e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd

Sharing

Copy URL Twitter E-mail

General

Target
e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd
Size 13.5MB
Sample260722-bc2yratvcs
SHA256 e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd
MD5 6106fac3f7b8ac067d6990e5d577a8a5
SHA1 26f790bec802a535ebf0b6d0d843a6bee8c4cf52
SHA512 480abfe099576242f8c27b0e8e4c62598c7d7927723932e6ed495b8544682733cec345fca9d90e723e3fbff2385cc22075735fdb0650ade25516a85ba15a76fa
SSDEEP 196608:rfo7ev0lD7fix5KDvdJWjQT4qXPmoEp0N9f/:s760sx5KDvdjZP3N9
TLSH
T1CCE6BF23938C06E8F059EC379C98973B83B43C578B62494B606A66D15EF0DD8C73DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd

File Explorer

e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd

.exe 13.5MB

e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd

IMPHASH c7a382554a04214385c29745af02555c
SHA256 e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd
MD5 6106fac3f7b8ac067d6990e5d577a8a5
SHA1 26f790bec802a535ebf0b6d0d843a6bee8c4cf52
SHA512 480abfe099576242f8c27b0e8e4c62598c7d7927723932e6ed495b8544682733cec345fca9d90e723e3fbff2385cc22075735fdb0650ade25516a85ba15a76fa
SSDEEP 196608:rfo7ev0lD7fix5KDvdJWjQT4qXPmoEp0N9f/:s760sx5KDvdjZP3N9
TLSH
T1CCE6BF23938C06E8F059EC379C98973B83B43C578B62494B606A66D15EF0DD8C73DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11059349

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qt6widgets

??1QWidget@@UEAA@XZ

qt6gui

??0QIcon@@QEAA@AEBVQString@@@Z

qt6core

?activate@QMetaObject@@SAXPEAVQObject@@PEBU1@HPEAPEAX@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-math-l1-1-0

cos

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

SetUnhandledExceptionFilter CancelWaitableTimer CloseHandle CompareStringW ConvertThreadToFiber CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateProcessW CreateSemaphoreA CreateThread CreateTimerQueueTimer CreateToolhelp32Snapshot CreateWaitableTimerA DecodePointer DefineDosDeviceA DeleteCriticalSection DeleteFiber DeleteFileW DeleteTimerQueueTimer DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetComputerNameW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeA GetDriveTypeW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadUILanguage GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersion GetVersionExA GetVolumeInformationA HeapAlloc HeapFree HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalAlloc LocalFree MapViewOfFile Module32First Module32Next MoveFileExW MultiByteToWideChar OpenFileMappingA OpenMutexA OpenProcess OpenSemaphoreA OpenThread OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryDosDeviceA QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSemaphore RemoveDirectoryW ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SearchPathA SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

shell32

CommandLineToArgvW

advapi32

DeregisterEventSource RegisterEventSourceA

user32

CallNextHookEx EnableMenuItem EnumWindows GetDlgItem GetSystemMenu GetWindowThreadProcessId KillTimer MessageBoxA PeekMessageA PostMessageA SendMessageA SetTimer SetWindowsHookExA ShowWindow UnhookWindowsHookEx wsprintfA

Name

.text

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.merged

Size

13.3MB

Virtual Size

13.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

e05daf50e6d4453450b5e7738e020c87bc516f62ebbedac477e4cddca9022fdd

qt6widgets

qt6gui

qt6core

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

shell32

advapi32

user32

generic