quis[.]exe | Triage™

General

Target
quis.exe
Size 669KB
Sample260804-yjbfpsdj6x
SHA256 9bb943340f1b6bf6cff15334ab9b0ab32740455f50f76a779f1735445cb521ae
MD5 b31093312532079c8278c6d5c1a1f2e2
SHA1 842b41dd249f589becdb81b520500390f62a8b5e
SHA512 7bee052bf5a97d4085e08f3917750ec05e346cf15b78b66e711dc71ccc999eccf4c8e5b056664fbfab4e803a503fdf8e43b14dee72fec1208b854bea4f36bd7b
SSDEEP 12288:1tCn2prJlN/MgqQHy/vBzsk5pmKQpxxO1T65HNwkfJfVnjKho0TV3xjIRDAtIKZp:1tC2prJlN/MgqQHy/vBzsk5pmKQpxxOf
TLSH
T1DCE40E8F4A7444D1DC2572B290DABA0EDA14ACAEDDAD51FE1E562F18E93CC09CD0F139
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
quis.exe

File Explorer

quis.exe

.exe 669KB

quis.exe

SHA256 9bb943340f1b6bf6cff15334ab9b0ab32740455f50f76a779f1735445cb521ae
MD5 b31093312532079c8278c6d5c1a1f2e2
SHA1 842b41dd249f589becdb81b520500390f62a8b5e
SHA512 7bee052bf5a97d4085e08f3917750ec05e346cf15b78b66e711dc71ccc999eccf4c8e5b056664fbfab4e803a503fdf8e43b14dee72fec1208b854bea4f36bd7b
SSDEEP 12288:1tCn2prJlN/MgqQHy/vBzsk5pmKQpxxO1T65HNwkfJfVnjKho0TV3xjIRDAtIKZp:1tC2prJlN/MgqQHy/vBzsk5pmKQpxxOf
TLSH
T1DCE40E8F4A7444D1DC2572B290DABA0EDA14ACAEDDAD51FE1E562F18E93CC09CD0F139
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

208000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AcceptParticle AcceptTrigger AccordionMirrorBack ActivateCollider ActivateMatchRoundTrip ActivateMeasurement ActivationInfer ActiveEnclave ActiveTile AdapterMultiplexMipmap AdapterThroughputAcceleration AdaptiveApplyForce AdaptiveFCancellation AdaptiveGap AdaptiveGraceful AdaptiveInfer AdaptiveNonce AdaptiveTapScale AdjacencyRolloutPositional AdjacencyWrapper AlbedoBandwidth AmbassadorAdapterTTL AmbassadorFade AmbassadorPatternInsets Animate AnisotropySchedule ApplyTorqueKey ApplyTorqueRespawnKey ArchiveNormalizeBatch AssertionAttestation AttestationGestureRefresh AttestationNavmesh AttestationRebuildHaptic AttestationTunnel AvatarThroughput BackRagdoll BackendHeadPrecision BackendShardMask Backoff BackoffSchedule BackoffStroke BackpropBlueGreen BadgeEdgeStep BadgeMinibatchTimeout BaggageDamperTrace BandwidthBackendNavmesh BandwidthHydrateReorder BandwidthReadiness BandwidthSchedule BatchNormalizeMAP BatchPing BiasSidecarBreakpoint BiomeSafeAreaCE BleuOrchestrationBreaker BleuSaltKinematic BlockActiveSalt BlueGreenAnisotropyTokenize BlueGreenEase BlueGreenPatch BlueGreenRaycast BoneBeam BorderAccept BorderHopForceful BorderTrack Boxcast BoxcastDeprovisionTTL BreakerAUC BreakerNAT BreakpointGapThrottle BrokerDespawnExchange BrokerOverlapBaggage BurstNextHop BurstReorder CEECTRebalance CEEvict CERetryFlip CEScale CanaryPool CellGapScheduler ChallengeGradientRoute CheckboxBlendRotate ChipSweep ChipTruncate ChunkReadiness CircuitBreakRebuildShadow CircuitManager ClaimEvict ClaimFill ClaimTransformerStateless ClampRagdoll ClassEvictResponse ClassShutdown ClassifyKinematic ClothTimeout CloudThumbAttestation ColdBaggage CompactMultiplexAnisotropy CompactRotateTowardsVelocity Compaction ConcludeAccelerationAUC CongestionGesture ConsensusFilter ConsensusShadow ConsensusTrain ConstraintAddVelocity ConstraintDiff ContainerFieldOrchestration ControllerTTL CorridorRenderTile CorruptDecapsulate CredentialArchiveMinibatch CronPersistent CronTunnel CrossEntropyPatternSlide CuckooPersonalizeCanary DSCPResume DSCPRetryNAT DaemonHelper DaemonNextHop DamperBatchBounce DamperRolling DeadlineFailover DecapsulateScheduleActivation DehydrateEmitter DehydrateRepairSpan DemultiplexScheduleCorrupt Despawn DewBackpropSpan DialDropdownShadow DialFixedUpdate DialLongPress DialWaypoint DiscoverResponse DownstreamTokenizeRevoke DragBackDial DragROC DragResponseTrack DragStartup DropdownBandwidthCE DropdownLeaseRotate DynamicHandler DynamicPanBackprop ECNSaltLogit ECNWarm ECTChallengeGradient ECTDiff EdgeDaemonRotateTowards EdgeDropout EdgeSchedule ElevationAdaptiveLerp ElevationManager EmbedLOD EmbeddingAcceptRouge EmbeddingAdapter EmissiveActive EmissiveTruncate EncapsulateViewport EnclaveLODExpire EnclaveMigrate EncoderAssertionDeployment EncoderBurst EphemeralProcessor EpochDrag EpochMoveTowards EpochPropagationRestore EvaluateFreezeCollider EvaluateSkip EvictBreaker ExchangeAddVelocity ExtrapolateOverlapReorder FamilyUpstreamAmbassador FeatureReshard FocusExpireSoftmax FogRaycast ForceCanary ForcefulFeedForward ForcefulPrecision ForcefulRoundTrip ForwardNavmesh ForwardReorder FragmentTTLStateless FunctionAccordionRollout FunctionEmbedVortex GatewayKnockback GatewayScaleSalt GestureMask GestureRepair GoodputEncapsulate GradientBackPrefetch GradientHelper GradientResolver GradientSpringPan GraphRecallECT HandshakeSchedulerBandwidth HandshakeShrinkValidate HeadSpawn HeadTimeout HealthCheckCE HealthCheckGoodput HealthCheckPatchAcceleration HeuristicSmoothDamp HopEvict HopRouteVortex HoverUnmountPacketLoss InferBackpropQuote InferenceGap IngressTileCron InsetsSpreadUnmount InsetsTokenize InterpolateResponse IntrospectBlueGreen IntrospectInfer IntrospectShrink JitterLongPressRetry JitterRadiusRefresh JoinerCorruptMirror JoinerReassembleBack JointCostHop KeyTurbulenceClamp KinematicProvider Knockback LagAdjacency LagReconcileRetry LateUpdateHeuristic LatencyRegress LatencyWarm LatencyWrapper LayerIntrospect LearnerSubjectCost LearnerTruncate LerpDeployment LiftPrecisionCorrupt LogitResolver LogitTruncate LossTenantAmbassador LossVectorHeuristic MAPPool MAPStateless MarginBorderKinematic MarginGoodputTick MarginReassemble MaskPerplexityPad MaskToggleHeuristic MaskWeightPadding MemtableKinematic MergeBlurTTL MergeNATStateless MetricWrap Migrate MigrateRotate MinibatchChunk MinibatchCorrupt MipmapColliderGradient MipmapPadding MipmapSkipAdaptive MirrorHelper Mount MoveTowardsBoxcastAttestation MultiplexSwipe NamespaceCrossEntropyAnisotropy NavmeshRepair NeuralFixedUpdateBreakpoint NextHopThroughput NormAttendFeedForward NormQuery NormalizeCompactRagdoll NormalmapNextHopTrigger OffsetMargin OffsetVacuum OperatorHeuristicSafeArea OrchestrationBleuEmbed OrchestrationRespawn Overlap OverlayRadiusLogit PacketLossThrottle PadAcceptDamper PadBleu PaddingConsumer PanGradient PanHapticElevation PaneSubjectBlueGreen ParticleLateUpdateRecall ParticlePropagationPurge ParticleRaycast ParticleShrink ParticleThrottleAttestation PasskeyDamperLOD PasskeyRigidbodyBandwidth PatchEmitter PatchShutdownNDCG PathVortex PatternRateTokenize PeerWrap PepperChallenge Personalize PinchRadiusAcceleration PinchSafeAreaBackoff PlaceholderBandwidthEphemeral PongGraph PositionalGoodputThaw PositionalWrap PredictionDragDeadline PredictionTenantStroke PrefetchKey Pressed ProbeAnimateThroughput ProbeReassembleSidecar ProbeVelocity ProjectPositionalStep ProjectRate ProjectRoundTrip ProjectSlideRecall ProjectTurbulence PropagationDSCP PropagationSeal PurgeBorder QualifierReconcilerScheduler QueueActiveSealing QuorumCost QuorumDaemon QuoteBreakerResponsive QuoteRender QuoteRotateECN ROCCronDecapsulate ROCFlip ROCProcessor ROCROC ROCRetryOverlap RadioAccept RadiusDaemon RagdollEncapsulate RateLimit RateLimitMeasurement RateLimitPan RatingProbeBleu RatingStubNavmesh RaycastROC RaycastRagdoll Rebuild RebuildBorder RebuildParticle RecallRateLimit ReconcilerRetryGradient RefreshAnisotropyNonce RefreshBaggageSealing RefreshValidateDiff RefreshWrapper RegressResumeKinematic Renegotiate ReorderHead RepairRigidbody ReplicaPersonalizeMeasurement ResidualCompaction ResidualConsumer ResidualQueryResponsive ResponseThaw ResponsiveDemultiplex ResponsivePrefetch ResponsiveStandardize ResponsiveVortexRevoke ResumeConstraint ResumeDrag RetransmitDaemon RigidbodyConstraintDiscover RolloutEmbed RolloutHandler RolloutRefreshConstraint RotateHandler RotateOrchestration RotateRoundTrip RotateTowards RougeSchedule RoundTripEvaluate RoundTripHeadPing RoundTripMemtable RouteLODMatch RowGracefulResponsive RowRebalancePan RowSpinnerDuplicate SafeAreaFlip SafeAreaMAP SampleBounceAUC SampleLerpFilter ScaleDaemon ScalePropagation ScaleRoundTrip ScaleSpring ScanToken Schedule ScheduleGoodput ScheduleParticle SchedulerEmbed SealingHealthCheck SequenceEdge SequenceProgressCost ServiceSidecarQuery ShadowManager ShardDemultiplexPrecision SheetTrigger SidecarClamp SidecarExponential SidecarResolver Simulate SkeletonFeedForward SkeletonTeleport SkinStateful SlaGradientPropagation SlaResponse SlideCrossEntropy SnackbarBandwidthRevoke SnapExpireRagdoll SnapPadding SnapRevoke SoftmaxOrchestration SoftmaxRolling SpacingActivation SpinnerGoodputCron SpinnerPlaceholderIntrospect SpreadPad SpringWaypointSkip Standardize Startup StartupFeedForward StateResponsiveChunk StatefulEpochUnseal StatefulLiveness StatelessHelper StatelessRaycast StatelessSafeArea StreamerCancellation StubChallengeCE SubscriberExchangeTexture Suspend SuspendScaleAdaptive SweepHoverEphemeral SweepInterpolateActivation SwitchCircuitTTL SwitchROCRollout TTLColdNDCG TTLConsumer TTLPressedCE TTLZoomed TapHead TeleportTexture TextureLogit Thaw ThrottleDraggedPersistent ThroughputMipmapAttend TickPropagation TileSnapshotElevation TileStartup TokenHealthCheckF TokenMultiplex TokenProcessor TooltipBackoff TooltipEmitterAttestation TopologyRender TorqueF TrackIntrospect TransformerModalKinematic TransitionBackoff TransitionPerplexity TriggerAnnounce TriggerPersistent TriggerTickDynamic TruncateMipmap UnmountJoint UpstreamPepperLogit VacuumDespawnCron ValidateBeam ValidateBulkhead ValidateRank ValidateReassemble VelocityClassify VelocityScan VerifierForceDeployment VerifierRank ViewportResolver VolumeSkip VolumeSwipeDamper WarmMeasurement WaypointExponential WindActivationCorrupt ZoneDiffRotate

Name

.text

Size

203KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

263KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

quis.exe

generic