f6f8c5417fcec41597dcff9e4ae750121417d479bc13600b5853a381a26967f3

Sharing

Copy URL Twitter E-mail

General

Target

f6f8c5417fcec41597dcff9e4ae750121417d479bc13600b5853a381a26967f3
Size

1.6MB
MD5

a89ef6ae190794cc7a888029ad127943
SHA1

f5ef20a0144c85f57009d68ca896510b619c92eb
SHA256

f6f8c5417fcec41597dcff9e4ae750121417d479bc13600b5853a381a26967f3
SHA512

c6226c458cfe1d43b9f4b2b6ab54f7dbdd26fb523e62f8190788af1729203b56eb10c3965cbbcaa756de9b5d9a7398534e07c29d67788cceddf5410ee2f23e35
SSDEEP

12288:4p1d42IO6HBtFZOwo1mzG3P+KP2pysW6Z9vginCGKUo1P:or50ogS+lws9vjnm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6f8c5417fcec41597dcff9e4ae750121417d479bc13600b5853a381a26967f3

Files

f6f8c5417fcec41597dcff9e4ae750121417d479bc13600b5853a381a26967f3
.exe windows:6 windows x64 arch:x64

cfcda0b98e41aeb48f1324ffa36de162

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\home\jenkins\agent\workspace\Replace-DYTC-hyperlink-with-text\src\QSHelper\bin\x64\Release\QSHelper.pdb

Imports

kernel32

Sleep
GetTickCount64
GetLastError
Process32NextW
SetEvent
DeleteFileW
Process32FirstW
CloseHandle
ResetEvent
HeapAlloc
GetLocalTime
GetProcAddress
VirtualAllocEx
WTSGetActiveConsoleSessionId
DeleteCriticalSection
VerSetConditionMask
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
VerifyVersionInfoW
CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
VirtualFreeEx
ReadFile
GetFullPathNameW
GetModuleFileNameW
SetFilePointer
CreateFileW
LoadLibraryExW
OutputDebugStringW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
CreateEventW
OpenProcess
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
CreateMutexW
GetSystemPowerStatus
K32GetModuleFileNameExW
TerminateProcess
GetCurrentProcess
FindNextFileW
HeapFree
FindFirstFileW
QueryFullProcessImageNameW
GetStartupInfoW

user32

CreatePopupMenu
TrackPopupMenu
LoadStringW
GetSystemMetrics
SendMessageW
CreateWindowExW
GetWindowRect
FindWindowExW
DispatchMessageW
SetTimer
PostMessageW
UnregisterPowerSettingNotification
RegisterClassW
DefWindowProcW
GetMessageW
GetWindowThreadProcessId
ShowWindow
TranslateMessage
LoadIconW
GetCursorPos
InvalidateRect
SetForegroundWindow
FindWindowW
LoadCursorW
GetClientRect
AppendMenuW
KillTimer
RegisterPowerSettingNotification
PostQuitMessage
RegisterWindowMessageW

advapi32

RegQueryValueExW
CreateProcessAsUserW
RegOpenKeyExW
CheckTokenMembership
FreeSid
RegSetValueExW
ImpersonateLoggedOnUser
RegCreateKeyExW
RegDeleteKeyValueW
AllocateAndInitializeSid
RegCloseKey
RegSetKeyValueW
RegNotifyChangeKeyValue
RevertToSelf
GetUserNameW

shell32

ShellExecuteW
SHGetKnownFolderPath
Shell_NotifyIconW

ole32

StringFromGUID2
CoCreateGuid
CoTaskMemFree

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

shlwapi

PathFileExistsW

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

wintrust

WinVerifyTrust

bcrypt

BCryptGetProperty
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
__std_exception_destroy
__std_exception_copy
wcsrchr
memmove
memset
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context

api-ms-win-crt-filesystem-l1-1-0

_waccess_s

api-ms-win-crt-stdio-l1-1-0

fflush
fclose
__p__commode
_set_fmode
__stdio_common_vfwprintf
__stdio_common_vswprintf
_wfsopen

api-ms-win-crt-string-l1-1-0

_wcsnicmp
_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_crt_atexit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_beginthreadex
terminate
_register_onexit_function

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
_callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cfcda0b98e41aeb48f1324ffa36de162

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

msvcp140

shlwapi

wtsapi32

userenv

api-ms-win-shcore-scaling-l1-1-1

wintrust

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 1.5MB - Virtual size: 2.5MB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 1.5MB - Virtual size: 2.5MB