13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595

Sharing

Copy URL Twitter E-mail

General

Target
13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595
Size 1.2MB
Sample260722-ft79badm7w
SHA256 13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595
MD5 10d95676e5f1360a13e9b4d8ed4e2008
SHA1 aa695d4c77d68f02ee3b7787cf98be0d2173e4f7
SHA512 8684c2f18dd5af96bbe6f711bb2599667d12aa26cb7650818703dbdc091e2cb49cd674b64ba5b307b69cf8e0e468acab820929e20738a66fdbdf80109c8b6416
SSDEEP 6144:KMXSI6tEVmJqjx5r0Hyjhrl3Xd/VbDsk5UGHuojRazVUzV4QlShiUrIpqMfHdtf:z6HOhrzmk5UGVUzVUzV4MRqMjf
TLSH
T162454A71BB4BE031D95250F16B7CAABEB469FE241F6559DB63C43B690CB88C10A30F52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595

File Explorer

13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595

.exe 1.2MB

13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595

IMPHASH 9cfe4b665320bcde584bcdd51e441597
SHA256 13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595
MD5 10d95676e5f1360a13e9b4d8ed4e2008
SHA1 aa695d4c77d68f02ee3b7787cf98be0d2173e4f7
SHA512 8684c2f18dd5af96bbe6f711bb2599667d12aa26cb7650818703dbdc091e2cb49cd674b64ba5b307b69cf8e0e468acab820929e20738a66fdbdf80109c8b6416
SSDEEP 6144:KMXSI6tEVmJqjx5r0Hyjhrl3Xd/VbDsk5UGHuojRazVUzV4QlShiUrIpqMfHdtf:z6HOhrzmk5UGVUzVUzV4MRqMjf
TLSH
T162454A71BB4BE031D95250F16B7CAABEB469FE241F6559DB63C43B690CB88C10A30F52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

294546

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\qci_workspace\root-workspaces\__qci-pipeline-11444313-1\Basic\Output\BinFinal\bugreport.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

dbghelp

SymCleanup SymLoadModule SymFunctionTableAccess SymInitialize SymGetModuleInfoW SymSetOptions SymGetModuleInfo StackWalk

wininet

HttpOpenRequestA InternetOpenA InternetConnectA InternetCloseHandle InternetReadFile HttpSendRequestA

psapi

EnumProcessModules GetModuleFileNameExW GetModuleFileNameExA GetDeviceDriverFileNameW GetProcessMemoryInfo EnumProcesses GetModuleBaseNameW GetDeviceDriverBaseNameW EnumDeviceDrivers

comctl32

InitCommonControlsEx ImageList_ReplaceIcon ImageList_Create

shlwapi

SHGetValueW StrChrW PathFileExistsA StrStrW PathAppendW StrStrIW StrStrIA PathFindFileNameW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW

ws2_32

htons htonl

kernel32

SetFilePointer CreateDirectoryW SizeofResource FindFirstFileW WriteProcessMemory HeapFree SetLastError FindNextFileW GetCurrentProcess GetTempPathW InitializeCriticalSectionEx FindClose HeapSize MultiByteToWideChar Sleep CreateFileA FileTimeToSystemTime LockResource DeleteFileW HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc FileTimeToLocalFileTime HeapDestroy GetProcAddress MoveFileExW DeleteCriticalSection ReadProcessMemory GetProcessHeap GetModuleHandleW WideCharToMultiByte GetTickCount GetFileTime OpenThread VirtualQueryEx GetCommandLineW WriteFile TerminateProcess GetVersionExW OpenProcess SetEvent SetCurrentDirectoryW CreateProcessW CopyFileW SetDllDirectoryW IsDebuggerPresent SetUnhandledExceptionFilter WaitForSingleObject GlobalAlloc GlobalFree GlobalLock GlobalUnlock CreateEventW ResetEvent EnterCriticalSection VirtualFree LeaveCriticalSection OutputDebugStringW GetCurrentProcessId SetThreadPriority GetThreadPriority UnhandledExceptionFilter lstrcpynW CloseHandle VirtualQuery FreeLibrary GetFileAttributesW GetLocalTime GetSystemDefaultUILanguage GetProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW IsWow64Process lstrlenW LoadLibraryW GetModuleHandleExW InitializeCriticalSectionAndSpinCount LocalFree SwitchToThread UnmapViewOfFile CreateFileMappingW ProcessIdToSessionId QueryPerformanceCounter MapViewOfFileEx InitializeCriticalSection GetTickCount64 GetSystemDefaultLangID GetNativeSystemInfo GetSystemPowerStatus LoadLibraryA lstrcmpiW GetPrivateProfileStringA GetFileAttributesExA GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent WaitForSingleObjectEx GetLastError GetModuleFileNameW ReadFile GetCurrentThreadId GetFileSize CreateFileW GetSystemTimeAsFileTime

user32

MsgWaitForMultipleObjects PeekMessageW DispatchMessageW RegisterWindowMessageW GetDC ReleaseDC GetMenuItemCount CreatePopupMenu TrackPopupMenu DestroyMenu SendMessageTimeoutW FindWindowW GetWindowTextLengthW RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindow GetWindowRect SetWindowPos SendMessageW EndDialog SetWindowTextW ShowWindow OpenClipboard DestroyIcon ClientToScreen CloseClipboard EmptyClipboard MapWindowPoints SendDlgItemMessageW LoadIconW SetClipboardData MapDialogRect SetWindowLongW GetClientRect GetDlgItem DrawIconEx LoadImageW InvalidateRect GetWindowThreadProcessId FindWindowExW EnumChildWindows EnumWindows GetClassNameW DialogBoxParamW GetAncestor GetWindowTextW SetDlgItemTextW GetWindowLongW

gdi32

DeleteObject GetStockObject SetTextColor

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey RegEnumValueW RegQueryInfoKeyW RegSetKeySecurity RegGetKeySecurity RegNotifyChangeKeyValue RegEnumKeyExW RegFlushKey RegDeleteValueW RegDeleteKeyW RegEnumKeyW OpenProcessToken

shell32

SHCreateDirectoryExW SHGetFileInfoW ord155 SHBindToParent SHGetDesktopFolder SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize OleInitialize CoCreateGuid DoDragDrop CoRegisterClassObject OleUninitialize CoSetProxyBlanket CoInitializeSecurity CoLoadLibrary

oleaut32

VariantClear SysFreeString SysStringByteLen SysAllocStringByteLen SysAllocString SysStringLen

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?_Xout_of_range@std@@YAXPBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Xlength_error@std@@YAXPBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z

wintrust

WinVerifyTrust

vcruntime140

wcsstr strrchr _purecall wcschr strstr __std_type_info_compare __std_type_info_name strchr _CxxThrowException __std_exception_destroy memchr wcsrchr __std_terminate __current_exception_context __current_exception _except_handler4_common memset memmove memcpy __std_exception_copy __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcsncpy_s iswalnum iswalpha _wcslwr_s strnlen wcscpy_s strcpy_s wcsncat_s wcsncpy iswspace wcsncmp wcsnlen wcscat_s wmemcpy_s strncmp _wcsicmp iswdigit

api-ms-win-crt-runtime-l1-1-0

__p___argc _initterm _get_wide_winmain_command_line _beginthreadex _initialize_wide_environment _configure_wide_argv _controlfp_s _set_app_type _seh_filter_exe terminate _cexit _initterm_e _exit _c_exit _invalid_parameter_noinfo _crt_atexit _register_onexit_function _initialize_onexit_table exit _errno _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback __p___wargv

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode _callnewh _aligned_malloc _aligned_free malloc _recalloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vswscanf __stdio_common_vsnwprintf_s fwrite __stdio_common_vsprintf_s _wfopen fgets __p__commode __stdio_common_vsprintf fclose fread _set_fmode __stdio_common_vswprintf_s

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp _mbscmp _mbslwr_s

api-ms-win-crt-time-l1-1-0

_time64 _gmtime32

api-ms-win-crt-convert-l1-1-0

wcstoul atoi _i64tow_s _itow_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

Sharing

General

Malware Config

Signatures

File Explorer

13df54026095588d65ab7c5611a564f121a46a16a1120d07b3cef70a80d40595

version

dbghelp

wininet

psapi

comctl32

shlwapi

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

wintrust

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic