Quantum Entropy Candle[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Quantum Entropy Candle.exe
Size 4.2MB
Sample260804-3a5emsshje
SHA256 d6b40e165cf32bac52407672b316175937a3ab192f1f1dcd8a04d927a672e1e1
MD5 69a61ed3418dc78a7aa0c64ec9d7ac2a
SHA1 da6093aaa72e25f7a6135be1e8dcb6a2ed97d9e0
SHA512 d88fde32894374b39de728eee110ad5ab0e6bb14603a9a6dffdce1fb7f9d179be4901b4f52c32eea2f3823101a0dde1c6d6c9f963e5c12f84f2e1124a90fe4c5
SSDEEP 49152:0v0IUvRAg0JLSccJBJzJ87HwJ3FcfYOpyrFPEaQ95dJvNoWHtBBP2xCsYXf7cGiM:sUqJLCXJzJLOWRnO3oOP2w/gGiAjRCEb
TLSH
T1FC16CF43F6A350ECC01AC174875AA623FA75B8894B107EEB5680D7363E75EE06F39724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Quantum Entropy Candle.exe

File Explorer

Quantum Entropy Candle.exe

.exe 4.2MB

Quantum Entropy Candle.exe

IMPHASH 6a22d89a6164510e6f0359a29dfe19a9
SHA256 d6b40e165cf32bac52407672b316175937a3ab192f1f1dcd8a04d927a672e1e1
MD5 69a61ed3418dc78a7aa0c64ec9d7ac2a
SHA1 da6093aaa72e25f7a6135be1e8dcb6a2ed97d9e0
SHA512 d88fde32894374b39de728eee110ad5ab0e6bb14603a9a6dffdce1fb7f9d179be4901b4f52c32eea2f3823101a0dde1c6d6c9f963e5c12f84f2e1124a90fe4c5
SSDEEP 49152:0v0IUvRAg0JLSccJBJzJ87HwJ3FcfYOpyrFPEaQ95dJvNoWHtBBP2xCsYXf7cGiM:sUqJLCXJzJLOWRnO3oOP2w/gGiAjRCEb
TLSH
T1FC16CF43F6A350ECC01AC174875AA623FA75B8894B107EEB5680D7363E75EE06F39724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2287224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CancelIo CloseHandle CompareStringEx CompareStringOrdinal CompareStringW CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateIoCompletionPort CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DecodePointer DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetUserDefaultLCID GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MapViewOfFile MultiByteToWideChar OpenProcess PostQueuedCompletionStatus Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFileCompletionNotificationModes SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx

user32

AddClipboardFormatListener CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard EnumDisplaySettingsA FlashWindowEx GetClientRect GetClipboardData GetCursorPos GetDesktopWindow GetWindowRect InvalidateRect LoadCursorA LoadImageA MessageBoxA OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA RemoveClipboardFormatListener ScreenToClient SetClipboardData SetCursor SetLayeredWindowAttributes SetWindowPos ShowWindow TranslateMessage UnregisterClassA UpdateWindow

shell32

ShellExecuteA

d3d11

D3D11CreateDeviceAndSwapChain

ole32

CoCreateInstance CoInitialize CoUninitialize

d3dcompiler_43

D3DCompile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegOpenKeyExW RegQueryValueExW RegSetValueExW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockopt ioctlsocket recv send setsockopt socket

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptStringToBinaryA

ncrypt

NCryptCreatePersistedKey NCryptDecrypt NCryptDeleteKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile RtlNtStatusToDosError

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

489KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

305B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

1.2MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Quantum Entropy Candle.exe

kernel32

user32

shell32

d3d11

ole32

d3dcompiler_43

api-ms-win-core-synch-l1-2-0

advapi32

ws2_32

secur32

crypt32

ncrypt

bcryptprimitives

ntdll

generic