9192c627bc07984499b8cce4c5814b6b001c3ef8f997e13cf0334acd4c0f8b31

Sharing

Copy URL Twitter E-mail

General

Target

9192c627bc07984499b8cce4c5814b6b001c3ef8f997e13cf0334acd4c0f8b31
Size

728KB
MD5

7696a219de8552242829db7819801cf0
SHA1

5a6e170657a008004dec70d58d29e9c7afe44ae8
SHA256

9192c627bc07984499b8cce4c5814b6b001c3ef8f997e13cf0334acd4c0f8b31
SHA512

0761cb1e31ffafbb6714c58ad5af79dcad8c432a4c9a4cb45b124335ab3131ff05fe6dfaf6ecfdb72f3ac9db94eb960d12d4850fdff9a10c8009851174854a56
SSDEEP

12288:EUywmLD5JLA4JKfaDFKaGri1xAyC0Q+GDSiZFN75+nTsgLEDWcmf7c:EUywmfvfDCrioeqFNITJLIe7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9192c627bc07984499b8cce4c5814b6b001c3ef8f997e13cf0334acd4c0f8b31

Files

9192c627bc07984499b8cce4c5814b6b001c3ef8f997e13cf0334acd4c0f8b31
.exe windows:6 windows x86 arch:x86

deefc5a481d835b43d84c0968f74dcae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\work\capture\ScreenRecorder\rel\Win32\QYRunningHelper.pdb

Imports

kernel32

GetFileSize
DeleteFileW
DecodePointer
GetCommandLineW
LoadLibraryExW
lstrcmpiW
FreeLibrary
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
ReadFile
CreateProcessW
GetStartupInfoW
CreatePipe
SetProcessShutdownParameters
WriteFile
OutputDebugStringW
CloseHandle
SetFilePointer
CreateFileW
MultiByteToWideChar
SetLastError
RaiseException
GetCurrentThreadId
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
DeleteCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapDestroy
GetModuleFileNameW
GetLastError
GetSystemTimeAsFileTime
QueryPerformanceCounter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LCMapStringEx
GetCPInfo
GetStringTypeW
LoadLibraryExA
VirtualFree
GetFileAttributesExW
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
Sleep
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
lstrlenA
GetTickCount
SetFileAttributesW
MoveFileExW
WaitForSingleObject
SystemTimeToFileTime
LocalFileTimeToFileTime
GetVersionExW
GetVersion
GetSystemTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetThreadLocale
SetThreadLocale
GetNativeSystemInfo
ResetEvent
SetEvent
PostQueuedCompletionStatus
GetSystemInfo
GetExitCodeThread
TerminateThread
CreateEventW
CreateIoCompletionPort
GetQueuedCompletionStatus
LoadLibraryW
LocalFree
GlobalAlloc
GlobalFree
VirtualAlloc
SetUnhandledExceptionFilter
GetLocalTime
IsBadReadPtr
VirtualProtect
ExitProcess
GetCurrentProcessId
GetCurrentProcess
InitializeCriticalSection
OpenProcess
K32EnumProcessModules
TerminateProcess
lstrcmpA
UnmapViewOfFile
SetEndOfFile
CreateFileMappingW
MapViewOfFile
RemoveDirectoryW
GetLongPathNameW
DeviceIoControl
SetErrorMode
CreateThread
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent

user32

PostMessageW
MessageBoxW
SetTimer
KillTimer
PostQuitMessage
DefWindowProcW
IsWindow
DestroyWindow
SendMessageW
wsprintfW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
SetWindowLongW
GetWindowLongW
CallWindowProcW
ShowWindow
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW

advapi32

RegDeleteValueW
RegQueryValueExW
RegEnumKeyW
GetUserNameW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
CloseServiceHandle
CreateServiceW
OpenSCManagerW

shell32

SHChangeNotify
ShellExecuteW
SHCreateDirectoryExW
SHGetFolderPathW
ord165
SHGetSpecialFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

OleRun
CoInitializeSecurity
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

GetErrorInfo
VariantCopy
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringLen

shlwapi

PathFindFileNameW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathRemoveExtensionW
PathIsPrefixW
PathRemoveBackslashW
PathCanonicalizeW
SHGetValueW
SHDeleteValueW
PathSearchAndQualifyW
StrStrIW
PathCombineW

wininet

HttpSendRequestW
InternetConnectW
InternetSetOptionW
InternetOpenW
InternetCrackUrlW
HttpQueryInfoW
InternetReadFile
InternetQueryOptionW
InternetCloseHandle
HttpOpenRequestW

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

netapi32

Netbios

iphlpapi

GetIpAddrTable
GetAdaptersInfo

version

VerQueryValueW

secur32

GetUserNameExW

Sections

.text
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

deefc5a481d835b43d84c0968f74dcae

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

crypt32

netapi32

iphlpapi

version

secur32

Sections

.text Size: 489KB - Virtual size: 489KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 10KB - Virtual size: 23KB

.rsrc Size: 92KB - Virtual size: 91KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 489KB - Virtual size: 489KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 10KB - Virtual size: 23KB

.rsrc
Size: 92KB - Virtual size: 91KB

.reloc
Size: 24KB - Virtual size: 23KB