96368123cf8fbe07ed344f30db4d6ff376746d70c5acabbf1d64038177eff585

Sharing

Copy URL Twitter E-mail

General

Target

96368123cf8fbe07ed344f30db4d6ff376746d70c5acabbf1d64038177eff585
Size

692KB
MD5

7c7b665a2f6eabdd9a070053b1027fef
SHA1

a7275f8a7e09bc141bdc2528df256f592e2a8d1d
SHA256

96368123cf8fbe07ed344f30db4d6ff376746d70c5acabbf1d64038177eff585
SHA512

8cce256363bcac31f92dcb4faa87013a9df32e141561cb63c9ea02be81a0f9c76cd3a8d35235fe721ca91f93f96740fe05f9ea2aeb904a31ae6a16f061a92d37
SSDEEP

6144:hJsHxeJqTlfQ+RCpA4VNZOGr0TZu4bO4FE:HsHxeJAlQ++3HMucO4FE

Score

1^/10

Malware Config

Signatures

Files

96368123cf8fbe07ed344f30db4d6ff376746d70c5acabbf1d64038177eff585
.exe windows:5 windows x86 arch:x86

9959369560daa71531b37ec3ed0fdb0d

Code Sign

63:47:c3:06:7a:c8:14:85:4e:52:01:62:e5:d1:77:6a
Certificate

Issuer

CN=Thinkinfo.Qs Ltds

Not Before

07/08/2023, 16:00

Not After

30/12/2028, 16:00

Subject

CN=Thinkinfo.Qs Ltds

Extended Key Usages

ExtKeyUsageCodeSigning

e8:1d:3f:30:97:27:2b:27:39:3c:43:c3:30:ac:9a:be:0f:37:de:bd:00:f5:85:20:22:9d:e2:6d:a4:11:33:f5
Signer

Actual PE Digest

e8:1d:3f:30:97:27:2b:27:39:3c:43:c3:30:ac:9a:be:0f:37:de:bd:00:f5:85:20:22:9d:e2:6d:a4:11:33:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegEnumKeyExA

shlwapi

PathFileExistsA

shell32

SHGetSpecialFolderLocation
SHChangeNotify
ShellExecuteExA
SHGetPathFromIDListA

gdi32

CreateCompatibleDC
GetObjectA
CreateFontA
CreateSolidBrush

user32

GetSystemMetrics
EnableWindow
SendMessageA
MessageBoxA
DrawIcon
AppendMenuA
GetSystemMenu
IsIconic
GetClientRect
LoadIconW
LoadBitmapW
FillRect
LoadImageA
GetWindowRect
UpdateWindow
InvalidateRect
IsWindow
SendMessageTimeoutA

mfc100

ord948
ord385
ord9475
ord6601
ord5774
ord2183
ord11924
ord5207
ord943
ord11941
ord12128
ord7322
ord374
ord6836
ord1709
ord3970
ord4785
ord1294
ord4341
ord1174
ord723
ord12962
ord8506
ord11882
ord12865
ord3977
ord13219
ord8137
ord4148
ord7892
ord3254
ord11067
ord10007
ord10360
ord3620
ord2974
ord2973
ord5095
ord2752
ord5532
ord12531
ord2416
ord11108
ord8330
ord8305
ord968
ord8235
ord5821
ord915
ord3738
ord2742
ord946
ord5777
ord1263
ord3755
ord2838
ord5534
ord12535
ord2881
ord2878
ord7349
ord2417
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8231
ord11025
ord3395
ord10883
ord13294
ord4881
ord5123
ord4625
ord1929
ord4606
ord5444
ord6897
ord7091
ord6888
ord4772
ord7357
ord9286
ord8304
ord6090
ord895
ord901
ord310
ord1296
ord5776
ord3439
ord1448
ord10030
ord1900
ord5837
ord14075
ord10922
ord13181
ord11413
ord7144
ord13483
ord8070
ord11154
ord6217
ord5830
ord8222
ord2184
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord7876
ord1483
ord868
ord10915
ord11318
ord13125
ord7875
ord2538
ord7832
ord11781
ord423
ord4188
ord4207
ord4936
ord11744
ord4143
ord2525
ord4283
ord1479
ord4939
ord2617
ord979
ord4144
ord12453
ord13348
ord1266
ord1267
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11172
ord11180
ord7355
ord9449
ord11184
ord11153
ord11787
ord5098
ord8439
ord6112
ord888
ord869
ord1288
ord13329
ord11297
ord1316
ord421
ord10906
ord2524
ord11277
ord300
ord13135
ord11627
ord5208
ord286
ord11625
ord13312
ord900
ord977
ord13310
ord266
ord265
ord11274
ord2056
ord6010
ord2611
ord4078
ord316
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord3390
ord4344
ord1985
ord7141
ord1890
ord6680
ord6316
ord7581
ord788
ord1732
ord1210
ord1496
ord1503
ord9399
ord6835
ord12095
ord12672
ord1509
ord1507
ord2067
ord2063
ord4774
ord11806
ord2061
ord12868
ord2076
ord13136
ord320
ord12720
ord1939
ord4499
ord1437
ord3404
ord3839
ord1480
ord11461
ord2569
ord4464
ord7012
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord4622
ord4903
ord7487
ord1313
ord5242
ord305
ord2626
ord6898
ord1982
ord9281
ord2088

msvcr100

_localtime64_s
strftime
strcpy_s
_putenv_s
_fullpath
srand
_mkdir
_time64
atof
calloc
_recalloc
_setmbcp
getenv
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_initterm_e
_initterm
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
_strdup
_rmdir
atoi
_access
memcpy_s
__CxxFrameHandler3
memset
memcpy
_except_handler3
malloc
free

kernel32

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
FreeLibrary
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
WinExec
lstrlenA
DeleteFileA
SetFileAttributesA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetModuleFileNameA
CopyFileA
GetTempPathA
SetEnvironmentVariableA
GetModuleHandleA
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetDiskFreeSpaceExA
GetFileAttributesA
GetEnvironmentVariableA
lstrlenW
QueryPerformanceCounter
SetLastError
GetLastError
RaiseException

msimg32

TransparentBlt

comctl32

InitCommonControlsEx

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9959369560daa71531b37ec3ed0fdb0d

Code Sign

63:47:c3:06:7a:c8:14:85:4e:52:01:62:e5:d1:77:6aCertificate

Extended Key Usages

e8:1d:3f:30:97:27:2b:27:39:3c:43:c3:30:ac:9a:be:0f:37:de:bd:00:f5:85:20:22:9d:e2:6d:a4:11:33:f5Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

shell32

gdi32

user32

mfc100

msvcr100

kernel32

msimg32

comctl32

Sections

.text Size: 71KB - Virtual size: 70KB

.rdata Size: 201KB - Virtual size: 201KB

.data Size: 2KB - Virtual size: 6KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 414KB - Virtual size: 414KB

63:47:c3:06:7a:c8:14:85:4e:52:01:62:e5:d1:77:6a
Certificate

e8:1d:3f:30:97:27:2b:27:39:3c:43:c3:30:ac:9a:be:0f:37:de:bd:00:f5:85:20:22:9d:e2:6d:a4:11:33:f5
Signer

.text
Size: 71KB - Virtual size: 70KB

.rdata
Size: 201KB - Virtual size: 201KB

.data
Size: 2KB - Virtual size: 6KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 414KB - Virtual size: 414KB