qipressportable_password0000[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

qipressportable_password0000.zip
Size

808KB
MD5

aa0aa7789d4f83c249a3c7eed53c0963
SHA1

3cfdbfa9b734b145a29c3412eb1149e2f4756646
SHA256

2541222610927098dc0ab96603b288707e61cd4014862fb20e8f4bde611563ea
SHA512

71602e647062bc1056438ac79e557ed3eef905e804f62dbd7839470ed52b569f616fd31d6c34d752e0f98655f323ff1d17b50c1765b6465c95416f1bc4f9101a
SSDEEP

24576:S0oI+qzF8s9cWAmZWLoQzvIRKEEN2jjVK1thZgj:Sy/zF8QcWHcLoOvlEEN281u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QiPress.exe

Files

qipressportable_password0000.zip
.zip

Password: 0000
QiPress.exe
.exe windows:5 windows x64 arch:x64

Password: 0000

48e414e431433a62713440d22abb8343

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

gethostbyname

winmm

mixerOpen

version

VerQueryValueW

comctl32

ImageList_Create

psapi

GetModuleBaseNameW

wininet

InternetOpenW

user32

GetDC

gdi32

BitBlt

comdlg32

GetSaveFileNameW

advapi32

RegCloseKey

shell32

DragFinish

ole32

CoGetObject

oleaut32

SafeArrayGetLBound

Sections

.MPRESS1
Size: 801KB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
README.md