QDNMh9s7a1d4H[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

QDNMh9s7a1d4H.exe
Size

1.6MB
MD5

37e74144523ecfc5faa2d9025d697f0b
SHA1

03ea5028a3983e93e879b9cb03965647f3c3260a
SHA256

266b9ddef38bdefecd84daa76f8a194ec7197984d4bfd808edfe0c4d96d2c2be
SHA512

4c95293d04e7df2a32f9bdb3bbbf3ce622e7410bb980126c9b9179da77179a6d541e4de1dd52fbe9555cf567df49aa7097b244dd17973d92a226d9e842e4eb5d
SSDEEP

24576:2JKLjar18a8AfEHM/rVJREqGgtcOVyyn5hEw:Ifru0cs/TREqGEbn3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
QDNMh9s7a1d4H.exe

Files

QDNMh9s7a1d4H.exe
.exe windows:6 windows x64 arch:x64

6b2ba3031500b6999aa59fe2839700a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LocalFree
GetCurrentProcessId
DecodePointer
GetConsoleOutputCP
SetStdHandle
CloseHandle
GlobalFree
GlobalAlloc
GetLastError
GetConsoleMode
GetCurrentThreadId
LocalAlloc
FindClose
GetStdHandle
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
ReadFile
GetFileSizeEx
WriteFile
SetErrorMode
SetFilePointer
CreateFileW
SetFilePointerEx
GetModuleHandleW
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
AttachConsole
OutputDebugStringW
WriteConsoleW
Process32First
CreateToolhelp32Snapshot
Process32Next
GetModuleFileNameW
GetTickCount
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
GetEnvironmentVariableA
SetEnvironmentVariableA
CancelIo
DeviceIoControl
WaitForSingleObject
CreateEventW
FormatMessageW
CreateFileA
LoadLibraryW
ResetEvent
GetOverlappedResult
VerSetConditionMask
VerifyVersionInfoW
GetSystemInfo
GlobalMemoryStatusEx
GetCurrentProcess
TerminateProcess
ExitProcess
VirtualFree
VirtualAlloc
VirtualQuery
SetThreadExecutionState
SetThreadPriority
GetCurrentThread
RaiseException
CreateThread
IsDebuggerPresent
CreateDirectoryW
LoadLibraryExW
WideCharToMultiByte
MulDiv
TlsSetValue
TlsAlloc
TlsGetValue
CompareStringA
GetModuleHandleExW
GlobalLock
GlobalUnlock
GetSystemPowerStatus
GetLocaleInfoA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
TlsFree
EncodePointer
RtlPcToFileHeader
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers

user32

PeekMessageW
ClientToScreen
DestroyIcon
SetTimer
DispatchMessageW
GetAsyncKeyState
RegisterClassExW
UnregisterClassW
GetSystemMetrics
CallNextHookEx
ScreenToClient
GetPropW
GetMenu
GetWindowRect
PostMessageW
CallWindowProcW
GetMessageExtraInfo
GetKeyState
AdjustWindowRectEx
DefWindowProcW
GetMessageW
GetWindowLongW
RegisterClassExA
UnregisterDeviceNotification
UnregisterClassA
CreateWindowExA
RegisterDeviceNotificationW
DestroyWindow
RegisterWindowMessageA
GetDesktopWindow
ReleaseDC
SystemParametersInfoW
DrawTextW
GetDlgItem
SystemParametersInfoA
SetFocus
DialogBoxIndirectParamW
GetWindowLongPtrW
EndDialog
SetWindowLongPtrW
GetDC
GetRawInputDeviceList
GetRawInputDeviceInfoA
PostThreadMessageW
TrackMouseEvent
GetRawInputData
SetCursorPos
ReleaseCapture
SetCapture
LoadCursorW
CreateIconIndirect
CopyImage
SetWindowRgn
ToUnicode
GetKeyboardLayout
GetKeyboardState
MapVirtualKeyW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
ChangeDisplaySettingsExW
GetWindowTextW
SetForegroundWindow
PtInRect
SetWindowLongW
FlashWindowEx
SetWindowsHookExW
SetPropW
IntersectRect
SetLayeredWindowAttributes
UnhookWindowsHookEx
CreateIconFromResource
AttachThreadInput
RegisterClassW
ShowWindow
SetWindowTextW
RemovePropW
SendMessageW
SetActiveWindow
SetWindowPos
GetFocus
GetWindowTextLengthW
GetWindowThreadProcessId
IsClipboardFormatAvailable
SetClipboardData
GetClipboardSequenceNumber
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetClipCursor
RegisterRawInputDevices
GetForegroundWindow
IsRectEmpty
GetUpdateRect
TranslateMessage
LoadIconW
ClipCursor
SetCursor
GetClientRect
KillTimer
GetClassInfoExW
InvalidateRect
IsIconic
GetCursorPos
GetDoubleClickTime
ValidateRect
MessageBoxA
CreateWindowExW
GetParent

wininet

HttpOpenRequestA

winmm

waveOutPrepareHeader
waveInStart
waveInOpen
timeBeginPeriod
timeEndPeriod
waveInGetDevCapsW
waveInAddBuffer
waveOutOpen
waveOutClose
waveOutGetDevCapsW
waveInGetNumDevs
waveOutGetNumDevs
waveOutGetErrorTextW
waveOutWrite
waveInPrepareHeader
waveInClose
waveOutUnprepareHeader
waveInUnprepareHeader
waveOutReset
waveInReset

setupapi

SetupDiEnumDeviceInfo
CM_Get_Parent
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
CM_Get_Device_IDA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

imm32

ImmGetCandidateListW
ImmNotifyIME
ImmSetCandidateWindow
ImmSetCompositionStringW
ImmAssociateContext
ImmGetIMEFileNameA
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

gdi32

SelectObject
CreateBitmap
DeleteObject
CreateDIBSection
CombineRgn
CreateCompatibleDC
DeleteDC
CreateDCW
GetICMProfileW
CreateFontIndirectW
GetTextExtentPoint32A
GetDeviceCaps
CreateRectRgn
BitBlt
DescribePixelFormat
ChoosePixelFormat
SwapBuffers
GetPixelFormat
SetPixelFormat
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateCompatibleBitmap
GetDIBits
GetTextMetricsW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

DragAcceptFiles
ShellExecuteW
SHGetFolderPathW
ExtractIconExW
DragQueryFileW
DragFinish

ole32

PropVariantClear
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx

oleaut32

SysFreeString

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 341KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b2ba3031500b6999aa59fe2839700a0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

wininet

winmm

setupapi

version

imm32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 341KB - Virtual size: 340KB

.data Size: 28KB - Virtual size: 44KB

.pdata Size: 61KB - Virtual size: 61KB

.gxfg Size: 4KB - Virtual size: 4KB

.gehcont Size: 512B - Virtual size: 12B

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 341KB - Virtual size: 340KB

.data
Size: 28KB - Virtual size: 44KB

.pdata
Size: 61KB - Virtual size: 61KB

.gxfg
Size: 4KB - Virtual size: 4KB

.gehcont
Size: 512B - Virtual size: 12B

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 7KB - Virtual size: 6KB