e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463

Sharing

Copy URL Twitter E-mail

General

Target
e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463
Size 1.4MB
Sample260807-ktbbss1cnf
SHA256 e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463
MD5 a54c137acfa5d9723d362120b170906c
SHA1 45ec16008112373ed379f4fd75570b670738c4a7
SHA512 1fb7121519e3f6d737a790266af766eccbcec6cb444f92f2a9d57f74d58cb2cff2cc34e2eb35ab15c3370b497279fbfd57a0983a3e3ae368d992da5a2b005547
SSDEEP 12288:lyQE1fgRV4vAvlZW9Eq3dMA0ADEm8gReFD6DKjLbgzwPeg/tfWFx:lyQE14RV4yse0MhAE/FWOdPDWFx
TLSH
T17F65DF0172D9AEA1D2D60630F99BE3664D7AEF674E31621763163FCE3CAD7C31858212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463

File Explorer

e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463

.exe 1.4MB

e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463

IMPHASH d31de66c69ad4b3287572508eaa77662
SHA256 e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463
MD5 a54c137acfa5d9723d362120b170906c
SHA1 45ec16008112373ed379f4fd75570b670738c4a7
SHA512 1fb7121519e3f6d737a790266af766eccbcec6cb444f92f2a9d57f74d58cb2cff2cc34e2eb35ab15c3370b497279fbfd57a0983a3e3ae368d992da5a2b005547
SSDEEP 12288:lyQE1fgRV4vAvlZW9Eq3dMA0ADEm8gReFD6DKjLbgzwPeg/tfWFx:lyQE14RV4yse0MhAE/FWOdPDWFx
TLSH
T17F65DF0172D9AEA1D2D60630F99BE3664D7AEF674E31621763163FCE3CAD7C31858212
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\QQMusicPC\pdbRelease\QQMusicSvr.pdb

shlwapi

PathFileExistsW

ws2_32

closesocket htons htonl WSAStartup

qqmusiccommon

?Read@CFile@QM@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Open@CFile@QM@@QAE_NPB_W_N1@Z ??1CFile@QM@@QAE@XZ ??0CFile@QM@@QAE@XZ ?GetTempFolder@QM@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ ?GetSharedInstance_ConfigInfo@qqmusic@@YAPAVIConfigInfo@@XZ ??1CQMPEvent@@QAE@XZ ??0CQMPEvent@@QAE@HHPB_W@Z ??1CQMPThreadSink@@UAE@XZ ??0CQMPThreadSink@@QAE@XZ ?StopThread@CQMPThreadSink@@UAEXAAV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@K@Z ?TermThread@CQMPThreadSink@@QAEXXZ ??1?$CQMPAutoLock@VCQMPCritSec@@@@QAE@XZ ??0?$CQMPAutoLock@VCQMPCritSec@@@@QAE@PAVCQMPCritSec@@@Z ?newStreamWriter@StreamWriterBuilder@Json@@UBEPAVStreamWriter@2@XZ ?newCharReader@CharReaderBuilder@Json@@UBEPAVCharReader@2@XZ ?QueryEventByTime@CQMPThreadSink@@QAEPAXV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@PAXK_N@Z ?write@StyledWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?write@FastWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ??1CQMPCritSec@@QAE@XZ ??0CQMPCritSec@@QAE@XZ ?t2ui64@QM@@YA_KV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?WriteLog@qqmusic@@YAXHKPB_WZZ ??0StyledStreamWriter@Json@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??1Writer@Json@@UAE@XZ ??1StreamWriterBuilder@Json@@UAE@XZ ??1StreamWriter@Json@@UAE@XZ ??1Factory@StreamWriter@Json@@UAE@XZ ??1CharReaderBuilder@Json@@UAE@XZ ??4Value@Json@@QAEAAV01@ABV01@@Z ?GetICQMApiSvr@@YAJPAPAUICQMApiSvr@@@Z ?IsThreadRunning@CQMPThreadSink@@QAE_NV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@@Z ?a2t@QM@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?GetQmpThread@CQMPThreadPool@@QAE?AV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@PAVCQMPThreadSink@@H@Z ?Instance@CQMPThreadPool@@SAAAV1@XZ ?BeginThread@CQMPThreadSink@@QAE_NV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@@Z ??0CQMPThreadBase@@QAE@XZ ??1CQMPThreadBase@@UAE@XZ ?IsThreadRunning@CQMPThreadBase@@QAE_NXZ ??1Exception@Json@@UAE@XZ ?StopThread@CQMPThreadBase@@QAEXK@Z ?Stop@CQMPThreadPool@@QAEXI@Z ?BeginThread@CQMPThreadBase@@QAE_NXZ ?QueryEvent@CQMPThreadBase@@QAEPAXPAX_N@Z ?what@Exception@Json@@UBEPBDXZ ??0Value@Json@@QAE@W4ValueType@1@@Z ?isEqual@ValueIteratorBase@Json@@IBE_NABV12@@Z ??0Value@Json@@QAE@ABV01@@Z ??0ValueIterator@Json@@QAE@ABV01@@Z ?deref@ValueIteratorBase@Json@@IBEAAVValue@2@XZ ?increment@ValueIteratorBase@Json@@IAEXXZ ?decrement@ValueIteratorBase@Json@@IAEXXZ ?computeDistance@ValueIteratorBase@Json@@IBEHABV12@@Z

kernel32

FlushInstructionCache IsProcessorFeaturePresent InterlockedPushEntrySList VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter ResetEvent WaitForSingleObjectEx GetStartupInfoW QueryPerformanceCounter GetCurrentProcess IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList CreateThread CreateEventW WaitForSingleObject GetCommandLineW GetLongPathNameW SetUnhandledExceptionFilter TerminateProcess GetCurrentProcessId DecodePointer WideCharToMultiByte lstrlenA lstrcmpiA LoadLibraryExW lstrcmpiW FreeLibrary MultiByteToWideChar SetLastError GetCurrentThreadId OpenProcess LeaveCriticalSection EnterCriticalSection InterlockedIncrement CreateFileMappingA OpenFileMappingA MapViewOfFile InterlockedDecrement DeleteCriticalSection CreateProcessW InitializeCriticalSectionAndSpinCount RaiseException Sleep GetModuleHandleW GetProcAddress CreateEventA GetLastError SetEvent GetTickCount UnmapViewOfFile FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap GetPrivateProfileStringW GetTempPathW GetTempFileNameW lstrlenW DeleteFileW CreateFileW GetFileSize SetFilePointer ReadFile CloseHandle WriteFile GetModuleFileNameW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetSystemTimeAsFileTime

user32

CharUpperW PostThreadMessageW CharNextW CreateWindowExW LoadCursorW GetMessageW SendMessageW FindWindowW UnregisterClassW SendMessageTimeoutW DispatchMessageW TranslateMessage GetWindowLongW PostQuitMessage PeekMessageW MsgWaitForMultipleObjects PostMessageW KillTimer SetTimer GetClassInfoExW RegisterClassExW GetWindowThreadProcessId DestroyWindow GetDesktopWindow CallWindowProcW DefWindowProcW SetWindowLongW

advapi32

RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

ole32

CoReleaseServerProcess CoAddRefServerProcess CoTaskMemAlloc CoUninitialize CoTaskMemRealloc CoInitialize StringFromGUID2 CoCreateInstance CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoTaskMemFree

oleaut32

SysStringLen VarUI4FromStr LoadTypeLi UnRegisterTypeLi RegisterTypeLi VariantInit SysFreeString VariantCopy VariantClear LoadRegTypeLi SysAllocString

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

wininet

InternetCrackUrlA

vcruntime140

_except_handler4_common _CxxThrowException wcsrchr wcsstr memcmp _purecall __std_exception_destroy __CxxFrameHandler3 __std_terminate memset memcpy memmove __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _errno _c_exit _resetstkoflw _exit exit _invalid_parameter_noinfo _controlfp_s _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e

api-ms-win-crt-convert-l1-1-0

_ui64toa_s

api-ms-win-crt-string-l1-1-0

wcsnlen wcsncpy_s _wcslwr_s wcslen wcscmp _wcsicmp strlen wcscpy_s wmemcpy_s wcscat_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s _set_fmode __stdio_common_vswprintf __stdio_common_vsprintf __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc _recalloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

??0?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@ABV0@@Z ??0?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??0CDownloadPure@QMNetwork@@QAE@ABV01@@Z ??0CDownloadPure@QMNetwork@@QAE@PAVITaskCallback@1@@Z ??0CharReader@Json@@QAE@ABV01@@Z ??0CharReader@Json@@QAE@XZ ??0CharReaderBuilder@Json@@QAE@ABV01@@Z ??0Exception@Json@@QAE@ABV01@@Z ??0Factory@CharReader@Json@@QAE@ABV012@@Z ??0Factory@CharReader@Json@@QAE@XZ ??0Factory@StreamWriter@Json@@QAE@ABV012@@Z ??0Factory@StreamWriter@Json@@QAE@XZ ??0FastWriter@Json@@QAE@ABV01@@Z ??0ILoginHost@@QAE@ABV0@@Z ??0ILoginHost@@QAE@XZ ??0ILyricHost@@QAE@$$QAV0@@Z ??0ILyricHost@@QAE@ABV0@@Z ??0ILyricHost@@QAE@XZ ??0ILyricRenderFactory@@QAE@$$QAV0@@Z ??0ILyricRenderFactory@@QAE@ABV0@@Z ??0ILyricRenderFactory@@QAE@XZ ??0ITaskCallback@QMNetwork@@QAE@$$QAV01@@Z ??0ITaskCallback@QMNetwork@@QAE@ABV01@@Z ??0ITaskCallback@QMNetwork@@QAE@XZ ??0LogicError@Json@@QAE@$$QAV01@@Z ??0LogicError@Json@@QAE@ABV01@@Z ??0Path@Json@@QAE@$$QAV01@@Z ??0Path@Json@@QAE@ABV01@@Z ??0PathArgument@Json@@QAE@$$QAV01@@Z ??0PathArgument@Json@@QAE@ABV01@@Z ??0Reader@Json@@QAE@$$QAV01@@Z ??0Reader@Json@@QAE@ABV01@@Z ??0RuntimeError@Json@@QAE@$$QAV01@@Z ??0RuntimeError@Json@@QAE@ABV01@@Z ??0StaticString@Json@@QAE@PBD@Z ??0StreamWriter@Json@@QAE@ABV01@@Z ??0StreamWriterBuilder@Json@@QAE@ABV01@@Z ??0StyledStreamWriter@Json@@QAE@ABV01@@Z ??0StyledWriter@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@XZ ??0XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@J@Z ??0XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@ABV01@@Z ??0XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??1?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??1CDownloadPure@QMNetwork@@UAE@XZ ??1CharReader@Json@@UAE@XZ ??1Factory@CharReader@Json@@UAE@XZ ??1FastWriter@Json@@UAE@XZ ??1ILoginHost@@UAE@XZ ??1LogicError@Json@@UAE@XZ ??1Path@Json@@QAE@XZ ??1PathArgument@Json@@QAE@XZ ??1Reader@Json@@QAE@XZ ??1RuntimeError@Json@@UAE@XZ ??1StyledStreamWriter@Json@@QAE@XZ ??1StyledWriter@Json@@UAE@XZ ??1XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??4?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXABV0@@Z ??4?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXPAVCQMPThread@@@Z ??4?$Int2Tp@$00@@QAEAAU0@$$QAU0@@Z ??4?$Int2Tp@$00@@QAEAAU0@ABU0@@Z ??4?$Int2Tp@$0A@@@QAEAAU0@$$QAU0@@Z ??4?$Int2Tp@$0A@@@QAEAAU0@ABU0@@Z ??4CDownloadPure@QMNetwork@@QAEAAV01@ABV01@@Z ??4CharReader@Json@@QAEAAV01@ABV01@@Z ??4CharReaderBuilder@Json@@QAEAAV01@ABV01@@Z ??4Exception@Json@@QAEAAV01@ABV01@@Z ??4Factory@CharReader@Json@@QAEAAV012@ABV012@@Z ??4Factory@StreamWriter@Json@@QAEAAV012@ABV012@@Z ??4FastWriter@Json@@QAEAAV01@ABV01@@Z ??4Features@Json@@QAEAAV01@$$QAV01@@Z ??4Features@Json@@QAEAAV01@ABV01@@Z ??4ILoginHost@@QAEAAV0@ABV0@@Z ??4ILyricHost@@QAEAAV0@$$QAV0@@Z ??4ILyricHost@@QAEAAV0@ABV0@@Z ??4ILyricRenderFactory2@@QAEAAV0@$$QAV0@@Z ??4ILyricRenderFactory2@@QAEAAV0@ABV0@@Z ??4ILyricRenderFactory@@QAEAAV0@$$QAV0@@Z ??4ILyricRenderFactory@@QAEAAV0@ABV0@@Z ??4ITaskCallback@QMNetwork@@QAEAAV01@$$QAV01@@Z ??4ITaskCallback@QMNetwork@@QAEAAV01@ABV01@@Z ??4LogicError@Json@@QAEAAV01@$$QAV01@@Z ??4LogicError@Json@@QAEAAV01@ABV01@@Z ??4Path@Json@@QAEAAV01@$$QAV01@@Z ??4Path@Json@@QAEAAV01@ABV01@@Z ??4PathArgument@Json@@QAEAAV01@$$QAV01@@Z ??4PathArgument@Json@@QAEAAV01@ABV01@@Z ??4Reader@Json@@QAEAAV01@$$QAV01@@Z ??4Reader@Json@@QAEAAV01@ABV01@@Z ??4RuntimeError@Json@@QAEAAV01@$$QAV01@@Z ??4RuntimeError@Json@@QAEAAV01@ABV01@@Z ??4StaticString@Json@@QAEAAV01@$$QAV01@@Z ??4StaticString@Json@@QAEAAV01@ABV01@@Z ??4StreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StreamWriterBuilder@Json@@QAEAAV01@ABV01@@Z ??4StyledStreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StyledWriter@Json@@QAEAAV01@ABV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@$$QAV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@ABV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@$$QAV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@ABV01@@Z ??4Writer@Json@@QAEAAV01@ABV01@@Z ??4XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEAAV01@ABV01@@Z ??4XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXABV01@@Z ??4XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXPAVCQMPThread@@@Z ??8ValueIteratorBase@Json@@QBE_NABV01@@Z ??9ValueIteratorBase@Json@@QBE_NABV01@@Z ??BStaticString@Json@@QBEPBDXZ ??C?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QBEPAVCQMPThread@@XZ ??CValueConstIterator@Json@@QBEPBVValue@1@XZ ??CValueIterator@Json@@QBEPAVValue@1@XZ ??DValueConstIterator@Json@@QBEABVValue@1@XZ ??DValueIterator@Json@@QBEAAVValue@1@XZ ??EValueConstIterator@Json@@QAE?AV01@H@Z ??EValueConstIterator@Json@@QAEAAV01@XZ ??EValueIterator@Json@@QAE?AV01@H@Z ??EValueIterator@Json@@QAEAAV01@XZ ??FValueConstIterator@Json@@QAE?AV01@H@Z ??FValueConstIterator@Json@@QAEAAV01@XZ ??FValueIterator@Json@@QAE?AV01@H@Z ??FValueIterator@Json@@QAEAAV01@XZ ??GValueIteratorBase@Json@@QBEHABV01@@Z ??_7CDownloadPure@QMNetwork@@6B@ ??_7CharReader@Json@@6B@ ??_7CharReaderBuilder@Json@@6B@ ??_7Exception@Json@@6B@ ??_7Factory@CharReader@Json@@6B@ ??_7Factory@StreamWriter@Json@@6B@ ??_7FastWriter@Json@@6B@ ??_7ILoginHost@@6B@ ??_7ILyricHost@@6B@ ??_7ILyricRenderFactory@@6B@ ??_7ITaskCallback@QMNetwork@@6B@ ??_7LogicError@Json@@6B@ ??_7RuntimeError@Json@@6B@ ??_7StreamWriter@Json@@6B@ ??_7StreamWriterBuilder@Json@@6B@ ??_7StyledWriter@Json@@6B@ ??_7Writer@Json@@6B@ ??_FStyledStreamWriter@Json@@QAEXXZ ??_FValue@Json@@QAEXXZ ??_FXCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXXZ ?AddRef@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEJXZ ?Dec@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@AAEJU?$Int2Tp@$00@@@Z ?Free@XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@AAEXU?$Int2Tp@$0A@@@@Z ?Inc@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@AAEJU?$Int2Tp@$00@@@Z ?IsValid@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QBE_NXZ ?OnTaskNotify2@ITaskCallback@QMNetwork@@UAEXPADH@Z ?Release@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEJXZ ?Release@XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEJ_N@Z ?c_str@StaticString@Json@@QBEPBDXZ

Sharing

General

Malware Config

Signatures

File Explorer

e9fb11a5577042cabfcac0b508efd2ff14be35e528eecb32d378db0329696463

shlwapi

ws2_32

qqmusiccommon

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

wininet

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic