31cb9b3a920a8a4a7b5cf70f31dadec2e65882d59468a642f4dc6342e6633b4c

Sharing

Copy URL

Twitter E-mail

General

Target

31cb9b3a920a8a4a7b5cf70f31dadec2e65882d59468a642f4dc6342e6633b4c
Size

85KB
MD5

74beef1023aa35f8cc67cb5946762802
SHA1

94ad5249c9b6c51cf160eba8cfd602d706442be9
SHA256

31cb9b3a920a8a4a7b5cf70f31dadec2e65882d59468a642f4dc6342e6633b4c
SHA512

525e34841381d0a097bbb2712b5a0dacc66027a2d6822067d8cf0a122ada939c6d2f9a60a3b4906fbed5c84b8d3765c10c67edd912487cee823cd05388f20885
SSDEEP

1536:YxhM4aKEbP//L98WxWkfGrDvd/a1AJwF61u1P9ExTnr:6M4KjT98skBauJw2ud9ExTr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31cb9b3a920a8a4a7b5cf70f31dadec2e65882d59468a642f4dc6342e6633b4c

Files

31cb9b3a920a8a4a7b5cf70f31dadec2e65882d59468a642f4dc6342e6633b4c
.dll windows:6 windows x86 arch:x86

56e9ac8f72ade863a2edf1f466cf1baf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\qci_workspace\root-workspaces\__qci-pipeline-10989746-1\Basic\Output\BinFinal\QMAVProxy.pdb

Imports

kernel32

CreateFileW
VirtualQuery
QueryPerformanceCounter
SetFilePointer
ReadFile
OpenMutexW
SetLastError
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
GetFileAttributesExW
DeleteFileW
MoveFileW
GetCurrentThreadId
OutputDebugStringW
WriteFile
CreateMutexW
ReleaseMutex
RaiseException
GetModuleHandleExW
lstrcmpiW
SwitchToThread
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
CreateEventW
GetCurrentProcessId
SetEvent
ProcessIdToSessionId
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
GetTickCount64
GetModuleHandleW
WideCharToMultiByte
WritePrivateProfileStringW
GetTempPathW
GetLocalTime
LoadLibraryW
FreeLibrary
GetProcAddress
OpenProcess
CreateProcessW
DeleteCriticalSection
InitializeCriticalSectionEx
GetModuleFileNameW
InitializeSListHead
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetCurrentProcess
Sleep
WaitForSingleObject
CloseHandle
GetLastError
GetSystemTimeAsFileTime
GetPrivateProfileIntW

user32

PostMessageW
FindWindowW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

shlwapi

PathAppendW
PathFileExistsW
PathRemoveFileSpecW

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

psapi

EnumProcesses
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModules

vcruntime140

wcsrchr
__std_type_info_destroy_list
__CxxFrameHandler3
__std_terminate
memset
memcpy
__std_exception_copy
__std_exception_destroy
memmove
_CxxThrowException
strrchr
_except_handler4_common

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
malloc
free
_recalloc

api-ms-win-crt-string-l1-1-0

wcscpy_s
wcslen
wcsncpy_s
wmemcpy_s
_wcslwr_s
wcsnlen
strlen
wcsncmp
_wcsicmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_cexit
_crt_atexit
_errno
_initterm
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo
_initterm_e
_execute_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf

Exports

Exports

DllGetFileMonProxy

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56e9ac8f72ade863a2edf1f466cf1baf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

shlwapi

msvcp140

psapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 864B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 864B

.reloc
Size: 5KB - Virtual size: 4KB