconic
IsWindowVisible
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
GetWindowLongW
FindWindowExW
PostQuitMessage
ReleaseCapture
DestroyWindow
SetWindowPos
SetTimer
SetWindowLongW
KillTimer
SetActiveWindow
EnumChildWindows
WaitForInputIdle
ShowWindow
GetForegroundWindow
SetFocus
GetClassNameW
SetForegroundWindow
GetWindowTextW
PostMessageW
SendMessageW
IsWindow

gdi32

RealizePalette
CreateDCW
GetDIBits
SelectPalette
SetBitmapBits
GetBitmapBits
GetTextExtentPointA
CreatePatternBrush
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetCharABCWidthsW
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
GetClipBox
CreatePolygonRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

AdjustTokenPrivileges
StartServiceW
ControlService
DeleteService
ChangeServiceConfig2W
OpenSCManagerW
LookupPrivilegeValueW
SetEntriesInAclW
SetNamedSecurityInfoW
OpenProcessToken
RegCreateKeyExW
AllocateAndInitializeSid
FreeSid
GetTokenInformation
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenServiceW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetDesktopFolder
SHEmptyRecycleBinW
ord727
ExtractIconExW
DragQueryFileW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
SHGetSpecialFolderLocation

ole32

CoTaskMemFree
OleInitialize
CoUninitialize
CoInitialize
OleUninitialize
CoCreateInstance
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
DoDragDrop

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipSetStringFormatTrimming
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
ord1
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipDrawPath

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

shlwapi

PathFileExistsW
PathIsNetworkPathW
StrCmpW

ws2_32

gethostname
gethostbyname
WSAStartup

wininet

InternetCheckConnectionW

Exports

Exports

??0IQncEngineDataCenter@QNC@RC@@QAE@$$QAV012@@Z
??0IQncEngineDataCenter@QNC@RC@@QAE@ABV012@@Z
??0IQncEngineDataCenter@QNC@RC@@QAE@XZ
??0IQncEngineManager@QNC@RC@@QAE@$$QAV012@@Z
??0IQncEngineManager@QNC@RC@@QAE@ABV012@@Z
??0IQncEngineManager@QNC@RC@@QAE@XZ
??0IQncEngineManagerDelegate@QNC@RC@@QAE@$$QAV012@@Z
??0IQncEngineManagerDelegate@QNC@RC@@QAE@ABV012@@Z
??0IQncEngineManagerDelegate@QNC@RC@@QAE@XZ
??4IQncEngineDataCenter@QNC@RC@@QAEAAV012@$$QAV012@@Z
??4IQncEngineDataCenter@QNC@RC@@QAEAAV012@ABV012@@Z
??4IQncEngineManager@QNC@RC@@QAEAAV012@$$QAV012@@Z
??4IQncEngineManager@QNC@RC@@QAEAAV012@ABV012@@Z
??4IQncEngineManagerDelegate@QNC@RC@@QAEAAV012@$$QAV012@@Z
??4IQncEngineManagerDelegate@QNC@RC@@QAEAAV012@ABV012@@Z
??_7IQncEngineDataCenter@QNC@RC@@6B@
??_7IQncEngineManager@QNC@RC@@6B@
??_7IQncEngineManagerDelegate@QNC@RC@@6B@
GetQncEngineDataCenterFactory
GetQncEngineManagerFactory
ReleaseQncEngineDataCenter
ReleaseQncEngineManager

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

646ec2728cada0a83938fc783dbb50e9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

imm32

shlwapi

ws2_32

wininet

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 520KB - Virtual size: 519KB

.data Size: 37KB - Virtual size: 47KB

.rsrc Size: 296KB - Virtual size: 296KB

.reloc Size: 134KB - Virtual size: 133KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 520KB - Virtual size: 519KB

.data
Size: 37KB - Virtual size: 47KB

.rsrc
Size: 296KB - Virtual size: 296KB

.reloc
Size: 134KB - Virtual size: 133KB