v2_builds_latest_QuiverPhotos-amd64-installer[.]exe

resource	yara_rule
static1/unpack001/QuiverPhotos.exe	upx

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/QuiverPhotos.exe
unpack002/out.upx

v2_builds_latest_QuiverPhotos-amd64-installer.exe

IMPHASH f4d1e4cd7416ef83f79f7c6a038875b3
SHA256 5a1191d2527486f195ab010ad2bd770019ea9c881496d757e2ba1b0f31115fba
MD5 118c5e378a05b3e19999653e938db12a
SHA1 da04d3401171beb3290d560f7e204df6e6cb3dd0
SHA512 e44dbfb90645846ccde0e787809ce2f86f170f6f633f264052c14ff9666ec20e4912d54946b03488fa87b377753efd6381cc345c8fb9d095c9416b6229ac6015
SSDEEP 393216:FOs3Q0m9o8Ip/zONs9fot1FZDfGJgS426hS:F/3Q0m9c/zrfotbxGCS42v
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

97:ea:a5:81:36:7b:04:b6:0d:2a:74:4b:18:60:aa:3c:db:96:7c:a0:45:9b:cf:fb:72:ea:97:22:da:6c:86:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Quiver Inc,O=Quiver Inc,L=Draper,ST=Utah,C=US

Chains

Jul 8, 2024

Minor OS version

0

Major OS version

4

Entry point

17382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW

Name

.text

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/InstallOptions.dll

IMPHASH 52e510c34177688b17420f268f371225
SHA256 657672be6ea8a72fb4765074cfda019fb8fa4eacb3238a416c186f53919d7cf4
MD5 1f24c9859dd6639d0c752d7b96a2442d
SHA1 7014f711d1d06cdc3d5bae678aad29e8b9ebcfd2
SHA512 7a488b27031e76873623142e66355d45a2bcd13d0fe235b93db1f92bb5c6658c4b689131672cacdad7b5a3204fca3fdbe020066f442b3a0db17fcf85f3eabf96
SSDEEP 384:PnpIqrPKteJM6zAzlq0BnPr681qrSYc/RHXCtk6tztN4Ykvdv7WbHwyx1I83cwTv:PpI8yU0tmC/hS3NfgvtQt28PEslxo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9941

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

comdlg32

CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW

gdi32

CombineRgn CreateCompatibleDC CreateRectRgn DeleteObject GetDIBits GetObjectW SelectObject SetTextColor

kernel32

CloseHandle CreateFileW DeleteCriticalSection EnterCriticalSection FreeLibrary GetCurrentDirectoryW GetFileSize GetLastError GetModuleHandleA GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection LeaveCriticalSection LoadLibraryA MultiByteToWideChar ReadFile SetCurrentDirectoryW SetEndOfFile SetFilePointer Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpiW lstrcpyW lstrcpynW lstrlenW

msvcrt

_amsg_exit _initterm _iob _lock _unlock abort calloc free fwrite realloc strlen strncmp vfprintf

ole32

CoTaskMemFree

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

user32

CallWindowProcW CharNextW CloseClipboard CreateDialogParamW CreateWindowExW DestroyIcon DestroyWindow DispatchMessageW DrawFocusRect DrawTextW EnableMenuItem EnableWindow GetClientRect GetClipboardData GetDlgCtrlID GetDlgItem GetMessageW GetSysColor GetSystemMenu GetWindowLongW GetWindowRect GetWindowTextW IsDialogMessageW LoadCursorW LoadIconW LoadImageW MapDialogRect MapWindowPoints MessageBoxW OpenClipboard PostMessageW PtInRect SendMessageW SetCursor SetWindowLongW SetWindowPos SetWindowRgn SetWindowTextW ShowWindow TranslateMessage wsprintfW

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

135B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH b844086d4b3e59aa7b4439d88bcb40cb
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13105

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe

IMPHASH ccc6e30409f96054ca558f4765d32e38
SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
MD5 60366cbf515774ffde2b49297c3d2e9b
SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

04:3a:7c:79:39:d1:49:44:6f:2d:46:7c:3b:c6:8d:89:67:b1:4b:fd:cd:5f:9f:1d:33:a5:17:9b:41:84:03:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2024

PE Signature issue

Digest

04:3a:7c:79:39:d1:49:44:6f:2d:46:7c:3b:c6:8d:89:67:b1:4b:fd:cd:5f:9f:1d:33:a5:17:9b:41:84:03:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2024

Minor OS version

1

Major OS version

5

Entry point

29707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer QueryPerformanceCounter LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegSetValueExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

QuiverPhotos.exe

SHA256 9abc771cc6af7025e4c42e474aa5c9beb2a32a2bd3136914022fe3af2f242fe6
MD5 6780eae3b57fd18e332df211a10d3147
SHA1 590cf39c0a17b17df783c8b6d161a0d864eb19cb
SHA512 f5db53bae0626946a5d6adfb3e418e71b824d0d2f174ed7fb27368c3dbd72e0b584da899ef7dfc0ca68197e08614737a6519905ed0fe4c43e4e54c88a331b96f
SSDEEP 393216:Oj6sA/GxuA60if1PutEdrClQ//mlZ6X0uqPj:ie0iluYrCq/er1P
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

41587856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

out.upx

SHA256 776306ca02665a1ae6173dbb9e6daa70219a9bbe3308119d0ab87dc3240029b5
MD5 010de786bed0a16dc334e1ca08998c33
SHA1 92f0c095cb6ec5bbb35e8812118cc7e542149830
SHA512 71342b6f7a80c254a7377c95474b1376fad1fc98650f6e17e534c300688b3d35e0e59b492dc1bee8457b88d853b0558610f9a101e0d976c41fb6e36ba5cf5437
SSDEEP 196608:Rph9SPkPCQHhPbMjQ00T6q9bpRvInfBE7Q1YyoKZBoIRe+DpOKu:RjykPlHOj0dbpRCziyoKZB0g
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

471904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

16.0MB

Virtual Size

16.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21.0MB

Virtual Size

21.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.1MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

406KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

342KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

uninstall.exe.nsis

SHA256 6a797aaff047d594ac5ed596d35c019b7971f40ee786d0c37b897fcb1e522734
MD5 adf467536374b11010d311f08f8084bf
SHA1 98816f85ab0023dda3baaaa5bd2dd218be729233
SHA512 64fbda8933a6eea845370f3c4b9eab7a3a71e1f0deb9506c1118ffd599753df306a63f3f3c23326a669c03fde0d7be3cf80908e8300f26fee3abbd2c9124559b
MD5 SHA1 SHA512

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

v2_builds_latest_QuiverPhotos-amd64-installer.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/InstallOptions.dll

comdlg32

gdi32

kernel32

msvcrt

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

QuiverPhotos.exe

generic

out.upx

generic

uninstall.exe.nsis