03a58bdfeb4f30c6ce806d682f9c72c0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

03a58bdfeb4f30c6ce806d682f9c72c0N.exe
Size

363KB
MD5

03a58bdfeb4f30c6ce806d682f9c72c0
SHA1

e18b13282cddfb8a4f3ad4d6365ec6720906b7c3
SHA256

86110f1e8832a1fd9f3a85e8e036b69ee5447108ef33ae7284c8791e76f116b5
SHA512

e9c91a808b950136eacbd98747a31bdb444de51650e763df15ce6940db88b66d99a5361656b9a39e841fe042cdbde76b08fe364b46b2972b645487e5a6fcfdb5
SSDEEP

6144:nn8bTIvkAQTecZEWG/lO7T1tgRVvOZm1JoUh8mFqs3gO7pxWCVxsHxZ7iXQ33d2q:nnn8G/lOToVvOZm0Y8mtWCyT7iX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03a58bdfeb4f30c6ce806d682f9c72c0N.exe

Files

03a58bdfeb4f30c6ce806d682f9c72c0N.exe
.exe windows:4 windows x86 arch:x86

855317929dac1e56410214000af8c5f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

pnfhidctl

PHCGetFirmReceive

libusb-1.0

libusb_exit
libusb_get_device_list
libusb_get_device_descriptor
libusb_free_device_list
libusb_init

wbapi

WBGetPowerDownMode
WBSetPowerDownMode
WBClosePort
WBSetLEDColorMode
WBGetDeviceInfo
WBFindPort
WBOpenPort
WBGetHardwareInfo

qt5core

_Z13qErrnoWarningPKcz
_Z13qErrnoWarningiPKcz
_Z15qt_error_stringi
_Z17qt_message_output9QtMsgTypeRK18QMessageLogContextRK7QString
_Z4endlR11QTextStream
_Z7qstrcmpRK10QByteArrayPKc
_Z9qBadAllocv
_Z9qChecksumPKcj
_ZN10QArrayData10deallocateEPS_jj
_ZN10QArrayData11shared_nullE
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE
_ZN10QByteArray11reallocDataEj6QFlagsIN10QArrayData16AllocationOptionEE
_ZN10QByteArray6resizeEi
_ZN10QSemaphore10tryAcquireEii
_ZN10QSemaphore7acquireEi
_ZN10QSemaphore7releaseEi
_ZN10QSemaphoreC1Ei
_ZN10QSemaphoreD1Ev
_ZN11QDataStream10writeBytesEPKcj
_ZN11QDataStream11readRawDataEPci
_ZN11QDataStreamC1EP9QIODevice
_ZN11QDataStreamD1Ev
_ZN11QDataStreamrsERi
_ZN11QFileDevice12readLineDataEPcx
_ZN11QFileDevice4seekEx
_ZN11QFileDevice5closeEv
_ZN11QFileDevice8readDataEPcx
_ZN11QFileDevice9writeDataEPKcx
_ZN11QMetaObject10ConnectionD1Ev
_ZN11QMetaObject8activateEP7QObjectPKS_iPPv
_ZN11QTextStreamD1Ev
_ZN11QTextStreamlsEPKc
_ZN11QTextStreamlsERK7QString
_ZN11QTextStreamlsEc
_ZN11QTextStreamlsEd
_ZN11QTextStreamlsEi
_ZN11QTextStreamlsEm
_ZN11QTextStreamlsEt
_ZN14QWaitCondition4waitEP6QMutexm
_ZN14QWaitCondition7wakeAllEv
_ZN14QWaitConditionC1Ev
_ZN14QWaitConditionD1Ev
_ZN16QCoreApplication11qt_metacallEN11QMetaObject4CallEiPPv
_ZN16QCoreApplication11qt_metacastEPKc
_ZN16QCoreApplication13compressEventEP6QEventP7QObjectP14QPostEventList
_ZN16QCoreApplication16staticMetaObjectE
_ZN16QCoreApplication18applicationDirPathEv
_ZN16QCoreApplication18setApplicationNameERK7QString
_ZN16QCoreApplication19applicationFilePathEv
_ZN16QCoreApplication19setOrganizationNameERK7QString
_ZN16QCoreApplication21setOrganizationDomainERK7QString
_ZN16QCoreApplication4execEv
_ZN16QCoreApplication4exitEi
_ZN16QCoreApplication4quitEv
_ZN16QCoreApplication4selfE
_ZN16QCoreApplication5eventEP6QEvent
_ZN16QCoreApplication6notifyEP7QObjectP6QEvent
_ZN16QCoreApplication9postEventEP7QObjectP6QEventi
_ZN16QCoreApplicationC2ERiPPci
_ZN16QCoreApplicationD2Ev
_ZN24QAbstractEventDispatcher24installNativeEventFilterEP26QAbstractNativeEventFilter
_ZN24QAbstractEventDispatcher8instanceEP7QThread
_ZN26QAbstractNativeEventFilterC2Ev
_ZN26QAbstractNativeEventFilterD2Ev
_ZN4QDir11currentPathEv
_ZN4QDir8tempPathEv
_ZN4QDirC1ERK7QString
_ZN4QDirD1Ev
_ZN5QFile11qt_metacallEN11QMetaObject4CallEiPPv
_ZN5QFile11qt_metacastEPKc
_ZN5QFile11setFileNameERK7QString
_ZN5QFile14setPermissionsE6QFlagsIN11QFileDevice10PermissionEE
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN5QFile6resizeEx
_ZN5QFileC2ERK7QString
_ZN5QFileC2Ev
_ZN5QFileD2Ev
_ZN5QTime11currentTimeEv
_ZN5QTime5startEv
_ZN6QEventC1ENS_4TypeE
_ZN6QMutex4lockEv
_ZN6QMutex6unlockEv
_ZN6QMutexC1ENS_13RecursionModeE
_ZN6QMutexD1Ev
_ZN6QTimer10singleShotEiPK7QObjectPKc
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject11qt_metacallEN11QMetaObject4CallEiPPv
_ZN7QObject11qt_metacastEPKc
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject16staticMetaObjectE
_ZN7QObject5eventEP6QEvent
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE
_ZN7QObjectC2EPS_
_ZN7QObjectD2Ev
_ZN7QRegExpC1ERK7QStringN2Qt15CaseSensitivityENS_13PatternSyntaxE
_ZN7QRegExpD1Ev
_ZN7QString11reallocDataEjb
_ZN7QString15fromUtf8_helperEPKci
_ZN7QString16fromAscii_helperEPKci
_ZN7QString17fromLatin1_helperEPKci
_ZN7QString20fromLocal8Bit_helperEPKci
_ZN7QString6appendERKS_
_ZN7QString6insertEi13QLatin1String
_ZN7QString6numberEii
_ZN7QString6numberEmi
_ZN7QString7replaceE5QCharS0_N2Qt15CaseSensitivityE
_ZN7QString7replaceERK7QRegExpRKS_
_ZN7QString7replaceERKS_S1_N2Qt15CaseSensitivityE
_ZN7QString7sprintfEPKcz
_ZN7QString8truncateEi
_ZN7QString9fromUtf16EPKti
_ZN7QStringC1E5QChar
_ZN7QStringaSERKS_
_ZN7QThread11qt_metacallEN11QMetaObject4CallEiPPv
_ZN7QThread11qt_metacastEPKc
_ZN7QThread16staticMetaObjectE
_ZN7QThread4waitEm
_ZN7QThread5eventEP6QEvent
_ZN7QThread5startENS_8PriorityE
_ZN7QThread6msleepEm
_ZN7QThreadC2EP7QObject
_ZN7QThreadD2Ev
_ZN8QLibrary7resolveEPKc
_ZN8QLibraryC1ERK7QStringP7QObject
_ZN8QLibraryD1Ev
_ZN8QProcess13startDetachedERK7QStringRK11QStringListS2_Px
_ZN8QProcess15waitForFinishedEi
_ZN8QProcess21readAllStandardOutputEv
_ZN8QProcess5startERK7QStringRK11QStringList6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN8QProcess7executeERK7QStringRK11QStringList
_ZN8QProcessC1EP7QObject
_ZN8QProcessD1Ev
_ZN8QVariantC1EPKc
_ZN8QVariantC1ERK7QString
_ZN8QVariantC1Eb
_ZN8QVariantC1Ei
_ZN8QVariantD1Ev
_ZN9QFileInfoC1ERK5QFile
_ZN9QFileInfoD1Ev
_ZN9QIODevice16waitForReadyReadEi
_ZN9QIODevice19waitForBytesWrittenEi
_ZN9QIODevice4readEPcx
_ZN9QIODevice4readEx
_ZN9QIODevice5resetEv
_ZN9QIODevice5writeEPKcx
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData6removeEi
_ZN9QListData7disposeEPNS_4DataE
_ZN9QListData7reallocEi
_ZN9QSettings16setDefaultFormatENS_6FormatE
_ZN9QSettings4syncEv
_ZN9QSettings8setValueERK7QStringRK8QVariant
_ZN9QSettingsC1ENS_5ScopeERK7QStringS3_P7QObject
_ZN9QSettingsC1EP7QObject
_ZN9QSettingsD1Ev
_ZN9QtPrivate20QStringList_containsEPK11QStringListRK7QStringN2Qt15CaseSensitivityE
_ZNK11QFileDevice12isSequentialEv
_ZNK11QFileDevice3posEv
_ZNK11QFileDevice5atEndEv
_ZNK11QMetaObject4castEP7QObject
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK14QMessageLogger5debugEPKcz
_ZNK14QMessageLogger5debugEv
_ZNK14QMessageLogger7warningEPKcz
_ZNK4QDir12absolutePathEv
_ZNK5QFile10metaObjectEv
_ZNK5QFile11permissionsEv
_ZNK5QFile4sizeEv
_ZNK5QFile8fileNameEv
_ZNK5QTime8toStringEN2Qt10DateFormatE
_ZNK7QObject6senderEv
_ZNK7QString10startsWithERKS_N2Qt15CaseSensitivityE
_ZNK7QString11toLocal8BitEv
_ZNK7QString3argERKS_i5QChar
_ZNK7QString3argExii5QChar
_ZNK7QString5splitERKS_NS_13SplitBehaviorEN2Qt15CaseSensitivityE
_ZNK7QString5toIntEPbi
_ZNK7QString5utf16Ev
_ZNK7QString6toUtf8Ev
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE
_ZNK7QString7indexOfERKS_iN2Qt15CaseSensitivityE
_ZNK7QString7sectionERKS_ii6QFlagsINS_11SectionFlagEE
_ZNK7QString7toLowerEv
_ZNK7QString7toUpperEv
_ZNK7QString8endsWithE13QLatin1StringN2Qt15CaseSensitivityE
_ZNK7QString8toDoubleEPb
_ZNK7QString8toLatin1Ev
_ZNK7QStringeqE13QLatin1String
_ZNK7QThread10isFinishedEv
_ZNK7QThread10metaObjectEv
_ZNK7QThread9isRunningEv
_ZNK8QVariant5toIntEPb
_ZNK8QVariant8toStringEv
_ZNK9QFileInfo16absoluteFilePathEv
_ZNK9QIODevice11canReadLineEv
_ZNK9QIODevice11errorStringEv
_ZNK9QIODevice12bytesToWriteEv
_ZNK9QIODevice14bytesAvailableEv
_ZNK9QIODevice6isOpenEv
_ZNK9QSettings5valueERK7QStringRK8QVariant
_ZNK9QSettings8containsERK7QString
_ZNK9QSettings8fileNameEv
_ZeqRK7QStringS1_
_Zls6QDebugRK7QPointF

qt5network

_ZN10QTcpServer6listenERK12QHostAddresst
_ZN10QTcpServerC1EP7QObject
_ZN10QTcpSocket16staticMetaObjectE
_ZN12QHostAddressC1ERK7QString
_ZN12QHostAddressD1Ev
_ZN12QLocalServer6listenERK7QString
_ZN12QLocalServerC1EP7QObject
_ZN12QLocalSocket15connectToServerERK7QString6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN12QLocalSocket16waitForConnectedEi
_ZN12QLocalSocket16waitForReadyReadEi
_ZN12QLocalSocket19waitForBytesWrittenEi
_ZN12QLocalSocket19waitForDisconnectedEi
_ZN12QLocalSocketC1EP7QObject
_ZN12QLocalSocketD1Ev
_ZNK12QLocalServer11errorStringEv
_ZNK15QAbstractSocket5stateEv
_ZNK15QAbstractSocket7isValidEv

advapi32

ConvertStringSidToSidW
CreateProcessAsUserW
GetLengthSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
RegCloseKey
RegEnumValueW
RegOpenKeyExW
SetTokenInformation

libgcc_s_dw2-1

_Unwind_Resume
__deregister_frame_info
__register_frame_info
__udivdi3
__umoddi3

kernel32

CloseHandle
CreateMutexW
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OpenMutexW
OpenProcess
QueryPerformanceCounter
ReleaseMutex
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

__dllonexit
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_exit
_fmode
_initterm
_iob
_lock
_onexit
_snwprintf
_unlock
abort
acos
asin
atan
atan2
atoi
calloc
exit
fputc
free
fwprintf
getenv
localeconv
strstr
malloc
memcmp
memcpy
memmove
memset
raise
rand
setlocale
signal
srand
strchr
strcmp
strerror
strlen
strncmp
tan
wcscpy
wcslen

user32

CreateWindowExW
DefWindowProcW
GetSystemMetrics
GetWindowLongW
MessageBoxW
RegisterClassW
RegisterDeviceNotificationW
RegisterWindowMessageW
SendMessageW
SetWindowLongW
mouse_event

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ws2_32

htonl
ntohl
send

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSRegisterSessionNotification

libstdc++-6

InterlockedCompareExchange@12
_ZNKSt5ctypeIcE13_M_widen_initEv
_ZNSo3putEc
_ZNSo5flushEv
_ZNSolsEi
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate
_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_i
_ZSt16__throw_bad_castv
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt4cerr
_ZSt4cout
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZdaPv
_ZdlPv
_Znaj
_Znwj
__cxa_begin_catch
__cxa_end_catch
__cxa_guard_abort
__cxa_guard_acquire
__cxa_guard_release
__cxa_pure_virtual
__cxa_rethrow
__gxx_personality_v0

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

855317929dac1e56410214000af8c5f3

Headers

File Characteristics

Imports

pnfhidctl

libusb-1.0

wbapi

qt5core

qt5network

advapi32

libgcc_s_dw2-1

kernel32

msvcrt

user32

userenv

ws2_32

wtsapi32

libstdc++-6

Sections

.text Size: 256KB - Virtual size: 256KB

.data Size: 1024B - Virtual size: 992B

.rdata Size: 27KB - Virtual size: 27KB

.eh_fram Size: 60KB - Virtual size: 59KB

.bss Size: - Virtual size: 3KB

.idata Size: 16KB - Virtual size: 15KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 32B

.text
Size: 256KB - Virtual size: 256KB

.data
Size: 1024B - Virtual size: 992B

.rdata
Size: 27KB - Virtual size: 27KB

.eh_fram
Size: 60KB - Virtual size: 59KB

.bss
Size: - Virtual size: 3KB

.idata
Size: 16KB - Virtual size: 15KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 32B