MQQQ8A08UAF8QNK5[.]com

Sharing

Copy URL Twitter E-mail

General

Target

MQQQ8A08UAF8QNK5.com
Size

32.1MB
MD5

9db7cccc77045f9cd3923f543de2bb71
SHA1

0b946efe6de99a76d98b7553499bc2818be8b9d8
SHA256

c08c1fc5fb52f3ec674acefed608da408e8c88c2113c98723bdbdbbe0914a265
SHA512

36b8613b0d0b11e0c660260c9c78f223a9b9e33f47589f1614b9ff5ba3a6a19d0a98b1c1531a8e6d740d6b7879ad93dc3bc59886ce90e223dbe36fab160e67b2
SSDEEP

786432:bxOcDAjSyjJCDC5OT7mGfPw3vmvAvenMYr:bxOaNoJcxwfmvrV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MQQQ8A08UAF8QNK5.com

Files

MQQQ8A08UAF8QNK5.com
.exe windows:6 windows x64 arch:x64

Password: fgfgfg

75ae3f8611f31a036b88afc66d4c2bf4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\suga\Desktop\Projects\loader_new_serv\build\Release\x64\loader.pdb

Imports

kernel32

WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
TerminateProcess
OpenProcess
GetStdHandle
SetConsoleTextAttribute
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceCounter
FreeLibrary
GetProcAddress
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFilePointerEx
HeapFree
HeapAlloc
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
SetConsoleCtrlHandler
DeleteFileW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
SetEndOfFile
ExitProcess
ReadFile
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
InitOnceBeginInitialize
InitOnceComplete
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetFileType
WriteFile
GetLastError
GetModuleHandleW
GetSystemDirectoryA
FormatMessageA
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
GetEnvironmentVariableW
GetModuleHandleExW
VirtualFree
GetACP
SwitchToFiber
DeleteFiber
CreateFiberEx
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
LoadLibraryW
ConvertFiberToThread
ConvertThreadToFiberEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
GetExitCodeThread
CreateSemaphoreA
GetSystemTime
SystemTimeToFileTime
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FindClose
FindFirstFileW
FindNextFileW
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
TryAcquireSRWLockExclusive
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
GetStringTypeW
RtlUnwind

user32

ScreenToClient
LoadCursorA
GetKeyState
ShowWindow
UpdateWindow
RegisterClassExA
GetDesktopWindow
UnregisterClassA
ClientToScreen
DefWindowProcA
SetWindowPos
DestroyWindow
GetWindowRect
GetWindowThreadProcessId
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetCapture
GetClientRect
ReleaseCapture
SetCursorPos
IsChild
TrackMouseEvent
GetForegroundWindow
SetCapture
CreateWindowExA
SetClipboardData
GetCursorPos
SetCursor
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard

oleaut32

SysFreeString
SysAllocString
SysStringLen

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

gdiplus

GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipSaveImageToStream
GdipFree
GdipCloneImage

ws2_32

WSAGetLastError
setsockopt
getnameinfo
getservbyname
ioctlsocket
freeaddrinfo
getsockopt
recv
connect
ntohs
sendto
socket
send
getsockname
getpeername
WSAStartup
getaddrinfo
inet_pton
WSASocketW
shutdown
select
closesocket
__WSAFDIsSet
WSACleanup
WSASetLastError
htonl
htons
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
recvfrom

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW

advapi32

DeregisterEventSource
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
RegisterEventSourceW

Sections

.smg
Size: - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.smg
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.smg
Size: - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.smg
Size: - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.smg
Size: - Virtual size: 18.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.smg
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.smg
Size: 32.1MB - Virtual size: 32.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.smg
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.smg
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: fgfgfg

75ae3f8611f31a036b88afc66d4c2bf4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

imm32

d3d9

d3dx9_43

ntdll

gdiplus

ws2_32

crypt32

advapi32

Sections

.smg Size: - Virtual size: 4.4MB

.smg Size: - Virtual size: 1.0MB

.smg Size: - Virtual size: 432KB

.smg Size: - Virtual size: 167KB

.smg Size: - Virtual size: 18.6MB

.smg Size: 2KB - Virtual size: 2KB

.smg Size: 32.1MB - Virtual size: 32.1MB

.smg Size: 512B - Virtual size: 480B

.smg Size: 512B - Virtual size: 212B

.smg
Size: - Virtual size: 4.4MB

.smg
Size: - Virtual size: 1.0MB

.smg
Size: - Virtual size: 432KB

.smg
Size: - Virtual size: 167KB

.smg
Size: - Virtual size: 18.6MB

.smg
Size: 2KB - Virtual size: 2KB

.smg
Size: 32.1MB - Virtual size: 32.1MB

.smg
Size: 512B - Virtual size: 480B

.smg
Size: 512B - Virtual size: 212B