2c2f3f5b9ac3aa62c42d58417fd4aac099aae183580cb8535253eaba0c0a289a

Sharing

Copy URL Twitter E-mail

General

Target

2c2f3f5b9ac3aa62c42d58417fd4aac099aae183580cb8535253eaba0c0a289a
Size

1.2MB
MD5

019210e437279f84a64d18b45bc8b5c3
SHA1

f33a9e1e65155b0cfaa4862ce15568cd9db86a31
SHA256

2c2f3f5b9ac3aa62c42d58417fd4aac099aae183580cb8535253eaba0c0a289a
SHA512

3725f9111ea17ce32e62e1f1f89c3ed960f8d1f3239a03a1b51f1f66b7b359b0b0eb9116d6bb1359f6f9b33cf4b497f510e6fa492d5c0c1789141105a07179d3
SSDEEP

24576:CX99tXEtVb3QnkjMsBTZJ5RjHnZq84qcqtqqz30qo0q4qq1qqB/qsYqwrs:erlU1BjMyTz5RjHnZq84qcqtqqzEqo0f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c2f3f5b9ac3aa62c42d58417fd4aac099aae183580cb8535253eaba0c0a289a

Files

2c2f3f5b9ac3aa62c42d58417fd4aac099aae183580cb8535253eaba0c0a289a
.exe windows:6 windows x86 arch:x86

c5ca107c9346355e62452e3a7ed51320

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Project\qb_analyzer\out\Release\Win32\qb_analyzer.pdb

Imports

kernel32

GetSystemInfo
OpenProcess
K32GetProcessImageFileNameW
GetNativeSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
ExpandEnvironmentStringsW
GetModuleHandleExW
DeleteFileW
GetPrivateProfileStringW
RemoveDirectoryW
GetFullPathNameW
CreateDirectoryW
GetCurrentThread
LocalAlloc
GetVersionExW
GetModuleFileNameW
GetModuleHandleW
SystemTimeToFileTime
GetSystemTime
GetCurrentProcess
Sleep
GetProcessHeap
DecodePointer
HeapAlloc
GlobalMemoryStatusEx
HeapReAlloc
HeapSize
HeapFree
InitializeCriticalSectionEx
DeleteCriticalSection
RaiseException
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetSystemDirectoryW
DeviceIoControl
CreateFileW
LocalFree
CloseHandle
CreateProcessW
FindClose
FindNextFileW
lstrcmpiW
FindFirstFileW
WriteConsoleW
GetDriveTypeW
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetFileType
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
ExitProcess
LoadLibraryExW
CopyFileW
GetTickCount
GetSystemTimeAsFileTime
RtlUnwind
lstrlenW
MulDiv
InitOnceExecuteOnce
AcquireSRWLockShared
ReleaseSRWLockShared
GetEnvironmentVariableW
SetEnvironmentVariableW
SetFilePointer
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SleepConditionVariableSRW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
GetWindowsDirectoryW
RtlCaptureStackBackTrace
GetThreadId
FlushFileBuffers
SetFilePointerEx
SetEndOfFile
SetFileTime
GetFileSizeEx
SystemTimeToTzSpecificLocalTime
QueryPerformanceFrequency
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
QueryThreadCycleTime
ResumeThread
GetProcessId
AssignProcessToJobObject
GetStdHandle
SetHandleInformation
CreateThread
GetThreadPriority
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
FormatMessageA
WideCharToMultiByte
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
WriteFile
GetLocalTime
GetCurrentDirectoryW
WaitForSingleObject
DuplicateHandle
ReadFile
GetTempPathW
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
FindFirstFileExW
K32GetProcessMemoryInfo
GetProcessTimes
GetCommandLineW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetThreadPriority

user32

GetWindowLongW
GetWindow
LoadMenuW
DestroyWindow
DestroyMenu
SetFocus
EndDialog
LoadAcceleratorsW
GetCursorPos
SetScrollPos
TranslateAcceleratorW
GetSubMenu
DialogBoxParamW
TrackPopupMenu
MonitorFromPoint
PtInRect
CallWindowProcW
DefWindowProcW
SetTimer
DispatchMessageW
SendMessageW
GetMonitorInfoW
DrawTextW
DrawFocusRect
EnumChildWindows
EndPaint
BeginPaint
IsRectEmpty
IsWindowEnabled
LoadIconW
SetWindowLongW
CreateDialogParamW
UnregisterClassW
IntersectRect
ScreenToClient
UnionRect
ReleaseCapture
InvalidateRect
MonitorFromWindow
GetWindowRect
GetParent
MapWindowPoints
IsWindowVisible
SetWindowPos
SetWindowTextW
MoveWindow
GetClientRect
GetWindowTextW
EnableWindow
ShowWindow
GetDlgItem
PostMessageW
RegisterClassExW
CopyRect
EqualRect
IsWindow
OffsetRect
ReleaseDC
GetDC
IsDlgButtonChecked
GetSystemMetrics
TranslateMessage
PostQuitMessage
KillTimer
PeekMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
CreateWindowExW

gdi32

SetBkMode
SetTextColor
GetBitmapBits
GetObjectW
SetBitmapBits
SetBkColor
ExtTextOutW
GetTextExtentExPointW
GetTextExtentPoint32W
LineTo
MoveToEx
GetCurrentObject
CreateCompatibleDC
SetViewportOrgEx
CreateDIBSection
GetStockObject
CreateFontIndirectW
SelectObject
SaveDC
RestoreDC
GetViewportOrgEx
GetClipBox
RectVisible
SelectClipRgn
CreateRectRgnIndirect
DeleteDC
GetDeviceCaps
CreateDCW
BitBlt
CreateFontW
DeleteObject

advapi32

RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExA
RegOpenKeyExA
AddAce
InitializeAcl
GetLengthSid
EqualSid
SetSecurityInfo
DeleteAce
GetAce
GetAclInformation
GetSecurityInfo
OpenThreadToken
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
CreateProcessAsUserW

shell32

SHGetFolderPathW
CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteW
SHGetFileInfoW

ole32

CoTaskMemFree
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit

shlwapi

SHSetValueW
PathFindFileNameW

comctl32

_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_Create

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

netapi32

Netbios
NetApiBufferFree
NetWkstaTransportEnum

dbghelp

SymInitialize
SymSetOptions
SymGetLineFromAddr64
SymSetSearchPathW
SymFromAddr
SymGetSearchPathW

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Exports

Exports

GetHandleVerifier

Sections

.text
Size: 706KB - Virtual size: 706KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 303KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5ca107c9346355e62452e3a7ed51320

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

urlmon

netapi32

dbghelp

winmm

userenv

Exports

Exports

Sections

.text Size: 706KB - Virtual size: 706KB

.rdata Size: 162KB - Virtual size: 161KB

.data Size: 12KB - Virtual size: 82KB

.rsrc Size: 303KB - Virtual size: 303KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 706KB - Virtual size: 706KB

.rdata
Size: 162KB - Virtual size: 161KB

.data
Size: 12KB - Virtual size: 82KB

.rsrc
Size: 303KB - Virtual size: 303KB

.reloc
Size: 30KB - Virtual size: 30KB