otqp9[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

otqp9.exe
Size

332KB
MD5

e6cd9d13873fe412d65b9e6aba45d220
SHA1

8cb137c74236e4cad3fbc46abe736c0683db1c9e
SHA256

5a43cbf8cf2636662187db7fd18d214c2f0468c0305b08920d82371f0a530f65
SHA512

367368a6fe3c56373e4c1a2bf39a895f9d99c36ad12983a5f5be4d62c1bace0bd1eacfc743b5a0ecc3f8ce4e792aa169bff9f91c40571c4461df54792c250b22
SSDEEP

6144:T2xlV673rp8I+xY01VAuwV4g/LVnW2e4yZkNiRudnV1/UzH:qxlm3rud/wOKW74yZUiR2JUzH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
otqp9.exe

Files

otqp9.exe
.exe windows:6 windows x86 arch:x86

8a08f05f951e29daf72a243fb2aa4e67

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CloseClipboard
GetClipboardData
GetDC
GetInputState
GetSystemMetrics
GetWindowLongW
OpenClipboard
ReleaseDC

kernel32

CopyFileW
ExitProcess
GetCommandLineW
GetCurrentProcessId
GetCurrentThreadId
GetLogicalDrives
GetSystemDirectoryW
GlobalLock
GlobalUnlock

ole32

CoCreateInstance
CoInitialize
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SysStringLen
VariantClear
VariantInit

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
SelectObject
StretchBlt

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ