70ee939b45d16f51635c9e520198a70b2358beecb736f70b7b898ba6ad1f4e70

Sharing

Copy URL Twitter E-mail

General

Target

70ee939b45d16f51635c9e520198a70b2358beecb736f70b7b898ba6ad1f4e70
Size

119KB
MD5

69da21d70b3dfb8f756165ec60d33efd
SHA1

92996abb63e4fc73f8c0c6ba547f360e2c386928
SHA256

70ee939b45d16f51635c9e520198a70b2358beecb736f70b7b898ba6ad1f4e70
SHA512

b687a77acb2f2a38ef47f88aa8ddbe14d20121a35339fe686f1e3509130677dfab48c8c6b850eaaecd6963bd862907ef89659bf6cb4a59940f862f3cfab4d679
SSDEEP

1536:TCmtnGV9TTykGvo33Szp5HY7/y8M7tc6ovKCfXCiLVn2TTsEiU4Nx7:rUTTykGvv5HYDy8M7tcfLHVn2TT1iLf

Score

1^/10

Malware Config

Signatures

Files

70ee939b45d16f51635c9e520198a70b2358beecb736f70b7b898ba6ad1f4e70
.dll windows:6 windows x64 arch:x64

b2a0f1843f082ebc7d58298833bd2b0e

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:a6:8f:ee:73:f7:05:c5:89:6a:66:69:e2:6d:70:29
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

01/05/2023, 00:00

Not After

31/07/2026, 23:59

Subject

CN=K Desktop Environment e. V.,O=K Desktop Environment e. V.,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:2a:bb:d6:a3:7e:68:fb:bc:27:d7:24:4f:6e:ea:7e:9e:89:37:21:8c:04:ab:06:73:3a:05:3c:ce:4b:f6:18
Signer

Actual PE Digest

b1:2a:bb:d6:a3:7e:68:fb:bc:27:d7:24:4f:6e:ea:7e:9e:89:37:21:8c:04:ab:06:73:3a:05:3c:ce:4b:f6:18

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Imports

qt5qml

_Z17qmlRegisterModulePKcii
_ZN10QQmlEngine16contextForObjectEPK7QObject
_ZN11QQmlContext18setContextPropertyERK7QStringRK8QVariant
_ZN11QQmlContextC1EPS_P7QObject
_ZN11QQmlContextD1Ev
_ZN11QQmlPrivate11qmlregisterENS_16RegistrationTypeEPv
_ZN11QQmlPrivate30qdeclarativeelement_destructorEP7QObject
_ZN14QQmlExpression8evaluateEPb
_ZN14QQmlExpressionC1ERK16QQmlScriptStringP11QQmlContextP7QObjectS6_
_ZN14QQmlExpressionD1Ev
_ZN16QQmlCustomParser5errorERKN3QV412CompiledData8LocationERK7QString
_ZN16QQmlParserStatusC2Ev
_ZN16QQmlParserStatusD2Ev
_ZN16QQmlScriptStringC1ERKS_
_ZN16QQmlScriptStringC1Ev
_ZN16QQmlScriptStringD1Ev
_ZN16QQmlScriptStringaSERKS_
_ZN22QQmlModuleRegistrationC1EPKciPFvvE
_ZN22QQmlModuleRegistrationD1Ev
_ZN24QQmlJavaScriptExpression23setNotifyOnValueChangedEb
_ZN25QQmlBoundSignalExpression8evaluateERK5QListI8QVariantE
_ZN25QQmlBoundSignalExpressionC1EP7QObjectiP15QQmlContextDataS1_PN3QV48FunctionEPNS4_16ExecutionContextE
_ZN25QQmlEngineExtensionPlugin11qt_metacallEN11QMetaObject4CallEiPPv
_ZN25QQmlEngineExtensionPlugin11qt_metacastEPKc
_ZN25QQmlEngineExtensionPlugin16initializeEngineEP10QQmlEnginePKc
_ZN25QQmlEngineExtensionPlugin16staticMetaObjectE
_ZN25QQmlEngineExtensionPluginC2EP7QObject
_ZN25QQmlEngineExtensionPluginD2Ev
_ZN32QQmlBoundSignalExpressionPointer4takeEP25QQmlBoundSignalExpression
_ZN32QQmlBoundSignalExpressionPointerC1EP25QQmlBoundSignalExpression
_ZN32QQmlBoundSignalExpressionPointerD1Ev
_ZN3QV413QObjectMethod11static_vtblE
_ZN3QV415ExecutionEngine11fromVariantERK8QVariant
_ZN3QV416QmlSignalHandler11static_vtblE
_ZN3QV422PersistentValueStorage8allocateEv
_ZN3QV422PersistentValueStorage9getEngineEPNS_5ValueE
_ZN5QtQml10qmlWarningEPK7QObject
_ZN8QJSValueC1ENS_12SpecialValueE
_ZN8QJSValueC1ERKS_
_ZN8QJSValueD1Ev
_ZN8QJSValueaSERKS_
_ZN8QQmlInfoD1Ev
_ZN9QQmlErrorD1Ev
_ZNK11QQmlContext6engineEv
_ZNK16QQmlScriptString7isEmptyEv
_ZNK16QQmlScriptStringeqERKS_
_ZNK8QJSValue14strictlyEqualsERKS_
_ZTV16QQmlCustomParser
_ZThn16_N25QQmlEngineExtensionPlugin16initializeEngineEP10QQmlEnginePKc

qt5core

_ZN10QArrayData10deallocateEPS_yy
_ZN10QArrayData11shared_nullE
_ZN10QArrayData8allocateEyyy6QFlagsINS_16AllocationOptionEE
_ZN10QByteArray11reallocDataEj6QFlagsIN10QArrayData16AllocationOptionEE
_ZN10QByteArray6appendEPKc
_ZN10QByteArray6appendEc
_ZN10QByteArrayC1EPKci
_ZN11QFinalState11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QFinalState11qt_metacastEPKc
_ZN11QFinalState16staticMetaObjectE
_ZN11QFinalState5eventEP6QEvent
_ZN11QFinalState6onExitEP6QEvent
_ZN11QFinalState7onEntryEP6QEvent
_ZN11QFinalStateC2EP6QState
_ZN11QFinalStateD2Ev
_ZN11QMetaObject10ConnectionD1Ev
_ZN11QMetaObject14normalizedTypeEPKc
_ZN11QMetaObject8activateEP7QObjectPKS_iPPv
_ZN11QTextStreamlsERK7QString
_ZN11QTextStreamlsEc
_ZN13QHistoryState11qt_metacallEN11QMetaObject4CallEiPPv
_ZN13QHistoryState11qt_metacastEPKc
_ZN13QHistoryState16staticMetaObjectE
_ZN13QHistoryState5eventEP6QEvent
_ZN13QHistoryState6onExitEP6QEvent
_ZN13QHistoryState7onEntryEP6QEvent
_ZN13QHistoryStateC2EP6QState
_ZN13QHistoryStateD2Ev
_ZN13QStateMachine10setRunningEb
_ZN13QStateMachine11eventFilterEP7QObjectP6QEvent
_ZN13QStateMachine11qt_metacallEN11QMetaObject4CallEiPPv
_ZN13QStateMachine11qt_metacastEPKc
_ZN13QStateMachine12endMicrostepEP6QEvent
_ZN13QStateMachine14beginMicrostepEP6QEvent
_ZN13QStateMachine16staticMetaObjectE
_ZN13QStateMachine20endSelectTransitionsEP6QEvent
_ZN13QStateMachine22beginSelectTransitionsEP6QEvent
_ZN13QStateMachine5eventEP6QEvent
_ZN13QStateMachine6onExitEP6QEvent
_ZN13QStateMachine7onEntryEP6QEvent
_ZN13QStateMachineC2EP7QObject
_ZN13QStateMachineD2Ev
_ZN14QAbstractState16staticMetaObjectE
_ZN15QtSharedPointer20ExternalRefCountData9getAndRefEPK7QObject
_ZN17QSignalTransition11qt_metacallEN11QMetaObject4CallEiPPv
_ZN17QSignalTransition11qt_metacastEPKc
_ZN17QSignalTransition12onTransitionEP6QEvent
_ZN17QSignalTransition15setSenderObjectEPK7QObject
_ZN17QSignalTransition16staticMetaObjectE
_ZN17QSignalTransition5eventEP6QEvent
_ZN17QSignalTransition9eventTestEP6QEvent
_ZN17QSignalTransition9setSignalERK10QByteArray
_ZN17QSignalTransitionC2EP6QState
_ZN17QSignalTransitionC2EPK7QObjectPKcP6QState
_ZN17QSignalTransitionD2Ev
_ZN18QMetaObjectPrivate11signalIndexERK11QMetaMethod
_ZN19QAbstractTransition16staticMetaObjectE
_ZN6QState11qt_metacallEN11QMetaObject4CallEiPPv
_ZN6QState11qt_metacastEPKc
_ZN6QState13addTransitionEP19QAbstractTransition
_ZN6QState16removeTransitionEP19QAbstractTransition
_ZN6QState16staticMetaObjectE
_ZN6QState5eventEP6QEvent
_ZN6QState6onExitEP6QEvent
_ZN6QState7onEntryEP6QEvent
_ZN6QStateC2EPS_
_ZN6QStateD2Ev
_ZN6QTimer11setIntervalEi
_ZN6QTimer5startEv
_ZN6QTimerC1EP7QObject
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject5eventEP6QEvent
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE
_ZN7QObject9setParentEPS_
_ZN7QString15fromUtf8_helperEPKci
_ZN7QString16fromAscii_helperEPKci
_ZN7QString18toLocal8Bit_helperEPK5QChari
_ZN7QStringC1EPK5QChari
_ZN8QVariantC1ERKS_
_ZN8QVariantD1Ev
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData5eraseEPPv
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData7disposeEPNS_4DataE
_ZN9QMetaType22registerNormalizedTypeERK10QByteArrayPFvPvEPFS3_S3_PKvEi6QFlagsINS_8TypeFlagEEPK11QMetaObject
_ZN9QMetaType25registerNormalizedTypedefERK10QByteArrayi
_ZNK11QMetaMethod14parameterNamesEv
_ZNK11QMetaMethod15methodSignatureEv
_ZNK11QMetaObject2trEPKcS1_i
_ZNK11QMetaObject4castEP7QObject
_ZNK11QMetaObject6methodEi
_ZNK11QMetaObject9classNameEv
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK13QHistoryState10metaObjectEv
_ZNK13QStateMachine9isRunningEv
_ZNK14QAbstractState6activeEv
_ZNK14QAbstractState7machineEv
_ZNK14QMessageLogger7warningEPKcz
_ZNK17QSignalTransition10metaObjectEv
_ZNK17QSignalTransition12senderObjectEv
_ZNK6QState10metaObjectEv
_ZNK6QState12initialStateEv
_ZNK6QState9childModeEv
_ZNK7QString3argERKS_i5QChar
_ZNK7QStringeqE13QLatin1String
_ZNK8QVariant6toBoolEv

libc++

_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdlPv
_Znwy
__cxa_guard_acquire
__cxa_guard_release

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc

api-ms-win-crt-private-l1-1-0

memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort

api-ms-win-crt-string-l1-1-0

strcmp
strlen
strncmp

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fwrite

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/16867
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2a0f1843f082ebc7d58298833bd2b0e

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

74:a6:8f:ee:73:f7:05:c5:89:6a:66:69:e2:6d:70:29Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b1:2a:bb:d6:a3:7e:68:fb:bc:27:d7:24:4f:6e:ea:7e:9e:89:37:21:8c:04:ab:06:73:3a:05:3c:ce:4b:f6:18Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

qt5qml

qt5core

libc++

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 21KB - Virtual size: 20KB

.buildid Size: 512B - Virtual size: 53B

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 1KB

.qtmetad Size: 512B - Virtual size: 116B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 856B

.reloc Size: 1024B - Virtual size: 892B

/16867 Size: 512B - Virtual size: 32B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

74:a6:8f:ee:73:f7:05:c5:89:6a:66:69:e2:6d:70:29
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b1:2a:bb:d6:a3:7e:68:fb:bc:27:d7:24:4f:6e:ea:7e:9e:89:37:21:8c:04:ab:06:73:3a:05:3c:ce:4b:f6:18
Signer

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 21KB - Virtual size: 20KB

.buildid
Size: 512B - Virtual size: 53B

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 1KB

.qtmetad
Size: 512B - Virtual size: 116B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 1024B - Virtual size: 892B

/16867
Size: 512B - Virtual size: 32B