E:\qci_workspace\root-workspaces\__qci-pipeline-603700-1\Basic\Output\BinFinal\QQPCRepair.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f3860fe60039fc7e5b5a3cfd0a54bc58491707e9191ba2ead96853e6b18f26d9.exe
Resource
win7-20240704-en
General
-
Target
f3860fe60039fc7e5b5a3cfd0a54bc58491707e9191ba2ead96853e6b18f26d9
-
Size
532KB
-
MD5
571fa111fedaa59e3278b2710488f376
-
SHA1
482ef1fd9ad103e0e04cbacb5985b2897a2177a1
-
SHA256
f3860fe60039fc7e5b5a3cfd0a54bc58491707e9191ba2ead96853e6b18f26d9
-
SHA512
bc65a413a6703821019dbe5bd68d93e72448229b04dd8d2472656c10191b214d415344ac6f2f61295354206d265d53cbe52c2126c929fbbcea61cc102a43d799
-
SSDEEP
12288:c5LrSqg2JWFy0pwISHYQS6vMzjc9tySgh6VLJpqWfg:q0k06rHYd6vWoTgh6VLJpqWfg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3860fe60039fc7e5b5a3cfd0a54bc58491707e9191ba2ead96853e6b18f26d9
Files
-
f3860fe60039fc7e5b5a3cfd0a54bc58491707e9191ba2ead96853e6b18f26d9.exe windows:5 windows x86 arch:x86
4a3570b74db42f17a9148f87d05b9b5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
ntohl
htons
ntohs
htonl
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
kernel32
DeleteFileW
DeviceIoControl
OpenEventW
InterlockedDecrement
VirtualFree
OpenProcess
GetCurrentProcessId
GetExitCodeProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
FileTimeToSystemTime
GetTickCount
lstrcmpA
GetModuleFileNameW
GetModuleHandleExW
GetTempPathW
GetWindowsDirectoryW
GetFullPathNameW
GetVersionExW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
MultiByteToWideChar
CreateFileA
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
InterlockedExchange
GetLocalTime
SetFileAttributesW
CopyFileW
GetVolumeInformationW
GetComputerNameW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
CreateEventW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
RaiseException
InitializeCriticalSectionAndSpinCount
SetErrorMode
InterlockedIncrement
MapViewOfFileEx
GetSystemDefaultLangID
GetNativeSystemInfo
GetSystemPowerStatus
lstrcmpiW
SwitchToThread
IsDebuggerPresent
GetCommandLineW
UnhandledExceptionFilter
WaitForMultipleObjects
lstrcpynW
SearchPathW
SetUnhandledExceptionFilter
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
DisableThreadLibraryCalls
GetFileAttributesExW
CreateFileW
ReadFile
GetModuleHandleA
WideCharToMultiByte
GetSystemDirectoryW
FindResourceExW
FindResourceW
LoadLibraryW
GetSystemInfo
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LocalFree
LocalAlloc
LockResource
GetModuleHandleW
LoadLibraryA
GetProcAddress
FreeLibrary
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
SetFilePointer
WriteFile
GetFileSize
SetLastError
SuspendThread
SetThreadContext
GetThreadContext
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
VirtualQuery
VirtualProtect
VirtualAlloc
FlushInstructionCache
InterlockedCompareExchange
CreateProcessW
CreateProcessA
ResumeThread
WriteProcessMemory
ReadProcessMemory
GetLastError
VirtualQueryEx
VirtualProtectEx
VirtualAllocEx
CreateDirectoryW
CreateMutexW
user32
GetSystemMetrics
GetWindowThreadProcessId
FindWindowW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
OpenProcessToken
OpenThreadToken
GetTokenInformation
RegCloseKey
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
LookupAccountNameW
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueW
RegOpenKeyW
RegOpenKeyA
RegSetValueExW
RegSetKeySecurity
RegQueryInfoKeyW
RegOpenKeyExA
RegGetKeySecurity
RegEnumKeyExW
CheckTokenMembership
DuplicateTokenEx
CreateProcessAsUserW
LookupPrivilegeValueW
LookupAccountSidW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
ConvertSidToStringSidW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetFolderPathW
SHCreateDirectoryExW
oleaut32
VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
shlwapi
StrChrIW
PathAppendW
PathFileExistsW
StrStrIW
PathRemoveFileSpecW
StrChrW
PathAppendA
StrStrIA
SHDeleteKeyW
StrStrW
PathMatchSpecW
SHGetValueW
imm32
ImmDisableIME
msvcp140
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
wininet
HttpQueryInfoW
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetReadFile
psapi
EnumProcesses
EnumProcessModules
GetProcessMemoryInfo
GetModuleFileNameExW
GetModuleBaseNameW
crypt32
CryptMsgClose
CryptQueryObject
CertCloseStore
CryptDecodeObject
CryptMsgGetParam
vcruntime140
memmove
__std_terminate
__CxxFrameHandler3
memset
memcpy
wcsrchr
__std_exception_copy
__std_exception_destroy
strchr
_purecall
memchr
strstr
_CxxThrowException
wcschr
wcsstr
_except_handler4_common
_set_purecall_handler
api-ms-win-crt-string-l1-1-0
wcsncpy_s
_wcsicmp
wcscpy_s
wcscat_s
strcpy_s
strtok_s
strncpy_s
tolower
toupper
wmemcpy_s
_strnicmp
_stricmp
wcspbrk
wcsncmp
strnlen
wcslen
strcmp
_wcsnicmp
wcsnlen
strlen
wcscmp
api-ms-win-crt-utility-l1-1-0
rand
rand_s
srand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_initialize_onexit_table
_set_app_type
terminate
_cexit
_configure_wide_argv
_controlfp_s
_set_invalid_parameter_handler
_get_wide_winmain_command_line
_errno
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_c_exit
_seh_filter_exe
exit
_exit
_crt_atexit
_initialize_wide_environment
api-ms-win-crt-multibyte-l1-1-0
_mbsstr
api-ms-win-crt-stdio-l1-1-0
fwrite
_fseeki64
_set_fmode
ungetc
setvbuf
fsetpos
fread
__stdio_common_vswscanf
__p__commode
fputc
fgetpos
__stdio_common_vsprintf
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsscanf
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s
fgetc
api-ms-win-crt-convert-l1-1-0
wcstombs_s
_wtoi
_itoa_s
_ultow_s
_wtol
atoi
_itow_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setlocale
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
malloc
_set_new_mode
free
api-ms-win-crt-math-l1-1-0
_except1
__setusermatherr
modf
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_wrename
_unlock_file
_lock_file
Sections
.text Size: 385KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ