QuantumFree[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
QuantumFree.exe
Size 761KB
Sample260705-3pgbcsb19p
SHA256 dbdd677111cdfd533a41d099623fd00d810767575266c4aab3c9f1ceef092dc7
MD5 98fdcb55ce097ef41b5c70f8f7d136f7
SHA1 aea158369d2903a5b94a9725a0dc9f9908692580
SHA512 be5776b2327fe43c7d924a0a587a0cd90b54f90be32276d1c8f2cfec39c494350670c0c9b98ed83864e4cc88d10e8397a64dc05eb6c517d49a4b83b7402e03b9
SSDEEP 12288:81B0HR2Z4WKrTdXnBrw2gXwz3LUZTiPny+BPUdhyC6YLK2eoo9J:WB0x2ZYrTdXnZw2gX+LUJiPnNBPUdh+v
TLSH
T11FF4BF45F7F446F4C17BA13895A6AB1BF636748807209ADB23E401192FB77E04FBA361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
QuantumFree.exe

File Explorer

QuantumFree.exe

.exe 761KB

QuantumFree.exe

IMPHASH aefd38f267fd8fa25c7da2dda6e227eb
SHA256 dbdd677111cdfd533a41d099623fd00d810767575266c4aab3c9f1ceef092dc7
MD5 98fdcb55ce097ef41b5c70f8f7d136f7
SHA1 aea158369d2903a5b94a9725a0dc9f9908692580
SHA512 be5776b2327fe43c7d924a0a587a0cd90b54f90be32276d1c8f2cfec39c494350670c0c9b98ed83864e4cc88d10e8397a64dc05eb6c517d49a4b83b7402e03b9
SSDEEP 12288:81B0HR2Z4WKrTdXnBrw2gXwz3LUZTiPny+BPUdhyC6YLK2eoo9J:WB0x2ZYrTdXnZw2gX+LUJiPnNBPUdh+v
TLSH
T11FF4BF45F7F446F4C17BA13895A6AB1BF636748807209ADB23E401192FB77E04FBA361
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

458740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

kernel32

SetConsoleTitleA GetStdHandle DeviceIoControl WaitForSingleObject CreateFileW CreateToolhelp32Snapshot Sleep Process32Next CloseHandle Beep lstrcmpiA CreateProcessA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte SetEvent Process32First GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter DeleteCriticalSection GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetConsoleTextAttribute CreateEventW WaitForSingleObjectEx ResetEvent EnterCriticalSection GlobalUnlock

user32

FindWindowA GetWindowLongA GetKeyState LoadCursorA ScreenToClient ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor PeekMessageA GetClientRect SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxA DispatchMessageA SetWindowPos GetSystemMetrics ShowWindow GetAsyncKeyState SetWindowLongA SetMenu SetLayeredWindowAttributes UpdateWindow TranslateMessage mouse_event GetCursorPos

shell32

ShellExecuteA

ole32

CoInitialize

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Query_perf_frequency ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Throw_C_error@std@@YAXH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Thrd_sleep _Query_perf_counter _Xtime_get_ticks _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler strstr _CxxThrowException __current_exception memcmp __std_exception_copy __std_exception_destroy memmove memset __std_terminate memchr memcpy

api-ms-win-crt-stdio-l1-1-0

fclose fseek __stdio_common_vsprintf_s ftell __p__commode __stdio_common_vsscanf __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fflush _set_fmode fread __acrt_iob_func

api-ms-win-crt-heap-l1-1-0

realloc free _callnewh _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

strncpy strcmp tolower toupper strncmp

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-runtime-l1-1-0

_set_app_type _cexit _get_initial_narrow_environment _initterm _initterm_e exit _exit _invalid_parameter_noinfo_noreturn __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _crt_atexit terminate _configure_narrow_argv _register_onexit_function _initialize_narrow_environment _initialize_onexit_table _seh_filter_exe system

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

_fdclass fmodf powf acos acosf sinf sqrt sqrtf ldexp asin atan2 tanf cosf ceilf __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale