D:\qci_workspace\root-workspaces\__qci-pipeline-10989746-1\Basic\Output\BinFinal\QMTinyDL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bb25868a04c01c4e4c99c4d4c8504be24638ec82a005ff05c2c06502f5a93830.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bb25868a04c01c4e4c99c4d4c8504be24638ec82a005ff05c2c06502f5a93830.dll
Resource
win10v2004-20240802-en
General
-
Target
bb25868a04c01c4e4c99c4d4c8504be24638ec82a005ff05c2c06502f5a93830
-
Size
348KB
-
MD5
6899b2068a474d9ce088e61a35ed85c1
-
SHA1
d4928fce2da2294a8b769e10f5f8e0d9bfc4c9a7
-
SHA256
bb25868a04c01c4e4c99c4d4c8504be24638ec82a005ff05c2c06502f5a93830
-
SHA512
9595ba07c86472143e6d471c49fc1eb6be88b33eba7a3df4b210617793f64d2c85fc97cc485df3166d44782304e8f2f0c17649b542b9ce42ba4441a17e93eda2
-
SSDEEP
6144:lP4nkLFN+yrni60nTH+nmwyz6rX893+oKHZyxdhH3K8:lP4nkWyrnonb+2z6bH7c9K8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb25868a04c01c4e4c99c4d4c8504be24638ec82a005ff05c2c06502f5a93830
Files
-
bb25868a04c01c4e4c99c4d4c8504be24638ec82a005ff05c2c06502f5a93830.dll windows:6 windows x86 arch:x86
ff6c00b15e5a87f74caaca6f69636fa5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
htons
htonl
kernel32
HeapAlloc
GetLocalTime
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
MoveFileW
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
UnhandledExceptionFilter
IsBadReadPtr
CreateDirectoryW
ResetEvent
GetTempPathW
CopyFileW
GetVersionExW
DisableThreadLibraryCalls
GlobalFree
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
DuplicateHandle
GetSystemDirectoryW
GetModuleHandleExW
GetFileAttributesW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
IsDebuggerPresent
GetTickCount
LocalFree
SwitchToThread
LoadResource
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
IsBadWritePtr
OpenEventW
GetCurrentProcessId
GetCommandLineW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
FindFirstFileW
GetSystemTime
SystemTimeToFileTime
FindNextFileW
FindClose
GetFileSize
SetEndOfFile
LocalAlloc
lstrlenW
MapViewOfFileEx
GetSystemDefaultLangID
GetNativeSystemInfo
VirtualQuery
GetSystemPowerStatus
LoadLibraryA
TryEnterCriticalSection
GetCPInfo
IsDBCSLeadByte
CreateProcessW
OpenProcess
lstrcmpiW
GetDateFormatW
GetTimeFormatW
ExpandEnvironmentStringsW
GetModuleFileNameA
GetFileAttributesExA
GetSystemTimeAsFileTime
TerminateProcess
InitializeSListHead
SetUnhandledExceptionFilter
FindResourceW
FindResourceExW
LoadLibraryW
RaiseException
CloseHandle
HeapReAlloc
IsProcessorFeaturePresent
DeleteFileW
LockResource
OutputDebugStringW
GetFileAttributesExW
GetLastError
GetTickCount64
Sleep
MultiByteToWideChar
HeapSize
GetCurrentThreadId
CreateFileW
InitializeCriticalSectionEx
SetFilePointer
GetModuleFileNameW
WriteFile
SetLastError
HeapFree
SizeofResource
WaitForSingleObjectEx
GetStartupInfoW
UnmapViewOfFile
user32
DestroyWindow
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DefWindowProcW
DispatchMessageW
UnregisterClassW
MsgWaitForMultipleObjectsEx
wsprintfW
PeekMessageW
advapi32
GetSecurityDescriptorSacl
RegDeleteValueW
RegDeleteKeyW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
ConvertStringSidToSidW
SetSecurityDescriptorSacl
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegSetValueExW
RegGetKeySecurity
RegSetKeySecurity
RegQueryInfoKeyW
RegFlushKey
shell32
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW
ole32
CoInitialize
CoUninitialize
oleaut32
SysFreeString
shlwapi
PathIsRootW
SHGetValueW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathIsRelativeW
msvcp140
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setf@ios_base@std@@QAEHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Xout_of_range@std@@YAXPBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
psapi
EnumProcesses
GetProcessMemoryInfo
EnumProcessModules
GetModuleBaseNameW
GetModuleFileNameExW
vcruntime140
memmove
memcpy
memset
__std_terminate
wcsrchr
__std_exception_destroy
__std_exception_copy
_purecall
wcschr
strrchr
wcsstr
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
__std_type_info_destroy_list
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
wcslen
wcsncpy
strncpy_s
tolower
wcscat_s
_wcsicmp
_wcslwr_s
wcsncpy_s
wcscpy_s
wcscmp
_wcsnicmp
isalpha
wcsnlen
wcsncmp
strlen
wmemcpy_s
api-ms-win-crt-heap-l1-1-0
malloc
_recalloc
free
_callnewh
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
fclose
fwrite
__stdio_common_vswscanf
_wfopen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
terminate
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_invalid_parameter_noinfo
_beginthreadex
_errno
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_crt_atexit
_get_errno
_set_errno
_crt_at_quick_exit
_initterm_e
_initterm
_cexit
_seh_filter_dll
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_free_locale
_create_locale
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-time-l1-1-0
_mktime64
_localtime64_s
_time32
_mkgmtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_wfullpath
api-ms-win-crt-math-l1-1-0
_except1
Exports
Exports
CreateQMTinyDLMgr
DestroyQMTinyDLMgr
GetQMTinyDLVer
Sections
.text Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ