c:\Windows\qzdm\qzdmtray.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6dc4bda907824ad9ed2bb86949cdeeff9527d2c715679f6163b7c88dd9683d03.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6dc4bda907824ad9ed2bb86949cdeeff9527d2c715679f6163b7c88dd9683d03.exe
Resource
win10v2004-20240802-en
General
-
Target
6dc4bda907824ad9ed2bb86949cdeeff9527d2c715679f6163b7c88dd9683d03
-
Size
5.0MB
-
MD5
d9d12a8f2ad9966f30667ffa26ebc17e
-
SHA1
5d1601014afac3ad8a5345dc3ab26ae31a073691
-
SHA256
6dc4bda907824ad9ed2bb86949cdeeff9527d2c715679f6163b7c88dd9683d03
-
SHA512
9e9bf4065f62bc5df12bd50cfaca00c3d121b368ab3a43db26a4fb5464eaa05e6982ea9f4a14a714eec568ad8d579c4075723f9198d22b9d938d0a08a98794fd
-
SSDEEP
24576:axid/LJk1fh/Yt53WMJ72ea3Cz7Y7pL9mgZufq6D1P0wn+7b3E1:arWT7S3PpL9orS3E1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6dc4bda907824ad9ed2bb86949cdeeff9527d2c715679f6163b7c88dd9683d03
Files
-
6dc4bda907824ad9ed2bb86949cdeeff9527d2c715679f6163b7c88dd9683d03.exe windows:4 windows x64 arch:x64
75a97101ce876a5ba1db8d984357c9bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
psapi
GetModuleBaseNameW
EnumProcessModules
EnumProcesses
sqlite3
sqlite3_busy_timeout
sqlite3_errmsg
sqlite3_open
sqlite3_open16
sqlite3_key
sqlite3_finalize
sqlite3_step
sqlite3_column_text
sqlite3_column_count
sqlite3_free
sqlite3_mprintf
sqlite3_close
sqlite3_exec
sqlite3_prepare
emailmodule
SendEmail
mfc80u
ord5781
ord2344
ord290
ord2679
ord589
ord316
ord5437
ord632
ord3223
ord4425
ord6099
ord2552
ord5646
ord6097
ord5643
ord6091
ord4192
ord6094
ord5924
ord6074
ord5762
ord5677
ord5682
ord5558
ord5623
ord5449
ord5436
ord5957
ord5754
ord3208
ord336
ord600
ord5648
ord5672
ord4144
ord4061
ord1021
ord6295
ord394
ord643
ord2300
ord2308
ord3959
ord2772
ord5750
ord1199
ord1195
ord4109
ord3875
ord913
ord5744
ord2475
ord306
ord6204
ord3624
ord4155
ord3679
ord5091
ord4595
ord3430
ord2393
ord2907
ord1564
ord6104
ord2818
ord568
ord757
ord2897
ord2179
ord332
ord1193
ord6326
ord774
ord5354
ord6337
ord5365
ord3283
ord1811
ord3330
ord6210
ord6216
ord310
ord6323
ord2396
ord4780
ord1817
ord424
ord663
ord1574
ord2395
ord2183
ord921
ord796
ord300
ord3429
ord5907
ord1816
ord1818
ord1102
ord2923
ord795
ord4572
ord3711
ord577
ord769
ord1079
ord3858
ord1126
ord1064
ord6011
ord2267
ord3361
ord4512
ord2862
ord5601
ord5247
ord5264
ord4599
ord3976
ord5260
ord5258
ord2955
ord1938
ord3860
ord5416
ord6258
ord5134
ord1022
ord3834
ord5618
ord2037
ord2082
ord4357
ord6318
ord3829
ord6316
ord4043
ord4067
ord6244
ord1935
ord4384
ord338
ord2074
ord450
ord559
ord4073
ord687
ord5751
ord1450
ord2149
ord6056
ord2594
ord1101
ord452
ord689
ord5493
ord5528
ord2731
ord2726
ord3271
ord1013
ord2499
ord3210
ord911
ord784
ord288
ord289
ord4136
ord4113
ord2289
ord1255
ord874
ord4026
ord5598
ord6213
ord6219
ord2493
ord2150
ord1258
ord3013
ord3356
ord766
ord3911
ord2682
ord2891
ord393
ord642
ord2040
ord3116
ord1867
ord1809
ord1173
ord4129
ord2113
ord3272
ord1292
ord1973
ord1435
ord265
ord1949
ord1493
ord4127
ord2108
ord1557
ord4265
ord3199
ord5909
ord602
ord5524
ord5563
ord4135
ord1498
ord285
ord280
ord788
ord6129
ord3451
ord1555
ord4263
ord3192
ord1921
ord1134
ord2397
ord1095
ord1744
ord5868
ord6102
ord3790
ord2392
ord3712
ord574
ord3232
ord598
ord3017
ord2105
ord2492
ord910
ord914
ord1495
ord2290
ord5597
ord4025
ord293
ord2958
ord1491
ord5216
ord4243
ord4766
ord4922
ord2039
ord1686
ord1685
ord1561
ord3079
ord5948
ord1636
ord1633
ord3974
ord1411
ord4275
ord5186
ord1926
ord5105
ord6315
ord4216
ord5237
ord3431
ord4753
ord4313
ord1610
ord5996
ord5269
ord5267
ord935
ord940
ord944
ord942
ord946
ord2415
ord2435
ord2419
ord2425
ord2423
ord2421
ord2438
ord2433
ord2417
ord2440
ord2428
ord2410
ord2412
ord2430
ord2197
ord2191
ord1532
ord6317
ord3830
ord6319
ord3373
ord4999
ord1371
ord5209
ord1982
ord1671
ord1670
ord1609
ord5234
ord2562
ord2755
ord2859
ord4338
ord2738
ord2886
ord2565
ord2671
ord2558
ord3746
ord3747
ord3737
ord2669
ord3977
ord4517
ord4293
ord5675
ord1288
ord614
ord355
ord721
ord512
ord789
ord5766
ord4351
ord1289
ord1073
ord3903
ord4611
ord2491
ord2906
ord296
ord4133
ord6276
ord3669
ord1812
ord1910
ord3189
ord3238
ord1952
ord3191
ord670
ord583
ord772
ord3258
ord4292
ord2984
ord5248
ord4269
ord1412
ord5951
ord3080
ord2111
ord588
ord286
ord617
ord362
ord3469
ord786
ord776
ord2342
ord266
ord2520
ord1216
ord1189
ord5904
msvcr80
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
_amsg_exit
__C_specific_handler
strcpy_s
strlen
memset
memcpy
vsprintf_s
_msize
_purecall
_gcvt_s
_fpclass
_set_errno
_CxxThrowException
wcstod
_wcstoi64
_ui64toa_s
_i64toa_s
isspace
_get_errno
strtol
_wcstoui64
wcsncmp
wcsnlen
_scwprintf
_ultoa_s
strncmp
_strlwr_s
_recalloc
calloc
_itow_s
_resetstkoflw
strtoul
towupper
_access
swprintf_s
vswprintf_s
ftell
memcpy_s
tolower
atol
_itoa_s
realloc
memmove
memmove_s
_findclose
_findnext64i32
_findfirst64i32
sprintf_s
_mktime64
wcsstr
iswspace
isalnum
strrchr
strstr
fflush
fseek
wprintf
fread
fwrite
strncpy
wcsncpy
_errno
_wcslwr
fprintf
__iob_func
fwprintf
_localtime64_s
printf
_wcsicmp
strchr
wcschr
fclose
fputs
_wfopen
wcsftime
_time64
_vswprintf
vwprintf
vsprintf
vprintf
strftime
_localtime64
_wrename
_wremove
_wopen
wcstol
?what@exception@std@@UEBAPEBDXZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBQEBD@Z
??0exception@std@@QEAA@XZ
_invalid_parameter_noinfo
sprintf
atoi
free
malloc
wcsncpy_s
wcscpy_s
wcscat_s
_wsplitpath
_waccess
_wtoi
_swprintf
wcsrchr
_chsize
_close
_strlwr
_itoa
_stricmp
_mkdir
__CxxFrameHandler3
ceil
_HUGE
kernel32
WaitForSingleObject
GetExitCodeProcess
GetFileSize
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetSystemDirectoryW
OutputDebugStringA
GetSystemDirectoryA
GetFileAttributesW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
FindClose
CopyFileW
lstrcpynW
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
GetNamedPipeHandleStateW
WaitNamedPipeW
CreateMutexW
CreateFileW
GlobalLock
CreateThread
lstrlenW
lstrlenA
CreateEventW
TerminateThread
GetVersionExW
GetDriveTypeW
OpenEventW
DeleteFileA
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
GetLocalTime
GetFileAttributesExW
GetVersion
Beep
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
SetLastError
VirtualQueryEx
VirtualAllocEx
ResumeThread
GetEnvironmentVariableW
GetStartupInfoW
QueryPerformanceCounter
GlobalAlloc
LoadResource
GetModuleFileNameW
CreateProcessW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateDirectoryW
GetLastError
InitializeCriticalSectionAndSpinCount
AreFileApisANSI
OutputDebugStringW
GetTickCount
GetVolumeInformationW
GetSystemWindowsDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
OpenProcess
CloseHandle
GlobalUnlock
GlobalFree
FindResourceW
SizeofResource
SetEvent
LockResource
GetCurrentThreadId
GetSystemTimeAsFileTime
GetFileSizeEx
SetFilePointer
ReadFile
WriteFile
FlushFileBuffers
CreateFileMappingW
MapViewOfFile
SetFileAttributesW
GetSystemInfo
UnmapViewOfFile
ReleaseMutex
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapSize
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DeleteFileW
user32
SetForegroundWindow
ShowWindow
MessageBoxTimeoutW
LoadStringA
FindWindowExW
IsMenu
GetSubMenu
GetMenu
GetMenuItemID
GetMenuItemCount
RegisterWindowMessageW
PostQuitMessage
LoadIconW
FindWindowW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetDlgItem
SetWindowTextW
SetWindowLongW
DrawIcon
IsIconic
GetSystemMetrics
AppendMenuW
GetSystemMenu
SystemParametersInfoW
SetWindowRgn
wsprintfW
KillTimer
PtInRect
GetFocus
GetActiveWindow
MessageBoxW
IsWindow
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
EqualRect
GetClientRect
GetWindowLongW
LoadStringW
MessageBoxA
PostMessageW
GetParent
InvalidateRect
LoadImageW
GetSysColor
CopyRect
SetMenuDefaultItem
DeleteMenu
GetCursorPos
TrackPopupMenu
FillRect
SetTimer
LoadMenuW
SendMessageW
LoadBitmapW
GetWindowRect
EnableWindow
DrawFocusRect
gdi32
CreateSolidBrush
CreateFontW
CombineRgn
GetPixel
CreateRectRgn
GetStockObject
GetTextExtentPoint32W
PtVisible
TextOutW
ExtTextOutW
Escape
CreateFontIndirectW
GetObjectW
CreateCompatibleBitmap
SelectObject
BitBlt
CreateCompatibleDC
CreatePatternBrush
RectVisible
comdlg32
GetSaveFileNameW
advapi32
GetUserNameA
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
RegOpenKeyW
shell32
SHGetPathFromIDListW
SHGetPathFromIDListA
SHGetMalloc
SHChangeNotify
SHFileOperationW
ShellExecuteW
Shell_NotifyIconW
SHGetSpecialFolderLocation
ShellExecuteExW
comctl32
InitCommonControlsEx
shlwapi
StrStrIW
ole32
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoUninitialize
oleaut32
SysFreeString
VariantClear
VariantInit
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
msvcp80
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAXXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@AEBV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_K_W_K@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA?AV12@_K0@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@H@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@0@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2_KB
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@AEBV01@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@_K0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA?AV12@_K0@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K1@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PEBDAEBV10@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PEBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEBV10@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@PEBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@_K0AEBV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KAEBV12@_K@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@PEB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAXXZ
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEA_W_K@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAXAEAV12@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2_KB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEBV10@PEBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@AEBV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_K@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@AEBV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAX_K@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PEB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PEBD@Z
netapi32
NetApiBufferFree
NetUserEnum
ftpclient
FtpClient
setruledata
InitWorkThread
gdiplus
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRect
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
iphlpapi
GetAdaptersInfo
GetNetworkParams
ws2_32
WSARecv
WSAGetOverlappedResult
WSASetEvent
ntohl
accept
listen
WSACreateEvent
getaddrinfo
WSASend
bind
WSAResetEvent
inet_ntoa
gethostbyname
WSAStartup
inet_addr
htons
socket
closesocket
ioctlsocket
connect
select
getsockopt
send
recv
WSACleanup
setsockopt
freeaddrinfo
WSASetLastError
WSAEnumNetworkEvents
WSACloseEvent
WSASocketW
WSAGetLastError
WSAConnect
WSAEventSelect
procmodule
UnInitRenameShare
Proc_StartModule
Proc_StopModule
InitRenameShare
keyboardmodule
?Keyboard_InstallHook@@YAHXZ
?Keyboard_UnInstallHook@@YAXXZ
wtsapi32
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
encryptfilehead
EncryptFileHead
Sections
.text Size: 866KB - Virtual size: 865KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 298KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ