4448629f6e1992e803a6843246eba8d0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4448629f6e1992e803a6843246eba8d0N.exe
Size

1.1MB
MD5

4448629f6e1992e803a6843246eba8d0
SHA1

17730a722c94002ecc59e41c74ade922769ebfd3
SHA256

5ab0c23a5d49f8cd66e86ae2b888b056d5a32448f15b0e03ae9a458010f23f9a
SHA512

6d001454942c9d4146a06fc077438f8e1e5dcf4f2182f79007ae8c1b08b3ba1020b3d89ea5ad35d83e370edb088af374752179e92947d649c18e51c57161631d
SSDEEP

24576:DQn6J/rxWvTn2+pgy3pj0oihnKnZXW4MmZWa:DKW/tW72+b10oihnKnZVN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4448629f6e1992e803a6843246eba8d0N.exe

Files

4448629f6e1992e803a6843246eba8d0N.exe
.dll windows:4 windows x64 arch:x64

d415edfa17f94fdeb7778487baf29d4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

qt5core

_Z5qHashRK7QStringj
_ZN10QArrayData10deallocateEPS_yy
_ZN10QArrayData11shared_nullE
_ZN10QArrayData8allocateEyyy6QFlagsINS_16AllocationOptionEE
_ZN10QByteArrayC1EPKci
_ZN11QMetaObject12invokeMethodEP7QObjectPKcN2Qt14ConnectionTypeE22QGenericReturnArgument16QGenericArgumentS7_S7_S7_S7_S7_S7_S7_S7_S7_
_ZN11QMetaObject14normalizedTypeEPKc
_ZN14QObjectPrivateC2Ei
_ZN14QObjectPrivateD2Ev
_ZN15QtSharedPointer20ExternalRefCountData9getAndRefEPK7QObject
_ZN16QCoreApplication9translateEPKcS1_S1_i
_ZN18QRegularExpressionC1ERK7QString6QFlagsINS_13PatternOptionEE
_ZN18QRegularExpressionD1Ev
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject5eventEP6QEvent
_ZN7QString11reallocDataEjb
_ZN7QString13toUtf8_helperERKS_
_ZN7QString14toLower_helperERKS_
_ZN7QString14toLower_helperERS_
_ZN7QString14trimmed_helperERS_
_ZN7QString15fromUtf8_helperEPKci
_ZN7QString17fromLatin1_helperEPKci
_ZN7QString18toLocal8Bit_helperEPK5QChari
_ZN7QString6appendE5QChar
_ZN7QString6appendERKS_
_ZN7QString6insertEi5QChar
_ZN7QString6numberEii
_ZN7QString6removeE5QCharN2Qt15CaseSensitivityE
_ZN7QString7replaceE5QChar13QLatin1StringN2Qt15CaseSensitivityE
_ZN7QStringC1EPK5QChari
_ZN8QVariantC1ENS_4TypeE
_ZN8QVariantC1ERK10QByteArray
_ZN8QVariantC1ERK7QString
_ZN8QVariantC1ERKS_
_ZN8QVariantC1Ed
_ZN8QVariantC1Ei
_ZN8QVariantC1EiPKvj
_ZN8QVariantC1Ex
_ZN8QVariantD1Ev
_ZN8QVariantaSERKS_
_ZN9QDateTimeD1Ev
_ZN9QHashData11free_helperEPFvPNS_4NodeEE
_ZN9QHashData11shared_nullE
_ZN9QHashData12allocateNodeEi
_ZN9QHashData13detach_helperEPFvPNS_4NodeEPvEPFvS1_Eii
_ZN9QHashData6rehashEi
_ZN9QHashData8freeNodeEPv
_ZN9QHashData8nextNodeEPNS_4NodeE
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData7disposeEPNS_4DataE
_ZN9QMetaType22registerNormalizedTypeERK10QByteArrayPFvPvEPFS3_S3_PKvEi6QFlagsINS_8TypeFlagEEPK11QMetaObject
_ZN9QtPrivate20QStringList_containsEPK11QStringListRK7QStringN2Qt15CaseSensitivityE
_ZNK10QStringRef10startsWithE13QLatin1StringN2Qt15CaseSensitivityE
_ZNK10QStringRef10startsWithE5QCharN2Qt15CaseSensitivityE
_ZNK10QStringRef3midEii
_ZNK10QStringRef5toIntEPbi
_ZNK10QStringRef7trimmedEv
_ZNK11QMetaObject2trEPKcS1_i
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK14QMessageLogger7warningEPKcz
_ZNK5QTime8toStringE11QStringView
_ZNK7QString10startsWithE13QLatin1StringN2Qt15CaseSensitivityE
_ZNK7QString10startsWithE5QCharN2Qt15CaseSensitivityE
_ZNK7QString11lastIndexOfE5QChariN2Qt15CaseSensitivityE
_ZNK7QString3argE13QLatin1Stringi5QChar
_ZNK7QString3midEii
_ZNK7QString4leftEi
_ZNK7QString5utf16Ev
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE
_ZNK7QString8containsERK18QRegularExpression
_ZNK7QString8endsWithE5QCharN2Qt15CaseSensitivityE
_ZNK7QString8splitRefE5QChar6QFlagsIN2Qt18SplitBehaviorFlagsEENS2_15CaseSensitivityE
_ZNK7QStringeqE13QLatin1String
_ZNK8QVariant10toDateTimeEv
_ZNK8QVariant10toLongLongEPb
_ZNK8QVariant5toIntEPb
_ZNK8QVariant6isNullEv
_ZNK8QVariant6toListEv
_ZNK8QVariant6toTimeEv
_ZNK8QVariant8toDoubleEPb
_ZNK8QVariant8toStringEv
_ZNK8QVariant8userTypeEv
_ZNK8QVariant9constDataEv
_ZNK9QDateTime8toStringEN2Qt10DateFormatE
_Zeq13QLatin1StringRK10QStringRef
_ZeqRK7QStringS1_

qt5sql

_ZN10QSqlDriver11cancelQueryEv
_ZN10QSqlDriver11qt_metacallEN11QMetaObject4CallEiPPv
_ZN10QSqlDriver11qt_metacastEPKc
_ZN10QSqlDriver12notificationERK7QString
_ZN10QSqlDriver12notificationERK7QStringNS_18NotificationSourceERK8QVariant
_ZN10QSqlDriver12setLastErrorERK9QSqlError
_ZN10QSqlDriver12setOpenErrorEb
_ZN10QSqlDriver16staticMetaObjectE
_ZN10QSqlDriver7setOpenEb
_ZN10QSqlDriverC2ER17QSqlDriverPrivateP7QObject
_ZN10QSqlDriverD2Ev
_ZN10QSqlRecord5clearEv
_ZN10QSqlRecord6appendERK9QSqlField
_ZN10QSqlRecordC1ERKS_
_ZN10QSqlRecordC1Ev
_ZN10QSqlRecordD1Ev
_ZN10QSqlResult10nextResultEv
_ZN10QSqlResult11savePrepareERK7QString
_ZN10QSqlResult12setLastErrorERK9QSqlError
_ZN10QSqlResult14setForwardOnlyEb
_ZN10QSqlResult5setAtEi
_ZN10QSqlResult8setQueryERK7QString
_ZN10QSqlResult9bindValueERK7QStringRK8QVariant6QFlagsIN4QSql13ParamTypeFlagEE
_ZN10QSqlResult9bindValueEiRK8QVariant6QFlagsIN4QSql13ParamTypeFlagEE
_ZN10QSqlResult9setActiveEb
_ZN10QSqlResult9setSelectEb
_ZN10QSqlResultD2Ev
_ZN16QSqlCachedResult10fetchFirstEv
_ZN16QSqlCachedResult11clearValuesEv
_ZN16QSqlCachedResult12virtual_hookEiPv
_ZN16QSqlCachedResult13fetchPreviousEv
_ZN16QSqlCachedResult27setNumericalPrecisionPolicyEN4QSql24NumericalPrecisionPolicyE
_ZN16QSqlCachedResult4dataEi
_ZN16QSqlCachedResult4initEi
_ZN16QSqlCachedResult5fetchEi
_ZN16QSqlCachedResult6isNullEi
_ZN16QSqlCachedResult7cleanupEv
_ZN16QSqlCachedResult9fetchLastEv
_ZN16QSqlCachedResult9fetchNextEv
_ZN16QSqlCachedResultC2ER23QSqlCachedResultPrivate
_ZN16QSqlDriverPlugin11qt_metacallEN11QMetaObject4CallEiPPv
_ZN16QSqlDriverPlugin11qt_metacastEPKc
_ZN16QSqlDriverPlugin16staticMetaObjectE
_ZN16QSqlDriverPluginC2EP7QObject
_ZN16QSqlDriverPluginD2Ev
_ZN23QSqlCachedResultPrivateC2EP16QSqlCachedResultPK10QSqlDriver
_ZN9QSqlErrorC1ERK7QStringS2_NS_9ErrorTypeES2_
_ZN9QSqlErrorD1Ev
_ZN9QSqlField10setSqlTypeEi
_ZN9QSqlField12setAutoValueEb
_ZN9QSqlField15setDefaultValueERK8QVariant
_ZN9QSqlField17setRequiredStatusENS_14RequiredStatusE
_ZN9QSqlFieldC1ERK7QStringN8QVariant4TypeES2_
_ZN9QSqlFieldD1Ev
_ZN9QSqlIndex6appendERK9QSqlField
_ZN9QSqlIndexC1ERK7QStringS2_
_ZN9QSqlIndexD1Ev
_ZN9QSqlQuery14setForwardOnlyEb
_ZN9QSqlQuery4execERK7QString
_ZN9QSqlQuery4nextEv
_ZN9QSqlQueryC1EP10QSqlResult
_ZN9QSqlQueryD1Ev
_ZNK10QSqlDriver11formatValueERK9QSqlFieldb
_ZNK10QSqlDriver11isOpenErrorEv
_ZNK10QSqlDriver12sqlStatementENS_13StatementTypeERK7QStringRK10QSqlRecordb
_ZNK10QSqlDriver15stripDelimitersERK7QStringNS_14IdentifierTypeE
_ZNK10QSqlDriver19isIdentifierEscapedERK7QStringNS_14IdentifierTypeE
_ZNK10QSqlDriver6isOpenEv
_ZNK10QSqlRecord5countEv
_ZNK10QSqlRecord7isEmptyEv
_ZNK10QSqlResult11boundValuesEv
_ZNK10QSqlResult24numericalPrecisionPolicyEv
_ZNK10QSqlResult6driverEv
_ZNK10QSqlResult8isActiveEv
_ZNK10QSqlResult8isSelectEv
_ZNK10QSqlResult9lastErrorEv
_ZNK17QSqlResultPrivate11fieldSerialEi
_ZNK9QSqlError12databaseTextEv
_ZNK9QSqlError7isValidEv
_ZNK9QSqlQuery5valueEi
_ZNK9QSqlQuery9lastErrorEv
_ZTV16QSqlCachedResult
_ZTV17QSqlResultPrivate
_ZTV23QSqlCachedResultPrivate

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
GetVersionExW
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEndOfFile
SetFilePointer
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile

msvcrt

__iob_func
__setusermatherr
_amsg_exit
_beginthreadex
_endthreadex
_errno
_initterm
_localtime64
_lock
_unlock
abort
acos
asin
atan
calloc
cosh
fprintf
free
fwrite
log10
malloc
memcmp
memcpy
memmove
memset
realloc
signal
sinh
strcmp
strcspn
strlen
strncmp
strrchr
tan
tanh
vfprintf

libstdc++-6

_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZdlPv
_ZdlPvy
_Znwy
__cxa_guard_acquire
__cxa_guard_release

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 941KB - Virtual size: 940KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d415edfa17f94fdeb7778487baf29d4c

Headers

File Characteristics

Imports

qt5core

qt5sql

kernel32

msvcrt

libstdc++-6

Exports

Exports

Sections

.text Size: 941KB - Virtual size: 940KB

.data Size: 16KB - Virtual size: 15KB

.rdata Size: 70KB - Virtual size: 69KB

.qtmetad Size: 512B - Virtual size: 128B

.pdata Size: 19KB - Virtual size: 19KB

.xdata Size: 23KB - Virtual size: 23KB

.bss Size: - Virtual size: 3KB

.edata Size: 512B - Virtual size: 116B

.idata Size: 15KB - Virtual size: 15KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 824B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 941KB - Virtual size: 940KB

.data
Size: 16KB - Virtual size: 15KB

.rdata
Size: 70KB - Virtual size: 69KB

.qtmetad
Size: 512B - Virtual size: 128B

.pdata
Size: 19KB - Virtual size: 19KB

.xdata
Size: 23KB - Virtual size: 23KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 512B - Virtual size: 116B

.idata
Size: 15KB - Virtual size: 15KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 824B

.reloc
Size: 3KB - Virtual size: 3KB