0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911

Sharing

Copy URL Twitter E-mail

General

Target
0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911
Size 392KB
Sample260701-2axt5aft7j
SHA256 0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911
MD5 c0b4a8cae8962c7fa2ac5a17c2e1d04b
SHA1 8cde7885a0dddb65f8f76a710235f26938372ead
SHA512 3fb11dcc4f5e3b15b75b9f8288f9124e8ebd648398bffedb70344f609993781486c980a628b6fd1f5400af1a3e39d5792914c655b2ec1b6805927bdc66965157
SSDEEP 6144:jGfgiVNwQMUPQTYemzfr9znhXWZo6zl4vEzh0d4uj43Z2MMW/gmqoP7TR8ZHw:IBVN4UPAYNj9hMKEzh0dljiZNMJCpqw
TLSH
T1A1847B12B7809034E26203318B69E75258FDBD715DA2551FF3E83E6D19306C3BA36B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911

File Explorer

0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911

.exe 392KB

0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911

IMPHASH 1278ac8aa364e9d4e87aaa3f1324c3e4
SHA256 0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911
MD5 c0b4a8cae8962c7fa2ac5a17c2e1d04b
SHA1 8cde7885a0dddb65f8f76a710235f26938372ead
SHA512 3fb11dcc4f5e3b15b75b9f8288f9124e8ebd648398bffedb70344f609993781486c980a628b6fd1f5400af1a3e39d5792914c655b2ec1b6805927bdc66965157
SSDEEP 6144:jGfgiVNwQMUPQTYemzfr9znhXWZo6zl4vEzh0d4uj43Z2MMW/gmqoP7TR8ZHw:IBVN4UPAYNj9hMKEzh0dljiZNMJCpqw
TLSH
T1A1847B12B7809034E26203318B69E75258FDBD715DA2551FF3E83E6D19306C3BA36B9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\workspace\qb_driver_service\master\out\Release\QQUrlMgr_QQ88.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW GetModuleInformation

kernel32

GetCurrentProcessId GetCurrentThreadId GetModuleHandleW SetErrorMode GetProcAddress InitializeCriticalSection WriteProcessMemory SetUnhandledExceptionFilter GetCurrentProcess CreateToolhelp32Snapshot Thread32First Thread32Next OpenThread SuspendThread EnterCriticalSection CreateEventW DuplicateHandle SearchPathW CreateProcessW WaitForMultipleObjects TerminateProcess ReadProcessMemory VirtualAllocEx GetVersionExW GetSystemDefaultLangID GetSystemInfo CreateThread TerminateThread GetSystemTimeAsFileTime InterlockedCompareExchange MultiByteToWideChar DeviceIoControl GetLastError GetSystemDirectoryW LoadLibraryW FreeLibrary GetFileSize ReadFile WaitForSingleObject CopyFileW FindFirstFileW FindClose WideCharToMultiByte LocalFree InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection GetModuleHandleExW CreateProcessA ResumeThread GetThreadContext SetThreadContext GetCurrentThread GetModuleFileNameW VirtualAlloc VirtualProtect SetLastError GetModuleHandleA GetPrivateProfileIntA SetFilePointer GetTickCount GlobalFindAtomW GlobalAddAtomW GetExitCodeThread GetPrivateProfileStringW Process32FirstW Process32NextW SizeofResource LockResource LoadResource FindResourceW FindResourceExW OpenEventW SetEvent LoadLibraryExW RaiseException DecodePointer MoveFileExW FindNextFileW ConnectNamedPipe CreateNamedPipeW WaitNamedPipeW DisconnectNamedPipe GetLocalTime GetFileAttributesW FindFirstFileA GetPrivateProfileStringA GetModuleFileNameA FindNextFileA SetHandleInformation CreatePipe CreateDirectoryW LCMapStringW CompareStringW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc UnhandledExceptionFilter GetCPInfo VirtualQuery GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CloseHandle Sleep WriteFile CreateFileW SetFileAttributesW DeleteFileW GetLocaleInfoW IsValidLocale GetUserDefaultLCID SetStdHandle SetEndOfFile FlushFileBuffers WriteConsoleW FlushInstructionCache SetEnvironmentVariableA RtlUnwind GetCommandLineW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetConsoleCP FreeEnvironmentStringsW GetEnvironmentStringsW GetDriveTypeW FindFirstFileExW IsProcessorFeaturePresent GetStringTypeW EncodePointer OutputDebugStringW IsDebuggerPresent ExitProcess QueryPerformanceCounter SetFilePointerEx ReadConsoleW GetConsoleMode GetTimeZoneInformation GetCurrentDirectoryW GetFullPathNameW PeekNamedPipe GetFileType GetFileInformationByHandle FileTimeToLocalFileTime GetOEMCP GetACP IsValidCodePage GetStdHandle EnumSystemLocalesW

user32

KillTimer PostQuitMessage TranslateMessage SetTimer PostThreadMessageW GetMessageW PeekMessageW IsWindow FindWindowW SendMessageTimeoutW

advapi32

SetSecurityDescriptorSacl GetSecurityDescriptorSacl FreeSid SetEntriesInAclW ConvertStringSecurityDescriptorToSecurityDescriptorW AllocateAndInitializeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteKeyW RegQueryInfoKeyW RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegDeleteValueW RegCloseKey RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryValueA

shell32

SHGetSpecialFolderPathW SHGetFolderPathW SHGetFolderPathA

ole32

CoInitialize CoCreateGuid CoUninitialize

shlwapi

PathFileExistsW PathFindFileNameW PathFileExistsA wnsprintfA wnsprintfW SHGetValueA

wininet

HttpSendRequestA HttpOpenRequestW InternetConnectW InternetSetOptionW InternetOpenA InternetCloseHandle

ws2_32

htonl htons

netapi32

Netbios NetWkstaTransportEnum NetApiBufferFree

urlmon

URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

0f00d75cc4987f5437c741e18e3366560a47dca1e733305e042a2d6a1c319911

version

psapi

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

ws2_32

netapi32

urlmon

generic