009a1e1a6e7d68d11252538033e73cc5ad0fa4187507d510606cc2151ef77bdd[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

009a1e1a6e7d68d11252538033e73cc5ad0fa4187507d510606cc2151ef77bdd.exe
Size

284KB
MD5

254e25d9c245c1c31195abf07c33ace8
SHA1

abb2f7c53bdba666327ca57e84858b0f2d06b32f
SHA256

009a1e1a6e7d68d11252538033e73cc5ad0fa4187507d510606cc2151ef77bdd
SHA512

2505dff96fb1ef123d865e027a163be1535d918d07145c0f27b8881c235ebf66d3d40bd8f7d10eaa9288aa8a70eb70238ee34cdd514c4f6bd87a84d7b177c909
SSDEEP

3072:PyMOh3r78V+l1zYJ6c5ya6by1VwEgvI1S9eWHfkq6VEf2h0xqE:PKr78fsGyhv6iDSVEf28/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
009a1e1a6e7d68d11252538033e73cc5ad0fa4187507d510606cc2151ef77bdd.exe

Files

009a1e1a6e7d68d11252538033e73cc5ad0fa4187507d510606cc2151ef77bdd.exe
.dll windows:4 windows x86 arch:x86

5cb155d5a0c338ff9fffe264aeb4fa33

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\qt\4.6.2\plugins\imageformats\qtiff46.pdb

Imports

qtgui46

?size@QImage@@QBE?AVQSize@@XZ
?isNull@QImage@@QBE_NXZ
?setColorTable@QImage@@QAEXV?$QVector@I@@@Z
?setDotsPerMeterX@QImage@@QAEXH@Z
?setDotsPerMeterY@QImage@@QAEXH@Z
?mirrored@QImage@@QBE?AV1@_N0@Z
??0QMatrix@@QAE@XZ
?rotate@QMatrix@@QAEAAV1@N@Z
?transformed@QImage@@QBE?AV1@ABVQMatrix@@W4TransformationMode@Qt@@@Z
?dotsPerMeterX@QImage@@QBEHXZ
?dotsPerMeterY@QImage@@QBEHXZ
?logicalDpiX@QPaintDevice@@QBEHXZ
?logicalDpiY@QPaintDevice@@QBEHXZ
?colorTable@QImage@@QBE?AV?$QVector@I@@XZ
?copy@QImage@@QBE?AV1@HHHH@Z
?scanLine@QImage@@QAEPAEH@Z
?convertToFormat@QImage@@QBE?AV1@W4Format@1@V?$QFlags@W4ImageConversionFlag@Qt@@@@@Z
?setFormat@QImageIOHandler@@QBEXABVQByteArray@@@Z
??1QImageIOHandler@@UAE@XZ
??0QImageIOHandler@@QAE@XZ
?jumpToNextImage@QImageIOHandler@@UAE_NXZ
?jumpToImage@QImageIOHandler@@UAE_NH@Z
?loopCount@QImageIOHandler@@UBEHXZ
?imageCount@QImageIOHandler@@UBEHXZ
?nextImageDelay@QImageIOHandler@@UBEHXZ
?currentImageNumber@QImageIOHandler@@UBEHXZ
?currentImageRect@QImageIOHandler@@UBE?AVQRect@@XZ
?height@QImage@@QBEHXZ
?width@QImage@@QBEHXZ
?format@QImage@@QBE?AW4Format@1@XZ
??0QImage@@QAE@HHW4Format@0@@Z
?bits@QImage@@QAEPAEXZ
??4QImage@@QAEAAV0@ABV0@@Z
??1QImage@@UAE@XZ
?device@QImageIOHandler@@QBEPAVQIODevice@@XZ
??1QImageIOPlugin@@UAE@XZ
??0QImageIOPlugin@@QAE@PAVQObject@@@Z
?metaObject@QImageIOPlugin@@UBEPBUQMetaObject@@XZ
?qt_metacast@QImageIOPlugin@@UAEPAXPBD@Z
?qt_metacall@QImageIOPlugin@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?setDevice@QImageIOHandler@@QAEXPAVQIODevice@@@Z
?setFormat@QImageIOHandler@@QAEXABVQByteArray@@@Z

qtcore46

deflateParams
inflateEnd
deflateEnd
deflate
deflateReset
deflateInit_
inflate
inflateSync
inflateReset
inflateInit_
?qMalloc@@YAPAXI@Z
?reallocate@QVectorData@@SAPAU1@PAU1@HHH@Z
?qMemSet@@YAPAXPAXHI@Z
?allocate@QVectorData@@SAPAU1@HH@Z
?qBadAlloc@@YAXXZ
?free@QVectorData@@SAXPAU1@H@Z
?type@QVariant@@QBE?AW4Type@1@XZ
?toInt@QVariant@@QBEHPA_N@Z
??0QVariant@@QAE@ABVQSize@@@Z
??0QVariant@@QAE@H@Z
??0QVariant@@QAE@XZ
??0QByteArray@@QAE@PBD@Z
?qWarning@@YAXPBDZZ
?peek@QIODevice@@QAE?AVQByteArray@@_J@Z
?fromRawData@QByteArray@@SA?AV1@PBDH@Z
??1QByteArray@@QAE@XZ
?write@QIODevice@@QAE_JPBD_J@Z
?read@QIODevice@@QAE_JPAD_J@Z
?fromLatin1_helper@QString@@CAPAUData@1@PBDH@Z
?append@QListData@@QAEPAPAXXZ
??1QString@@QAE@XZ
?detach3@QListData@@QAEPAUData@1@XZ
?qFree@@YAXPAX@Z
?isOpen@QIODevice@@QBE_NXZ
?isReadable@QIODevice@@QBE_NXZ
?isWritable@QIODevice@@QBE_NXZ
?free@QString@@CAXPAUData@1@@Z
??0QString@@QAE@ABV0@@Z
?changeGuard@QMetaObject@@SAXPAPAVQObject@@PAV2@@Z
?removeGuard@QMetaObject@@SAXPAPAVQObject@@@Z
?shared_null@QListData@@2UData@1@A
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?connectNotify@QObject@@MAEXPBD@Z
?disconnectNotify@QObject@@MAEXPBD@Z
?qstrcmp@@YAHABVQByteArray@@PBD@Z

msvcp71

?_Nomemory@std@@YAXXZ

msvcr71

__CxxFrameHandler
_CxxThrowException
floor
_CIpow
strncmp
qsort
_assert
fprintf
bsearch
sprintf
rand
vfprintf
_iob
malloc
_callnewh
??1type_info@@UAE@XZ
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
__CppXcptFilter
_except_handler3
?terminate@@YAXXZ
??3@YAXPAX@Z

kernel32

DisableThreadLibraryCalls
GlobalSize
GlobalFree
GlobalAlloc

Exports

Exports

qt_plugin_instance
qt_plugin_query_verification_data

Sections

.text
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5cb155d5a0c338ff9fffe264aeb4fa33

Headers

File Characteristics

PDB Paths

Imports

qtgui46

qtcore46

msvcp71

msvcr71

kernel32

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 128KB

.rdata Size: 128KB - Virtual size: 126KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 816B

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 132KB - Virtual size: 128KB

.rdata
Size: 128KB - Virtual size: 126KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 816B

.reloc
Size: 12KB - Virtual size: 8KB