q:\bin\qbexe\ProductConfigTool.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e93f72f1e3a3cf82fccaa62c7f12f7638cbaeeba0d20c8c4c52eb4a6a6b7e8f7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e93f72f1e3a3cf82fccaa62c7f12f7638cbaeeba0d20c8c4c52eb4a6a6b7e8f7.exe
Resource
win10v2004-20240709-en
General
-
Target
e93f72f1e3a3cf82fccaa62c7f12f7638cbaeeba0d20c8c4c52eb4a6a6b7e8f7
-
Size
2.0MB
-
MD5
37b7423cd1dadcdd236a053f4e9c9c4f
-
SHA1
938599d925e42c292173d352dec55d7c43712e23
-
SHA256
e93f72f1e3a3cf82fccaa62c7f12f7638cbaeeba0d20c8c4c52eb4a6a6b7e8f7
-
SHA512
002cb908c591e3cd2b4402e8df563c99ea5adb0314e1c17ff2eb937fadb33c0bc3bb941efb6ad1dec0c06f9076f2cdac6809344f7af64a72f7c164ba3cf7bbb5
-
SSDEEP
24576:VHke+4q+cv05HfhSf9d2olSDfL23iPtI9/vsCUL0uf6h/+tq:VEyc85HfhSf9kolOf69yL0uy8c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e93f72f1e3a3cf82fccaa62c7f12f7638cbaeeba0d20c8c4c52eb4a6a6b7e8f7
Files
-
e93f72f1e3a3cf82fccaa62c7f12f7638cbaeeba0d20c8c4c52eb4a6a6b7e8f7.exe windows:6 windows x86 arch:x86
1e54e385b11082ff74c3c0e761ad586e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
TerminateProcess
GetExitCodeProcess
CreateProcessA
OpenProcess
GetWindowsDirectoryA
GetModuleFileNameA
GetPrivateProfileIntA
GetTempPathA
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetLastError
CreateEventW
GetModuleHandleW
GetFileAttributesExA
FindFirstFileA
CloseHandle
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DeleteFileA
SetLastError
IsDebuggerPresent
CompareStringA
UnmapViewOfFile
GetPrivateProfileStringA
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateDirectoryA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
CreateEventA
GetCurrentProcessId
Sleep
TerminateThread
GetExitCodeThread
GetSystemInfo
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
CreateToolhelp32Snapshot
Module32First
GetModuleHandleA
GetProcAddress
GetComputerNameA
GetSystemDirectoryA
lstrlenA
GetVolumeInformationA
GetLogicalDriveStringsA
InitializeSListHead
UnhandledExceptionFilter
GetFileSize
LockFileEx
HeapValidate
HeapWalk
GetVersionExA
GlobalAlloc
GlobalReAlloc
GlobalSize
GlobalFlags
GlobalLock
GlobalUnlock
GlobalFree
UnlockFileEx
ReleaseMutex
MapViewOfFile
LocalAlloc
LocalFree
FormatMessageA
CreateFileMappingA
GlobalMemoryStatus
CreateMutexA
WaitForSingleObject
GetProcessHeap
SetErrorMode
CreateFileA
FindClose
FreeLibrary
LoadLibraryA
GetCurrentProcess
HeapSize
GetVersion
HeapFree
HeapReAlloc
GetCurrentThreadId
HeapAlloc
OutputDebugStringW
CreateDirectoryW
CreateFileW
GetFileAttributesExW
GetFileInformationByHandle
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
WideCharToMultiByte
CopyFileW
MoveFileW
PostQueuedCompletionStatus
GetDriveTypeA
GetDiskFreeSpaceA
FatalAppExitA
Beep
OutputDebugStringA
GetTickCount
GetCurrentDirectoryA
MultiByteToWideChar
ole32
StringFromGUID2
CoInitialize
OleRun
CoCreateGuid
CoUninitialize
CoCreateInstance
oleaut32
SafeArrayGetLBound
VariantInit
GetErrorInfo
SysAllocStringLen
SafeArrayGetVartype
SystemTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
SafeArrayCopy
VarBstrCmp
SysAllocStringByteLen
SysStringByteLen
VariantClear
VariantCopy
VariantChangeType
SysStringLen
SafeArrayUnlock
SysFreeString
SysAllocString
SafeArrayLock
DispGetParam
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayGetElement
SafeArrayCreate
user32
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
GetAsyncKeyState
GetClipboardOwner
GetQueueStatus
GetWindowThreadProcessId
GetClassNameA
EnumWindows
PeekMessageA
FindWindowA
MessageBoxA
GetWindowTextA
RedrawWindow
SetForegroundWindow
IsWindowVisible
GetCursorPos
IsWindow
PostQuitMessage
PostMessageA
SendMessageA
IsIconic
LoadIconW
GetClientRect
DrawIcon
GetSystemMetrics
EnableWindow
KillTimer
SetTimer
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
GetUserNameA
RegEnumValueA
shlwapi
StrToIntA
PathAppendA
PathFileExistsA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
SHGetFolderPathA
SHCreateDirectoryExA
SHGetFolderPathW
gdi32
PatBlt
inetclnt
ICConnect
ICCloseInet
ICOpenInet
ICRunInternetSetup
ICNeedsInternetSetup
ICInitialize
ICDisconnect
mfc140
ord14380
ord12474
ord7964
ord14581
ord6322
ord11927
ord14583
ord6324
ord14582
ord11928
ord2027
ord6323
ord7905
ord12888
ord4082
ord993
ord6831
ord3844
ord5894
ord12182
ord8180
ord12194
ord12162
ord14054
ord5742
ord10202
ord9166
ord8426
ord5096
ord2210
ord4143
ord9353
ord14507
ord14509
ord12484
ord12485
ord2484
ord10330
ord5336
ord8285
ord7961
ord4580
ord12806
ord12869
ord10383
ord12190
ord8347
ord1468
ord7618
ord7459
ord10986
ord12074
ord6193
ord13677
ord2758
ord9167
ord12115
ord1109
ord8997
ord10963
ord11343
ord10421
ord4476
ord4084
ord458
ord3395
ord3396
ord8429
ord6505
ord3298
ord3295
ord2200
ord4807
ord6540
ord3874
ord10207
ord8173
ord14699
ord10237
ord10239
ord10238
ord10236
ord10240
ord5631
ord6463
ord358
ord13026
ord5398
ord5401
ord11671
ord11672
ord9096
ord12032
ord3830
ord11881
ord14149
ord4468
ord14502
ord8922
ord6947
ord9332
ord7076
ord10950
ord9213
ord3259
ord13798
ord2298
ord12503
ord12205
ord12201
ord1717
ord1739
ord1765
ord1751
ord1772
ord4920
ord4987
ord4932
ord4950
ord4944
ord4938
ord4997
ord4981
ord4926
ord5003
ord4958
ord4896
ord4911
ord4972
ord4493
ord5769
ord9647
ord4485
ord3050
ord14510
ord7887
ord14508
ord2381
ord14421
ord6848
ord11663
ord13628
ord5911
ord2680
ord12067
ord3933
ord3363
ord3364
ord3258
ord12111
ord5228
ord5528
ord5739
ord9305
ord5504
ord5231
ord5390
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord3808
ord1389
ord890
ord5102
ord2241
ord2387
ord2383
ord2986
ord1696
ord1692
ord5095
ord5861
ord1661
ord300
ord1529
ord2992
ord4656
ord306
ord1528
ord3159
ord1526
ord1044
ord310
ord316
ord2407
ord1510
ord325
ord1051
ord2359
ord324
ord1050
ord2409
ord7886
comctl32
ord17
msvcp140
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Xlength_error@std@@YAXPBD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
concrt140
?lock@critical_section@Concurrency@@QAEXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
??1critical_section@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
vcruntime140
__std_exception_destroy
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
_purecall
__std_terminate
memchr
__std_type_info_compare
__RTDynamicCast
__std_exception_copy
memset
strstr
strrchr
_CxxThrowException
memmove
_except_handler4_common
memcpy
strchr
api-ms-win-crt-string-l1-1-0
strlen
strcmp
strncpy
strcat
strcpy
strncpy_s
_strnicmp
_wcsicmp
toupper
tolower
strspn
strcspn
strncmp
strcpy_s
towupper
_strupr_s
strcat_s
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
_mbsrchr
_mbscmp
_mbslwr
_ismbcdigit
_mbsstr
_mbsnbcpy
_mbctoupper
_mbschr
_mbsnbcpy_s
_mbsnbcmp
api-ms-win-crt-convert-l1-1-0
atoi
_itoa_s
_itoa
_ltoa
_ltoa_s
atol
api-ms-win-crt-runtime-l1-1-0
__p___argv
_resetstkoflw
__p___argc
_invalid_parameter_noinfo
_errno
_register_thread_local_exe_atexit_callback
_beginthreadex
exit
_invalid_parameter_noinfo_noreturn
_controlfp_s
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_getpid
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
api-ms-win-crt-stdio-l1-1-0
__p__commode
_write
fclose
fopen
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
_get_stream_buffer_pointers
fflush
fgetc
fgetpos
fputc
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_close
_sopen_dispatch
__stdio_common_vsscanf
_sopen_s
_read
_set_fmode
api-ms-win-crt-heap-l1-1-0
_expand
realloc
_msize
_callnewh
_set_new_mode
free
malloc
_recalloc
calloc
_heapchk
api-ms-win-crt-filesystem-l1-1-0
_makepath_s
_findfirst64i32
_mkdir
_stat64i32
_getdrives
_access
_chmod
_fstat64
_splitpath
_makepath
_findclose
_splitpath_s
rename
_fullpath
_unlock_file
_lock_file
_unlink
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_localtime64
_localtime64_s
strftime
_time64
_mktime32
_time32
_strdate_s
_strtime_s
_tzset
asctime_s
_localtime32
_difftime32
api-ms-win-crt-math-l1-1-0
__setusermatherr
_except1
ceil
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-locale-l1-1-0
_setmbcp
_configthreadlocale
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptDeriveKeyPBKDF2
Exports
Exports
AppKnowsAboutFileRedirection
Sections
.text Size: 893KB - Virtual size: 893KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 250KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 65B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 791KB - Virtual size: 790KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ