3aee8d69466629b645d33fbb9917ec7789b9f57d7e19e6717f4e89550a634fa0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3aee8d69466629b645d33fbb9917ec7789b9f57d7e19e6717f4e89550a634fa0.exe
Size

750KB
MD5

40cf0c706b556f297cf55f693f790250
SHA1

7b0235f5715bc3b46bdc72cd67324e65b033667a
SHA256

3aee8d69466629b645d33fbb9917ec7789b9f57d7e19e6717f4e89550a634fa0
SHA512

de5c615d34c35392a7fbc6493a7a25b9e993fa03277415c7518a719ad413b60c5babc89853c42b2bab70f4dd9843591df368a01129c3608b8ef16e65af73d79d
SSDEEP

12288:GEhdSSdQLAhYG9cD+dowAWHnMGYjWMs//zjy7VWs26dvDhxqiH6su/aDdw4pwFnU:phdSSdQLAhGeowVHGjWMsnm/9xgsuaeS

Score

1^/10

Malware Config

Signatures

Files

3aee8d69466629b645d33fbb9917ec7789b9f57d7e19e6717f4e89550a634fa0.exe
.exe windows:6 windows x86 arch:x86

b061a6adfe8135e3446a57172882bfe0

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/10/2022, 00:00

Not After

17/10/2025, 23:59

Subject

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:c2:07:4d:32:54:df:19:22:ac:b4:a6:19:42:f3:71:41:78:f2:3a:2d:bc:e5:69:46:2e:70:10:b7:5c:17:39
Signer

Actual PE Digest

4c:c2:07:4d:32:54:df:19:22:ac:b4:a6:19:42:f3:71:41:78:f2:3a:2d:bc:e5:69:46:2e:70:10:b7:5c:17:39

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMDL.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

htonl
WSAStartup
gethostbyname
inet_ntoa
WSACleanup
htons
ntohl
ntohs

kernel32

IsBadReadPtr
FreeLibrary
TerminateProcess
LoadLibraryExW
IsDebuggerPresent
GetCurrentProcess
CreateMutexW
GetTickCount64
OpenProcess
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
RaiseException
AreFileApisANSI
ReadFile
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetVersionExW
UnmapViewOfFile
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
CreateFileA
LoadLibraryA
DeleteFileA
DeleteFileW
GetSystemInfo
UnlockFile
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
GetSystemTimeAsFileTime
WaitForSingleObject
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
lstrcpynW
GetCurrentThreadId
SetErrorMode
SearchPathW
SetUnhandledExceptionFilter
WriteProcessMemory
GetModuleFileNameW
GetCommandLineW
SwitchToThread
GetModuleHandleExW
UnhandledExceptionFilter
ProcessIdToSessionId
lstrlenW
MapViewOfFileEx
GetSystemDefaultLangID
GetNativeSystemInfo
VirtualQuery
GetSystemPowerStatus
lstrcmpiW
GetFileAttributesW
FlushFileBuffers
CreateProcessW
GetTickCount
FindResourceW
FindResourceExW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetLastError
SetLastError
Sleep
GetModuleHandleW
GetProcAddress
LoadLibraryW
WideCharToMultiByte
WaitForMultipleObjects
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
TerminateThread
OpenMutexW
SetEvent
CreateEventW
CloseHandle
GetSystemTime

user32

DestroyWindow
DefWindowProcW
GetWindowLongW
CreateWindowExW
IsWindow
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW
KillTimer
PostQuitMessage
SetTimer
SetWindowLongW
RegisterClassExW

advapi32

RegNotifyChangeKeyValue
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegFlushKey
RegEnumKeyExW
RegEnumValueW
RegGetKeySecurity
RegSetKeySecurity
RegQueryInfoKeyW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

ole32

CLSIDFromProgID
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysFreeString

shlwapi

PathAppendW
PathAddBackslashW
StrStrIW
SHGetValueW
PathFileExistsW
PathRemoveFileSpecW
wnsprintfW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

imm32

ImmDisableIME

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo

vcruntime140

memchr
_set_purecall_handler
memcpy
memmove
wcsstr
wcschr
memset
_except_handler4_common
__current_exception
__current_exception_context
_CxxThrowException
wcsrchr
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
_purecall

api-ms-win-crt-runtime-l1-1-0

_initterm
_invalid_parameter_noinfo_noreturn
_initterm_e
_crt_atexit
set_terminate
_set_invalid_parameter_handler
_invalid_parameter_noinfo
_get_wide_winmain_command_line
_errno
_beginthreadex
_initialize_wide_environment
_controlfp_s
_configure_wide_argv
_exit
_set_app_type
_seh_filter_exe
terminate
_cexit
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_register_onexit_function
exit

api-ms-win-crt-time-l1-1-0

_difftime64
_time64
_localtime64_s

api-ms-win-crt-string-l1-1-0

wcsnlen
_wcsnicmp
wcscpy_s
wcsncpy_s
_wcsicmp
wmemcpy_s
strncmp
wcsncmp
strncpy_s

api-ms-win-crt-convert-l1-1-0

_ultow_s
_wtol
_wtoi

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__p__commode
_set_fmode
__stdio_common_vswscanf
__stdio_common_vsnwprintf_s

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
malloc
realloc
free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 589KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b061a6adfe8135e3446a57172882bfe0

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fcCertificate

Extended Key Usages

Key Usages

4c:c2:07:4d:32:54:df:19:22:ac:b4:a6:19:42:f3:71:41:78:f2:3a:2d:bc:e5:69:46:2e:70:10:b7:5c:17:39Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp140

imm32

psapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 589KB - Virtual size: 588KB

.rdata Size: 85KB - Virtual size: 84KB

.data Size: 17KB - Virtual size: 21KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 20KB - Virtual size: 20KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Certificate

4c:c2:07:4d:32:54:df:19:22:ac:b4:a6:19:42:f3:71:41:78:f2:3a:2d:bc:e5:69:46:2e:70:10:b7:5c:17:39
Signer

.text
Size: 589KB - Virtual size: 588KB

.rdata
Size: 85KB - Virtual size: 84KB

.data
Size: 17KB - Virtual size: 21KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 20KB - Virtual size: 20KB