I:\Work\workCode\QWinLog\Release\QWinLog.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4b81d0d21594ceb1fd15b407d99f63592085b144bc29b4cb174541a1d358cc8f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b81d0d21594ceb1fd15b407d99f63592085b144bc29b4cb174541a1d358cc8f.exe
Resource
win10v2004-20240802-en
General
-
Target
4b81d0d21594ceb1fd15b407d99f63592085b144bc29b4cb174541a1d358cc8f
-
Size
4.2MB
-
MD5
13e889329ffb8b21ff5fb9d91778baf6
-
SHA1
912509646c7d3276bbeb8604fe1e9f3af901823c
-
SHA256
4b81d0d21594ceb1fd15b407d99f63592085b144bc29b4cb174541a1d358cc8f
-
SHA512
bb59df28464e29927a354fa146c60503534256019dc0c8c64ae22cc95158caba5de8bfe881ec1a036fbb8217cc6ff3bf0ea303e47bdc404d8530b191eee25c11
-
SSDEEP
98304:yM6U+gLNzuAJ5Vmm5ZSBt7lfSAqovn2qAwA19yQ0IoLu+W+KMPpPn3lz:WU+gdVPSvNAIIoLu+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b81d0d21594ceb1fd15b407d99f63592085b144bc29b4cb174541a1d358cc8f
Files
-
4b81d0d21594ceb1fd15b407d99f63592085b144bc29b4cb174541a1d358cc8f.exe windows:6 windows x86 arch:x86
8d83b1cfbf0f5994395894345096bef4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetCurrentDirectoryW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
GetDriveTypeW
MoveFileExW
DeleteFileW
GetTimeZoneInformation
SetConsoleCtrlHandler
ReadConsoleW
SetFilePointerEx
CreateDirectoryW
GetFileAttributesExW
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
GetConsoleOutputCP
CreateFileW
ExitProcess
GetFileType
SetStdHandle
HeapQueryInformation
GetFullPathNameW
GetCommandLineW
GetCommandLineA
VirtualQuery
VirtualAlloc
FindNextFileW
FindFirstFileExW
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
CompareStringEx
GetStringTypeW
GetLocaleInfoEx
WriteConsoleW
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetTickCount64
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
RtlCaptureStackBackTrace
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
QueryPerformanceFrequency
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
GetCurrentDirectoryW
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
LocalUnlock
LocalLock
GetUserDefaultLCID
ReplaceFileA
GetTempFileNameA
GetDiskFreeSpaceA
GetTempPathA
GetProfileIntA
SearchPathA
GetWindowsDirectoryA
FindResourceExW
SetErrorMode
SetFileTime
SetFileAttributesA
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
VerifyVersionInfoA
VerSetConditionMask
GetACP
SystemTimeToFileTime
GetCPInfo
GetOEMCP
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
IsProcessorFeaturePresent
TlsGetValue
TlsAlloc
GetAtomNameA
GlobalFlags
InitializeCriticalSectionAndSpinCount
GetStringTypeExA
GetThreadLocale
MoveFileA
lstrcmpiA
GetShortPathNameA
LoadLibraryExA
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetFullPathNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
ResumeThread
SuspendThread
FormatMessageA
GlobalLock
GlobalUnlock
GlobalSize
CompareStringA
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
lstrcmpW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetSystemDirectoryW
SetLastError
EncodePointer
K32GetMappedFileNameA
QueryDosDeviceA
GetLogicalDriveStringsA
CreateFileMappingA
lstrlenA
lstrcpyA
UnmapViewOfFile
MapViewOfFile
lstrcmpA
RemoveDirectoryA
GetFileAttributesExA
CompareFileTime
CopyFileA
SetCommTimeouts
SetCommState
SetCommMask
PurgeComm
GetCommState
SetupComm
GlobalFree
GlobalAlloc
GetSystemTime
TerminateThread
GetOverlappedResult
SetFilePointer
ReadFile
GetFileSize
FlushFileBuffers
SetThreadPriority
GetDiskFreeSpaceExA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
GetDynamicTimeZoneInformation
WriteFile
GetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
GetStdHandle
GetSystemInfo
WaitForMultipleObjects
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
CreateProcessA
GetExitCodeProcess
TerminateProcess
GetVersionExA
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
MulDiv
LocalFree
LocalAlloc
DecodePointer
GetModuleFileNameA
GetTickCount
GetCurrentThread
CreateThread
Sleep
InitializeCriticalSection
GetVolumeInformationA
CreateDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
SetUnhandledExceptionFilter
OutputDebugStringA
IsDebuggerPresent
CreateFileA
GetCurrentDirectoryA
WideCharToMultiByte
FindResourceW
SizeofResource
LockResource
LoadResource
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
LCMapStringEx
user32
IntersectRect
GetAsyncKeyState
CopyImage
LoadCursorA
GetSysColorBrush
RealChildWindowFromPoint
CharUpperA
IsZoomed
SystemParametersInfoA
GetMenuItemInfoA
DestroyMenu
ClientToScreen
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
MapDialogRect
SetWindowContextHelpId
GetWindowThreadProcessId
SetCursor
ShowOwnedPopups
GetCursorPos
TranslateMessage
GetMessageA
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
OffsetRect
SetRectEmpty
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuState
GetMenuStringA
LoadCursorW
CharNextA
CopyAcceleratorTableA
InvalidateRgn
IsRectEmpty
GetNextDlgGroupItem
UnregisterClassA
SendMessageA
ReleaseDC
TrackMouseEvent
MapVirtualKeyA
GetKeyNameTextA
IsDialogMessageA
ScrollWindowEx
IsWindowEnabled
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindow
GetLastActivePopup
GetTopWindow
GetClassLongA
SetWindowLongA
GetWindowLongA
PtInRect
MessageBeep
BringWindowToTop
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
CreatePopupMenu
InsertMenuItemA
LoadImageA
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
LoadMenuW
GetSystemMenu
SetWindowRgn
DestroyIcon
EqualRect
GetSysColor
LoadImageW
GetDialogBaseUnits
DeleteMenu
WaitMessage
SetCapture
ReleaseCapture
GetDC
WindowFromPoint
EnableWindow
PeekMessageA
RegisterDeviceNotificationA
PostMessageA
PostQuitMessage
SetWindowPos
IsIconic
SetDlgItemTextA
SetTimer
KillTimer
GetSystemMetrics
GetMenu
EnableMenuItem
GetSubMenu
GetMenuItemID
GetMenuItemCount
DrawIcon
InvalidateRect
SetWindowTextA
GetClientRect
GetWindowRect
MessageBoxExA
LoadIconW
GetDpiForWindow
IsCharAlphaA
MessageBoxA
GetParent
GetForegroundWindow
wsprintfA
GetClassNameA
DrawStateA
FillRect
SetRect
CopyRect
InflateRect
GetFocus
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
LoadBitmapW
RegisterWindowMessageA
DispatchMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
IsWindow
IsMenu
IsChild
DestroyWindow
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ScreenToClient
IsWindowVisible
GetDlgItem
GetDlgCtrlID
SetFocus
GetKeyState
GetCapture
SetMenu
TrackPopupMenu
TrackPopupMenuEx
UpdateWindow
SetActiveWindow
SetForegroundWindow
BeginPaint
EndPaint
ValidateRect
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetWindowTextLengthA
AdjustWindowRectEx
NotifyWinEvent
GetMenuDefaultItem
SetMenuDefaultItem
UpdateLayeredWindow
EnableScrollBar
UnionRect
MonitorFromPoint
SetLayeredWindowAttributes
EnumDisplayMonitors
DrawFocusRect
DrawIconEx
GetIconInfo
HideCaret
InvertRect
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
SetClassLongA
SetParent
DrawEdge
DrawFrameControl
SetCursorPos
CopyIcon
FrameRect
RegisterClipboardFormatA
CharUpperBuffA
LockWindowUpdate
ModifyMenuA
GetKeyboardLayout
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
PostThreadMessageA
GetComboBoxInfo
IsCharLowerA
MapVirtualKeyExA
GetDoubleClickTime
IsClipboardFormatAvailable
GetUpdateRect
GetDCEx
DestroyCursor
MonitorFromRect
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
EnumChildWindows
SendNotifyMessageA
InSendMessage
WindowFromDC
CreateMenu
SubtractRect
GetWindowRgn
GetTabbedTextExtentA
GetTabbedTextExtentW
MapWindowPoints
gdi32
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutA
ExtTextOutA
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectA
GetTextMetricsA
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
OffsetClipRgn
CreateRoundRectRgn
CreateDIBSection
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
EnumFontFamiliesExA
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetDIBits
SetPixel
StretchBlt
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
LPtoDP
CreateFontA
GetCharWidthA
StretchDIBits
OffsetRgn
GetCurrentObject
Rectangle
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
SetPixelV
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateRectRgn
CreatePen
CreateSolidBrush
GetTextExtentPoint32A
RoundRect
CreateBitmap
SetBkColor
SetTextColor
GetObjectA
CreateRectRgnIndirect
PatBlt
CopyMetaFileA
CreateDCA
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateDIBPatternBrushPt
CreateHatchBrush
CreateCompatibleBitmap
SetBkMode
CreatePatternBrush
msimg32
TransparentBlt
AlphaBlend
winspool.drv
DocumentPropertiesA
GetJobA
ClosePrinter
OpenPrinterA
advapi32
RegEnumKeyExA
OpenThreadToken
GetFileSecurityA
SetFileSecurityA
RegEnumValueA
RegOpenKeyExW
RegQueryValueA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueA
RegOpenKeyA
RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegCloseKey
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RevertToSelf
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
ImpersonateSelf
GetLengthSid
FreeSid
AllocateAndInitializeSid
AddAccessAllowedAce
AccessCheck
shell32
DragQueryFileA
DragFinish
SHGetFileInfoA
SHFileOperationA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
SHGetSpecialFolderLocation
SHAppBarMessage
ShellExecuteExA
SHAddToRecentDocs
ExtractIconA
comctl32
_TrackMouseEvent
shlwapi
PathIsUNCA
PathRemoveFileSpecW
PathRemoveExtensionA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
StrFormatKBSizeA
uxtheme
IsThemeBackgroundPartiallyTransparent
CloseThemeData
DrawThemeBackground
IsAppThemed
DrawThemeText
GetThemePartSize
GetThemeSysColor
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeParentBackground
OpenThemeData
ole32
OleCreateLinkFromData
OleCreateFromData
OleCreate
CreateItemMoniker
CreateGenericComposite
GetHGlobalFromILockBytes
WriteClassStm
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleRegEnumVerbs
OleRegGetMiscStatus
CreateFileMoniker
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
PropVariantCopy
RevokeDragDrop
RegisterDragDrop
OleCreateLinkToFile
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleRun
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
StringFromGUID2
CoDisconnectObject
CoInitializeEx
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
OleLoad
OleSave
OleSaveToStream
OleSetContainedObject
OleGetIconOfClass
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleQueryLinkFromData
OleQueryCreateFromData
OleCreateStaticFromData
CoLockObjectExternal
OleCreateFromFile
StgIsStorageFile
oleaut32
SysFreeString
SysAllocStringLen
VariantInit
SetErrorInfo
SysAllocString
GetErrorInfo
VariantClear
OleCreateFontIndirect
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
SysStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
CreateErrorInfo
oledlg
ord8
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
CM_Get_Parent
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdA
CM_Get_Device_IDA
SetupDiEnumDeviceInfo
ws2_32
WSAEnumNetworkEvents
WSAEventSelect
recv
inet_pton
WSACreateEvent
WSACloseEvent
inet_ntoa
htonl
getpeername
WSASocketA
WSASend
WSARecv
WSAIoctl
gethostname
gethostbyname
send
listen
bind
WSAGetLastError
WSACleanup
WSAStartup
socket
shutdown
setsockopt
ntohs
closesocket
inet_addr
htons
getsockopt
connect
WSAWaitForMultipleEvents
iphlpapi
GetAdaptersInfo
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
gdiplus
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusShutdown
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipAlloc
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipDeleteGraphics
oleacc
CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow
winmm
PlaySoundA
imm32
ImmReleaseContext
ImmGetOpenStatus
ImmGetContext
Sections
.text Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 698KB - Virtual size: 697KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 58KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ