Static task
static1
General
-
Target
qtbewmkjkr.exe
-
Size
4.0MB
-
MD5
24f2fe91fa1b0421b9a53e3bde9cad28
-
SHA1
06cfe2fc4be52d0d188aef4916d8e0b96397dc59
-
SHA256
53e06986815b0caebb71c4877f6ac18b2b6ab2a97c430231cef7cb8d44c4005d
-
SHA512
d50453766dfdf98dd387ec24cf6fad89b4dc39aea022624ec45e92d99b3adbf7c87a5d757866327dfdab3d780429eff5f4bed613b602480e97c8c69006d9024e
-
SSDEEP
98304:9RGuimaf85bD/9cm0UazRrf3XNHtkZ7Nfr5hLVRuq:9Bime82HvR39Htk7Vff
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qtbewmkjkr.exe
Files
-
qtbewmkjkr.exe.exe windows:6 windows x64 arch:x64
88a2c159405702cdad392143489b9ca7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAGetLastError
dwmapi
DwmExtendFrameIntoClientArea
kernel32
Process32Next
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmSetCompositionWindow
msvcp140
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
winhttp
WinHttpQueryDataAvailable
d3d9
Direct3DCreate9Ex
crypt32
CertGetNameStringA
wininet
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
fputs
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-math-l1-1-0
floorf
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ntdll
RtlVirtualUnwind
wldap32
ord217
normaliz
IdnToAscii
advapi32
CryptImportKey
Sections
.text Size: - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wfewgfe Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.wfewgfe Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ