Qqj9C4ktU8[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Qqj9C4ktU8.exe
Size

18.7MB
MD5

e59ec8028bae3f29ced2c16eb3a37c62
SHA1

a42aa0f25d309f5dd99b78e04d7073ba89c6bdc0
SHA256

472aa329e76c7a11185aeeb4d0c7d09f0b9d412dc7de6b44c2af3d3a47dc76a4
SHA512

3cb1e9166412693e79ea59e44df9d7cf03ef90ebda2500c216efd363bd9e05f831308ddf17b3a08f6b707e00ec6691ed988ee7a6eb295e5e53a3b45783016920
SSDEEP

393216:fMekIEdKVZ0YSWz/TlGf2FbA3LgfzPIkDGIpL058ZcBeySi6t:UekIE8ZlSeTU3AHD9S6coyv6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Qqj9C4ktU8.exe

resource
Qqj9C4ktU8.exe

Files

Qqj9C4ktU8.exe
.exe windows:6 windows x64 arch:x64

2e55e7b332bdc7b90ac5b4b7a6e6efe5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FreeLibrary
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

wsprintfW

gdi32

CreateSolidBrush

advapi32

RegDeleteKeyW

shell32

SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal

iphlpapi

GetAdaptersAddresses

shlwapi

SHDeleteKeyW

dbghelp

ImageDirectoryEntryToData

ntdll

RtlCaptureContext

ws2_32

socket

gdiplus

GdipGetImageHeight

uxtheme

SetWindowTheme

Sections

.text
Size: 542KB - Virtual size: 542KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mRf
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

aMz
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CJu
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 955B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e55e7b332bdc7b90ac5b4b7a6e6efe5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

iphlpapi

shlwapi

dbghelp

ntdll

ws2_32

gdiplus

uxtheme

Sections

.text Size: 542KB - Virtual size: 542KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 3.9MB - Virtual size: 3.9MB

.pdata Size: 20KB - Virtual size: 19KB

_RDATA Size: 512B - Virtual size: 252B

.sdata Size: 512B - Virtual size: 512B

mRf Size: 8.2MB - Virtual size: 8.2MB

aMz Size: 3KB - Virtual size: 3KB

CJu Size: 5.9MB - Virtual size: 5.9MB

.reloc Size: 4KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 955B

.text
Size: 542KB - Virtual size: 542KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 3.9MB - Virtual size: 3.9MB

.pdata
Size: 20KB - Virtual size: 19KB

_RDATA
Size: 512B - Virtual size: 252B

.sdata
Size: 512B - Virtual size: 512B

mRf
Size: 8.2MB - Virtual size: 8.2MB

aMz
Size: 3KB - Virtual size: 3KB

CJu
Size: 5.9MB - Virtual size: 5.9MB

.reloc
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 955B