H:\QT_Client\finalrelease\20140324ForCFDemo\QQTalk\Output\Bin\QT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b9feaa94b5b0f9a50f47c1eb62c6b396c511aa0f84835d311013dd6d59a1ae5cN.exe
Resource
win7-20240903-en
General
-
Target
b9feaa94b5b0f9a50f47c1eb62c6b396c511aa0f84835d311013dd6d59a1ae5cN.exe
-
Size
619KB
-
MD5
005c809ed8415f5ea94e2d979dbe49c0
-
SHA1
3be7fe9b186976574db872faf28a7e79df282154
-
SHA256
b9feaa94b5b0f9a50f47c1eb62c6b396c511aa0f84835d311013dd6d59a1ae5c
-
SHA512
4c154888501fb415b1685edd930653e461b74e58c65b35f52c54d1d9f18ef4985a6f4833acb05816c34d550588ab1b1ee7bdb2fb7d654c1f7f0235900c947907
-
SSDEEP
12288:ENR/3fG88888888S88888888888888888888888888888888888888888888888p:c3fG88888888S888888888888888888F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9feaa94b5b0f9a50f47c1eb62c6b396c511aa0f84835d311013dd6d59a1ae5cN.exe
Files
-
b9feaa94b5b0f9a50f47c1eb62c6b396c511aa0f84835d311013dd6d59a1ae5cN.exe.exe windows:4 windows x86 arch:x86
bc5b7856f795cc3006925d1a4ca239ec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetTickCount
GetFileAttributesW
GetPrivateProfileStringW
FindFirstFileW
GetModuleFileNameW
FindNextFileW
FindClose
GetLocaleInfoA
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
RaiseException
RtlUnwind
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
Sleep
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
InitializeCriticalSection
CreateFileW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
CreateFileA
SetEndOfFile
ReadFile
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
shell32
SHGetFolderPathW
ShellExecuteW
shlwapi
PathFindFileNameW
PathFileExistsW
Sections
.text Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 520KB - Virtual size: 520KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE