D:\qci_workspace\root-workspaces\__qci-pipeline-10989746-1\Basic\Output\BinFinal\QQPCSoftCmd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e4f2e9e4ef20cbeb5e9967f6eace1456b4d48eac3b4724d85576e18191cc44ae.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e4f2e9e4ef20cbeb5e9967f6eace1456b4d48eac3b4724d85576e18191cc44ae.exe
Resource
win10v2004-20240802-en
General
-
Target
e4f2e9e4ef20cbeb5e9967f6eace1456b4d48eac3b4724d85576e18191cc44ae
-
Size
238KB
-
MD5
bce49bbd51dc1e6867e98174e2035b0a
-
SHA1
d8084afa4af1b843c11258d0aa1caf88e5e56cfc
-
SHA256
e4f2e9e4ef20cbeb5e9967f6eace1456b4d48eac3b4724d85576e18191cc44ae
-
SHA512
e22218d432f4ab590e5820631ae341e571a34a05a29d84af5b52e4abe3b6ff30fa52952e922e0a65a55558150177b772d0a8ae3d3d52c1b22217e82190c7e00c
-
SSDEEP
6144:wVIeooctUMR0mxI05KFLyOs75NiqaE+it:OIMctUMdMFLyOq5NP3V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e4f2e9e4ef20cbeb5e9967f6eace1456b4d48eac3b4724d85576e18191cc44ae
Files
-
e4f2e9e4ef20cbeb5e9967f6eace1456b4d48eac3b4724d85576e18191cc44ae.exe windows:6 windows x86 arch:x86
a7bee545a6cc1669f755ae84a4248ae5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
imm32
ImmDisableIME
ws2_32
ntohl
htonl
htons
ntohs
common
?IsValid@CxImage@@QBE_NXZ
?Load@CxImage@@QAE_NPB_WK@Z
??0CxImage@@QAE@K@Z
?Destroy@CxImage@@QAE_NXZ
?Save@CxImage@@QAE_NPB_WK@Z
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
kernel32
GetTempPathW
FindClose
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
GetTickCount64
ExpandEnvironmentStringsW
LocalAlloc
CreateProcessW
GetVersionExW
GetSystemDefaultLangID
SetFilePointer
SetErrorMode
GetShortPathNameW
lstrcmpiW
SetEvent
GetCurrentThreadId
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
InitializeCriticalSection
GetNativeSystemInfo
VirtualQuery
GetSystemPowerStatus
lstrcpynW
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
WaitForMultipleObjects
QueryPerformanceCounter
SearchPathW
SetUnhandledExceptionFilter
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
SetLastError
SystemTimeToFileTime
GetCurrentProcess
GetCurrentProcessId
CreateMutexW
OpenProcess
GetSystemTime
GetModuleHandleW
lstrlenW
Sleep
GetLastError
WaitForSingleObject
GetProcAddress
LoadLibraryW
GetModuleFileNameW
FreeLibrary
CloseHandle
CreateEventW
FindNextFileW
InitializeSListHead
FindFirstFileW
ReadFile
CreateDirectoryW
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
WaitForSingleObjectEx
ResetEvent
SwitchToThread
WriteFile
WideCharToMultiByte
DeleteFileW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapAlloc
ReleaseMutex
LocalFree
GetCommandLineW
TerminateProcess
IsDebuggerPresent
OpenMutexW
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
LoadLibraryA
VirtualAllocEx
user32
MsgWaitForMultipleObjects
PeekMessageW
LoadStringW
GetWindowLongW
FindWindowExW
FindWindowW
GetWindow
GetWindowThreadProcessId
SendMessageW
CreateWindowExW
SetWindowLongW
DestroyWindow
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CallWindowProcW
advapi32
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegDeleteKeyW
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
CreateServiceW
RegFlushKey
RegEnumKeyExW
RegEnumValueW
RegNotifyChangeKeyValue
RegGetKeySecurity
RegSetKeySecurity
RegQueryInfoKeyW
RegCloseKey
shell32
CommandLineToArgvW
SHChangeNotify
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantClear
SysFreeString
SysAllocString
shlwapi
PathAppendW
PathRemoveFileSpecW
PathAddBackslashW
StrStrIW
StrCmpW
PathFileExistsW
SHGetValueW
msvcp140
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?_Xout_of_range@std@@YAXPBD@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
psapi
GetProcessMemoryInfo
EnumProcesses
GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW
gdiplus
GdipGetImagePixelFormat
GdipCreateFont
GdipDeleteFontFamily
GdipDeleteFont
GdipCreateStringFormat
GdipCreateFontFamilyFromName
GdipSetInterpolationMode
GdipDeleteStringFormat
GdipDrawString
GdipSetStringFormatAlign
GdipGetImageWidth
GdipSetTextRenderingHint
GdipSaveImageToFile
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdipCreateBitmapFromFile
GdipDeleteGraphics
GdiplusShutdown
GdipSetStringFormatLineAlign
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipDeleteBrush
GdipDisposeImage
GdipGetImageHeight
GdipCloneImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
vcruntime140
_CxxThrowException
__current_exception_context
memcmp
__RTDynamicCast
__current_exception
__CxxFrameHandler3
_except_handler4_common
memset
memmove
memcpy
_purecall
__std_exception_copy
__std_exception_destroy
wcschr
__std_terminate
wcsrchr
_set_purecall_handler
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_set_invalid_parameter_handler
_invalid_parameter_noinfo_noreturn
set_terminate
api-ms-win-crt-heap-l1-1-0
free
_callnewh
realloc
_set_new_mode
malloc
api-ms-win-crt-string-l1-1-0
tolower
_wcsicmp
wcsncmp
_wcsnicmp
wcsncpy_s
wcscat_s
wcscpy_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
_wtol
_wtoi
_itow_s
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vsnwprintf_s
__stdio_common_vswscanf
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ