29dac320e83674a41faa34fd5b6ba5830839237d1c09b8524219447ac8795b8b

Sharing

Copy URL Twitter E-mail

General

Target

29dac320e83674a41faa34fd5b6ba5830839237d1c09b8524219447ac8795b8b
Size

1.0MB
MD5

7dbd8b5d16c9782b3154f2d427dfe48f
SHA1

58d392980d92088594c61d6175139bb1ff9208ae
SHA256

29dac320e83674a41faa34fd5b6ba5830839237d1c09b8524219447ac8795b8b
SHA512

95e9297d2be4100797dfef64b7c9b2b6f7cba151c7e3adf8c899e36f5579e1eb52f7b89ea626897d68d0d7760e9e63b1af14932b1190fcea0696c4a5249994e7
SSDEEP

24576:9yZoCUY1PQ2mDBV+YWZTht8ojwDuxYBx+nzarNFc3eAPf:9yZoCUCTmFAYWZ1fj0ux/zcjc3Zf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29dac320e83674a41faa34fd5b6ba5830839237d1c09b8524219447ac8795b8b

Files

29dac320e83674a41faa34fd5b6ba5830839237d1c09b8524219447ac8795b8b
.exe windows:6 windows x86 arch:x86

5734f0b6deca208dd6c2832f22c280e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Git-repo\qb10frame\chrome\src\out\Release_x86\QQBrowserLiveup.pdb

Imports

kernel32

ResetEvent
FindResourceExW
LockResource
VerSetConditionMask
VerifyVersionInfoW
WideCharToMultiByte
TerminateThread
Sleep
WinExec
GetTickCount
MoveFileExW
OpenProcess
CreateProcessW
GetVersionExW
DeleteFileW
VirtualQuery
MulDiv
GetExitCodeProcess
GetProcessHeap
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
WriteConsoleW
SetEndOfFile
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapFree
DecodePointer
SetUnhandledExceptionFilter
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
RaiseException
lstrcmpiW
FreeLibrary
MultiByteToWideChar
WaitForSingleObject
GetLastError
SetLastError
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetCurrentDirectoryW
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStdHandle
ExitProcess
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
VirtualProtect
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
EnterCriticalSection
GetCurrentThreadId
CreateMutexW
OpenMutexW
CloseHandle
LCMapStringEx
InitOnceExecuteOnce
QueryPerformanceCounter
FormatMessageA
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
WaitNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateThread
GetDiskFreeSpaceExW
GetExitCodeThread
DeviceIoControl
WaitForMultipleObjects
SetEvent
GetSystemTimeAsFileTime
K32GetMappedFileNameW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OutputDebugStringW
GetSystemDefaultLangID
GetFullPathNameW
WriteFile
SetFilePointer
CreateDirectoryW
RemoveDirectoryW
CopyFileW
TerminateProcess
FindNextFileW
FindClose
FindFirstFileW
GetLocalTime
GetTempPathW
GetSystemInfo
GetSystemDirectoryW
CreateEventW
ReadFile
GetCurrentProcess
LocalFree
LocalAlloc
LoadLibraryW
GlobalFree
InitializeCriticalSectionEx
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
lstrlenW
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource

user32

MapWindowPoints
GetParent
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetForegroundWindow
SetTimer
PostQuitMessage
ClientToScreen
SendMessageW
KillTimer
IsWindowVisible
ShowWindow
MessageBoxW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
LoadImageW
OffsetRect
GetSysColor
MoveWindow
SetWindowTextW
GetSystemMetrics
GetDesktopWindow
GetDlgItem
SetWindowRgn
ScreenToClient
EnableWindow
InvalidateRect
SetFocus
PtInRect
GetScrollInfo
EndDialog
GetDlgCtrlID
SystemParametersInfoW
DispatchMessageW
PostThreadMessageW
GetMessageW
PeekMessageW
FrameRect
SendInput
GetForegroundWindow
EnumWindows
IsZoomed
IsIconic
GetWindowDC
SetCursor
GetWindowTextLengthW
GetWindowTextW
InflateRect
GetClassNameW
PostMessageW
IsWindow
SetWindowPos
ReleaseDC
GetDC
UpdateLayeredWindow
GetWindowRect
GetClientRect
LoadCursorW
CallWindowProcW
GetWindowLongW
DialogBoxParamW
DestroyWindow
FindWindowW
EndPaint
BeginPaint
SetCapture
ReleaseCapture
UpdateWindow
GetCapture
DestroyIcon
GetIconInfo
SetRectEmpty
IsRectEmpty
DrawFocusRect
CopyRect
AdjustWindowRectEx
DrawTextW
UnionRect
GetActiveWindow
GetAncestor
GetFocus
SetPropW
RemovePropW
EnumChildWindows
IsWindowEnabled
IntersectRect
CharNextW
UnregisterClassW
DefWindowProcW
SetWindowLongW
GetMenu
EqualRect
GetCursorPos

gdi32

GetClipBox
GetViewportOrgEx
RestoreDC
SaveDC
CreatePen
CreateDIBSection
CreateFontIndirectW
SetDIBColorTable
CombineRgn
GetPixel
CreateSolidBrush
RectVisible
GetCurrentObject
MoveToEx
LineTo
GetTextExtentPoint32W
GetTextExtentExPointW
SetBitmapBits
GetBitmapBits
SetBkMode
GetObjectA
GetObjectW
DeleteObject
SetViewportOrgEx
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
BitBlt
CreateFontW
GetDeviceCaps
SetTextColor
GetStockObject
CreateRectRgnIndirect
SetBkColor
ExtTextOutW
SelectClipRgn

advapi32

ConvertSidToStringSidW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
RegOpenKeyExA
RegQueryValueExA
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
GetTokenInformation

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderLocation
ShellExecuteW
ord75
SHGetPathFromIDListW

ole32

CoCreateGuid
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathMatchSpecW
PathFindFileNameW
PathFileExistsW
PathAppendW
SHDeleteValueW
PathCombineW
SHGetValueW
PathRemoveFileSpecW
PathGetArgsW
PathRemoveBlanksW
PathRemoveBackslashW
PathIsDirectoryW
PathCanonicalizeW
wnsprintfW
SHSetValueW
PathRemoveArgsW
PathUnquoteSpacesW

comctl32

_TrackMouseEvent
ImageList_GetIconSize
ImageList_Destroy
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawImageRectRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromResource
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawString
GdipCreateImageAttributes
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipResetWorldTransform
GdipGetFontSize
GdiplusShutdown
GdipDrawImageRectI
GdipGetImagePixelFormat
GdipCreateBitmapFromHICON
GdipBitmapGetPixel
GdiplusStartup
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipSetSmoothingMode
GdipDrawEllipseI
GdipDrawPath
GdipFillEllipseI
GdipFillPath
GdipAlloc
GdipCreateFromHDC
GdipDeleteGraphics
GdipDisposeImage
GdipSetImageAttributesWrapMode
GdipSetImageAttributesColorMatrix
GdipDeleteFont
GdipDisposeImageAttributes
GdipFree
GdipMeasureString

dbghelp

MakeSureDirectoryPathExists

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

netapi32

NetApiBufferFree
NetWkstaTransportEnum
Netbios

ws2_32

ntohl
htonl
htons

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpConnect

urlmon

URLDownloadToFileW

wininet

HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA
InternetConnectA
InternetReadFile
DeleteUrlCacheEntryW
InternetOpenA

Sections

.text
Size: 569KB - Virtual size: 569KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5734f0b6deca208dd6c2832f22c280e7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

dbghelp

version

netapi32

ws2_32

winhttp

urlmon

wininet

Sections

.text Size: 569KB - Virtual size: 569KB

.rdata Size: 156KB - Virtual size: 155KB

.data Size: 17KB - Virtual size: 84KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 271KB - Virtual size: 271KB

.reloc Size: 28KB - Virtual size: 28KB

.text
Size: 569KB - Virtual size: 569KB

.rdata
Size: 156KB - Virtual size: 155KB

.data
Size: 17KB - Virtual size: 84KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 271KB - Virtual size: 271KB

.reloc
Size: 28KB - Virtual size: 28KB