QuickTimePlayer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
QuickTimePlayer.exe
Size 7.3MB
Sample260720-a3cacaat7p
SHA256 ad429b2090f63d2e98033446917557b5fd567291bb83017b666c934593efd8db
MD5 c46b4757b45b08b30a67e3a071b65515
SHA1 bc7afdf03803be7afa36b1d9f160bb82d346f929
SHA512 dd25f4d5cb9d44854e961dea08eaa606762785610bb1c5fa26aafb5787a1acf770a23f998880de5855561c20dac517573479d406a62d9be5201116d22df4536b
SSDEEP 49152:xLEqd2U9wlO92iZSkHi2f3myAJao/f9Rk8/MPbqo:xQU9UiZSkHXmyAJauk8/Mv
TLSH
T1A176C4105FE94998E0A70E704AB5514D945B7D985FB642CB7ABEF8393F70EC008B336A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
QuickTimePlayer.exe

File Explorer

QuickTimePlayer.exe

.exe 7.3MB

QuickTimePlayer.exe

IMPHASH 688c89ca77eda95ecab5ff6585e2aa5f
SHA256 ad429b2090f63d2e98033446917557b5fd567291bb83017b666c934593efd8db
MD5 c46b4757b45b08b30a67e3a071b65515
SHA1 bc7afdf03803be7afa36b1d9f160bb82d346f929
SHA512 dd25f4d5cb9d44854e961dea08eaa606762785610bb1c5fa26aafb5787a1acf770a23f998880de5855561c20dac517573479d406a62d9be5201116d22df4536b
SSDEEP 49152:xLEqd2U9wlO92iZSkHi2f3myAJao/f9Rk8/MPbqo:xQU9UiZSkHXmyAJauk8/Mv
TLSH
T1A176C4105FE94998E0A70E704AB5514D945B7D985FB642CB7ABEF8393F70EC008B336A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5b:46:e3:d3:1e:45:a9:58:dc:63:2f:ea:93:9d:68:ed

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Serial Number

09:5e:20:a8:0b:54:a4:5d:36:f6:c0:6b:9b:02:f9:3a

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 27, 2007 - Jun 26, 2009

Minor OS version

Major OS version

Entry point

1157290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bwa\QuickTimePlayerWin-472\srcroot\QuickTimePlayerWin\Projects\Release\QuickTimePlayer.pdb

psapi

GetProcessMemoryInfo

version

GetFileVersionInfoA GetFileVersionInfoW GetFileVersionInfoSizeA VerQueryValueW VerQueryValueA GetFileVersionInfoSizeW

winmm

timeGetTime timeEndPeriod timeBeginPeriod timeKillEvent timeSetEvent

wininet

InternetCrackUrlW InternetCreateUrlW

comctl32

ImageList_Create _TrackMouseEvent ImageList_Draw InitCommonControlsEx ImageList_AddMasked

shell32

SHGetSettings DragQueryFileW ord74 SHGetFolderPathW SHParseDisplayName SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW ShellExecuteW SHChangeNotify CommandLineToArgvW ShellExecuteA SHGetMalloc SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoInitialize CoUninitialize StringFromGUID2 CoCreateInstance OleLockRunning CoGetClassObject CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal OleInitialize OleUninitialize OleDuplicateData DoDragDrop StringFromCLSID ReleaseStgMedium OleRun CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream RegisterDragDrop CoLockObjectExternal RevokeDragDrop CoFreeUnusedLibraries CoTaskMemAlloc

oleaut32

VarBstrCmp SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SysAllocStringByteLen SafeArrayCreate SafeArrayGetElement SafeArrayDestroy VariantChangeType DispCallFunc OleCreateFontIndirect VariantClear VariantInit SysStringByteLen LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysAllocStringLen SysFreeString SysStringLen

gdiplus

GdipFillRectangle GdipSetStringFormatMeasurableCharacterRanges GdipGetGenericFontFamilySansSerif GdipCloneImage GdipCloneBrush GdipCreateFontFromLogfontA GdipMeasureString GdipDrawImageRectRectI GdipDrawString GdipCreateFromHDC GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipMeasureCharacterRanges GdipSetClipRegion GdipSaveGraphics GdipRestoreGraphics GdipCreateRegion GdipCreateFont GdipCreateFontFromDC GdipSaveImageToFile GdipCloneStringFormat GdipCreateSolidFill GdipCreatePath GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteFont GdipGetImageThumbnail GdipDeleteStringFormat GdipDeleteBrush GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipFree GdipCreateRegionRectI GdipCreateFromHWND GdipBitmapGetPixel GdipGetImageHeight GdipGetImageWidth GdipGetRegionHRgn GdipCombineRegionRectI GdipDeleteRegion GdipSetPenColor GdipResetPath GdipClosePathFigure GdipAddPathLine GdipAddPathArc GdipAddPathBezier GdipGetImageGraphicsContext GdipGetDC GdipReleaseDC GdipSetSmoothingMode GdipDeleteGraphics GdiplusStartup GdiplusShutdown GdipDeletePath GdipFlush GdipGetImageEncoders GdipGetPathWorldBoundsI GdipSetEmpty GdipCombineRegionPath GdipGetImageBounds GdipCreateTexture GdipSetSolidFillColor GdipSetLineBlend GdipTranslateLineTransform GdipCreatePen1 GdipStringFormatGetGenericDefault GdipDeletePen GdipCreateLineBrushFromRectI GdipSetImageAttributesWrapMode GdipSetPenWidth GdipGetImageEncodersSize GdipCloneBitmapAreaI GdipDrawImageRectI GdipGraphicsClear GdipSetInterpolationMode GdipSetCompositingMode GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipGetImageType GdipSetPixelOffsetMode GdipDrawPath GdipFillPath GdipFillRegion

kernel32

GetVersionExA GetModuleHandleA LoadLibraryA FreeResource QueryPerformanceCounter GetProcessTimes QueryPerformanceFrequency OpenProcess GetSystemInfo GetEnvironmentVariableA SetEnvironmentVariableA ReadFile IsProcessorFeaturePresent InterlockedCompareExchange SetFilePointer HeapFree VirtualFree VirtualAlloc RtlUnwind HeapReAlloc TerminateProcess UnhandledExceptionFilter IsDebuggerPresent FileTimeToSystemTime FileTimeToLocalFileTime GetFileAttributesW GetCommandLineA GetStartupInfoA ExitProcess HeapDestroy HeapCreate GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize SetHandleCount GetFileType GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW VirtualQuery LCMapStringA LCMapStringW FlushFileBuffers GetTimeZoneInformation SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEndOfFile GetThreadLocale GetModuleFileNameA OutputDebugStringA CreateFileA GetCurrentThread GetThreadPriority SetThreadPriority ReleaseSemaphore CreateSemaphoreW WaitForMultipleObjects DuplicateHandle ResetEvent lstrcpynW GetLocaleInfoA GetFileAttributesA GetSystemDirectoryA GetTimeFormatW GetDateFormatW GetEnvironmentVariableW CloseHandle GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateFileW GetProcAddress GetLastError LoadLibraryW GetModuleHandleW SetUnhandledExceptionFilter lstrlenW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection lstrcmpiW GetModuleFileNameW lstrcpyW WaitForSingleObject CreateMutexW ReleaseMutex Sleep FreeLibrary CreateThread CreateEventW InterlockedIncrement InterlockedDecrement SetEvent FlushInstructionCache lstrcmpW MulDiv GlobalUnlock GlobalLock GlobalAlloc SetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetCommandLineW DeleteFileW GetDiskFreeSpaceExW GetTickCount TryEnterCriticalSection OutputDebugStringW GlobalFree GetTempPathW InterlockedExchange GetLongPathNameW GlobalSize WideCharToMultiByte LockResource FindClose FindNextFileW FindFirstFileW SetErrorMode GetLocaleInfoW GetVersionExW LocalAlloc HeapAlloc GetProcessHeap FormatMessageW WriteFile CreateMutexA

user32

PostThreadMessageW UnregisterClassW RegisterClipboardFormatW RegisterWindowMessageA RegisterWindowMessageW DefWindowProcW GetSysColor MoveWindow SetWindowPos GetClientRect ClientToScreen ScreenToClient wsprintfW ReleaseDC InvalidateRect InvalidateRgn RedrawWindow SetCapture IsChild GetParent GetDlgItem GetClassNameW ReleaseCapture FillRect DestroyWindow CallWindowProcW EndPaint BeginPaint GetDesktopWindow DestroyAcceleratorTable GetWindow GetFocus SetFocus SendMessageW IsWindow GetClassInfoExW LoadCursorW RegisterClassExW CreateWindowExW CreateAcceleratorTableW SetWindowTextW GetWindowTextW GetWindowTextLengthW LoadAcceleratorsW LoadBitmapW SetTimer PostMessageW CopyRect SetRect SetWindowRgn GetWindowRect ShowWindow GetKeyState KillTimer InflateRect GetSysColorBrush AdjustWindowRectEx GetMenuItemInfoW DeleteMenu GetSubMenu GetMenuItemCount PtInRect DestroyMenu GetCursorPos GetCapture TrackPopupMenuEx AppendMenuW CreatePopupMenu IsWindowUnicode GetPropW SystemParametersInfoW BringWindowToTop InsertMenuItemW GetMenuItemID InsertMenuW GetMenuStringW GetMonitorInfoW MonitorFromPoint UpdateWindow EnableMenuItem MessageBoxW PostQuitMessage GetWindowThreadProcessId MonitorFromRect RemoveMenu LoadMenuW LoadIconW SetPropW SetForegroundWindow IsRectEmpty TranslateAcceleratorW GetMessagePos GetMessageTime GetSystemMetrics DrawTextW IsWindowVisible PeekMessageW IntersectRect OffsetRect ChildWindowFromPoint UnhookWindowsHookEx ToUnicode GetKeyboardState VkKeyScanW IsMenu ModifyMenuW SetMenuItemInfoW GetMenuState GetActiveWindow SendMessageA CallNextHookEx SetWindowsHookExW EnumChildWindows CharUpperBuffA SetCursorPos IsWindowEnabled MapVirtualKeyW GetDoubleClickTime SetCursor IsDialogMessageW GetWindowInfo DrawFocusRect SetActiveWindow MapWindowPoints EnableWindow GetDlgCtrlID EndDialog DialogBoxParamW CreateDialogParamW CheckDlgButton SetDlgItemTextW IsDlgButtonChecked GetDlgItemTextW CheckRadioButton SendDlgItemMessageW MessageBoxIndirectW CreateDialogIndirectParamW MapDialogRect SetRectEmpty GetDialogBaseUnits GetWindowPlacement SetWindowTextA MessageBeep ValidateRect IsZoomed GetGuiResources LoadStringA MsgWaitForMultipleObjects GetDC DdeUninitialize DdeFreeStringHandle DdeAccessData DdeCmpStringHandles DdeNameService DdeConnect DdeCreateStringHandleW DdeInitializeW wsprintfA DialogBoxParamA GetQueueStatus wvsprintfW LoadStringW GetMessageW DispatchMessageW TranslateMessage GetWindowLongW SetWindowLongW CharUpperW CharNextW UnregisterClassA CheckMenuItem DdeClientTransaction

gdi32

MoveToEx GetTextExtentExPointW GetDIBits ExtSelectClipRgn EndDoc EndPage StartPage StartDocW CreateFontIndirectW LineTo GetTextMetricsW OffsetWindowOrgEx CreatePen GetObjectA StretchBlt CreateDIBitmap TextOutW RestoreDC SelectClipRgn CreateRectRgnIndirect SaveDC CreateDIBSection SetViewportOrgEx GetViewportOrgEx SetROP2 SetWindowOrgEx CreateRectRgn LPtoDP CombineRgn SetBkColor SetBkMode GetTextExtentPoint32W GetTextExtentPoint32A CreateRoundRectRgn GetPixel CreatePolygonRgn GetStockObject GetObjectW CreateSolidBrush GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject SetPixel SetTextColor DeleteObject

comdlg32

GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError PrintDlgW GetFileTitleW PageSetupDlgW ChooseColorW

advapi32

RegEnumValueA RegCreateKeyExA RegEnumKeyW RegOpenKeyExA RegDeleteValueA RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumKeyExW RegQueryValueExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegOpenKeyA

shlwapi

PathIsURLW PathRemoveExtensionW PathStripPathW PathAddBackslashW PathAppendW PathIsDirectoryW PathStripToRootW PathFileExistsW PathRemoveFileSpecW

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

33B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

148KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=126, version=50327,

count=50, id=125, productName=VS2005 build 50727, version=50727,

count=6, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=59, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=28, version=9178,

count=9, id=98, version=3077,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=617, id=1, productName=Unmarked objects,

count=21, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=6, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=117, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=222, id=109, productName=VS2005 build 50727, version=50727,

count=205, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, productName=Unmarked objects (old),

count=1, id=120, productName=VS2005 build 50727, version=50727,