quickassist[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

quickassist.exe
Size

663KB
MD5

1156c479769fd1803ea854d89b5967df
SHA1

9ac47d4bfa5313be762797b42302b6b19bd5f8d1
SHA256

f61c6144f3bc8487f68077526e38832e99933d54dfbcc4ff8a9689870d7a80e6
SHA512

7c32578955036398b08759908cf3de572035554ecf072b7082384f0432f6da2f345da7d4f8d9306e80a9fa688e99b32a87a71b4f067a0211d46af42a665ccef0
SSDEEP

6144:AUuF8Av3HDgUucjwXmSQ4dgJkQtHr9pWMLDd6P7HBosBAyCWgQnmz6leu1EnZGd1:AUuFhTd4dgeM+bmelwZcDrpl+wWi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
quickassist.exe

Files

quickassist.exe
.exe windows:10 windows x64 arch:x64

b3b37e90f4622ca003036530e8182bf8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

QuickAssist.pdb

Imports

msvcrt

_XcptFilter
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler3
__wgetmainargs
__set_app_type
__C_specific_handler
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
exit
_exit
_cexit
__setusermatherr
_initterm
_wcmdln
_fmode
??0exception@@QEAA@XZ
_wcsicmp
_wcsnicmp
_commode
?terminate@@YAXXZ
_lock
_unlock
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
memmove
memcpy
free
??_V@YAXPEAX@Z
malloc
memcpy_s
_vsnwprintf
realloc
_purecall
sprintf_s
__dllonexit
_onexit
memmove_s
_itow_s
?what@exception@@UEBAPEBDXZ
_callnewh
_CxxThrowException
??1type_info@@UEAA@XZ
memset
_amsg_exit
memcmp
wcscmp

atl

ord30
ord32

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
SizeofResource
LoadStringW
FreeLibrary
LoadResource
GetModuleFileNameA
LockResource
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
ResetEvent
LeaveCriticalSection
SetEvent
WaitForSingleObjectEx
CreateMutexExW
InitializeCriticalSectionEx
CreateSemaphoreExW
WaitForMultipleObjectsEx
OpenSemaphoreW
DeleteCriticalSection
ReleaseSemaphore
CreateEventExW
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
CreateThread
GetCurrentProcessId
GetStartupInfoW
ExitThread
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-com-l1-1-0

CoCreateInstanceFromApp
CoUninitialize
StringFromGUID2
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance

oleaut32

SysFreeString
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayAccessData
VariantInit
SysStringLen
SysAllocString
VariantChangeType

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegGetValueW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-security-base-l1-1-0

CheckTokenMembership
AdjustTokenPrivileges
CreateWellKnownSid
GetTokenInformation

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsIsStringEmpty
WindowsCreateString

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
TrySubmitThreadpoolCallback
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError
RoTransformError
GetRestrictedErrorInfo

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayMonitors
GetSystemMetrics
SystemParametersInfoW

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness
GetDpiForMonitor

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

uxtheme

SetWindowThemeAttribute

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipGetPropertyItemSize
GdipLoadImageFromStream
GdipGetPropertyItem
GdipImageGetFrameDimensionsList
GdipDrawImageRectI
GdipDrawImageI
GdipGraphicsClear
GdipDeleteGraphics
GdipImageGetFrameCount
GdipCreateBitmapFromScan0
GdipImageGetFrameDimensionsCount
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipImageSelectActiveFrame
GdipFree

ext-ms-win-com-ole32-l1-1-0

OleUninitialize
OleInitialize

ext-ms-win-ntuser-draw-l1-1-0

BeginPaint
EndPaint
InvalidateRect
UpdateWindow

ext-ms-win-ntuser-window-l1-1-0

SetWindowsHookExW
UnhookWindowsHookEx
GetWindowRect
DefWindowProcW
ShowWindow
DestroyWindow
BringWindowToTop
GetClientRect
SetWindowTextW
CallNextHookEx

api-ms-win-ntuser-ie-window-l1-1-0

SetWindowLongPtrW
GetWindowLongPtrW
KillTimer
SetTimer
UnregisterClassW

api-ms-win-ntuser-ie-message-l1-1-0

DispatchMessageW
TranslateMessage
GetMessageW
PostQuitMessage
PostMessageW

rpcrt4

UuidCreate

ext-ms-win-ntuser-keyboard-l1-1-0

GetKeyState
SendInput

ext-ms-win-gdi-devcaps-l1-1-0

GetDeviceCaps

ext-ms-win-ntuser-dc-access-ext-l1-1-0

ReleaseDC
GetDC

ext-ms-win-ntuser-menu-l1-1-0

GetSystemMenu
EnableMenuItem

ext-ms-win-shell-shell32-l1-2-0

ShellExecuteW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-rtcore-ntuser-window-l1-1-0

SetWindowPos
CreateWindowExW
RegisterClassExW
GetParent

d2d1

ord1

d3d11

D3D11CreateDevice

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-shutdown-l1-1-1

InitiateShutdownW

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

crypt32

CryptProtectData
CryptUnprotectData

dcomp

DCompositionCreateSurfaceHandle
DCompositionCreateDevice2

sas

SendSAS

ext-ms-win-ntuser-window-l1-1-1

SetLayeredWindowAttributes
UpdateLayeredWindow

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ext-ms-win-ole32-bindctx-l1-1-0

CoGetObject

ext-ms-win-gdi-draw-l1-1-0

CreateSolidBrush

ext-ms-win-rtcore-gdi-object-l1-1-0

DeleteObject

ext-ms-win-ntuser-windowclass-l1-1-2

SetClassLongPtrW
GetClassLongPtrW

ext-ms-win-ntuser-gui-l1-1-0

LoadIconW
FillRect

Sections

.text
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3b37e90f4622ca003036530e8182bf8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

uxtheme

gdiplus

ext-ms-win-com-ole32-l1-1-0

ext-ms-win-ntuser-draw-l1-1-0

ext-ms-win-ntuser-window-l1-1-0

api-ms-win-ntuser-ie-window-l1-1-0

api-ms-win-ntuser-ie-message-l1-1-0

rpcrt4

ext-ms-win-ntuser-keyboard-l1-1-0

ext-ms-win-gdi-devcaps-l1-1-0

ext-ms-win-ntuser-dc-access-ext-l1-1-0

ext-ms-win-ntuser-menu-l1-1-0

ext-ms-win-shell-shell32-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-rtcore-ntuser-window-l1-1-0

d2d1

d3d11

api-ms-win-core-url-l1-1-0

api-ms-win-core-shutdown-l1-1-1

api-ms-win-core-windowserrorreporting-l1-1-3

api-ms-win-core-registry-l1-1-1

crypt32

dcomp

sas

ext-ms-win-ntuser-window-l1-1-1

api-ms-win-core-apiquery-l1-1-0

ext-ms-win-ole32-bindctx-l1-1-0

ext-ms-win-gdi-draw-l1-1-0

ext-ms-win-rtcore-gdi-object-l1-1-0

ext-ms-win-ntuser-windowclass-l1-1-2

ext-ms-win-ntuser-gui-l1-1-0

Sections

.text Size: 402KB - Virtual size: 402KB

.rdata Size: 186KB - Virtual size: 185KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 16KB - Virtual size: 16KB

.rsrc Size: 46KB - Virtual size: 45KB

.text
Size: 402KB - Virtual size: 402KB

.rdata
Size: 186KB - Virtual size: 185KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 46KB - Virtual size: 45KB

.reloc
Size: 9KB - Virtual size: 8KB