QuantumFree[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
QuantumFree.exe
Size 2.1MB
Sample260808-2t1ecswcjf
SHA256 74343ef9941f988d177f56e40c082df8a23076fff12ea0715cad9763842bab80
MD5 bbae19b6dad145c2cfdeba606087f436
SHA1 ae937630836e88970bd416d6bae7a23203be20e5
SHA512 1c4d001a9a63189e6ead0e92a713daab32caae665663a6d3a9d14c317b9250791b59e83a8a4c47d0bf3e2f565c9efe0e0480f5de774ea7dc7bbc77c07d8c01d7
SSDEEP 49152:mPquWzUg5Yv8cB2iKeRpz6iar9FJ3n1Az2ryj98b:mI5Y0w2itptaZFS
TLSH
T173A5BF53F2E187A9C11A933885B35B0AE7357864AF2117DF17A437746FA33E05E3A290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
QuantumFree.exe

File Explorer

QuantumFree.exe

.exe 2.1MB

QuantumFree.exe

IMPHASH d714572d52006773b4c5bcecf391daf4
SHA256 74343ef9941f988d177f56e40c082df8a23076fff12ea0715cad9763842bab80
MD5 bbae19b6dad145c2cfdeba606087f436
SHA1 ae937630836e88970bd416d6bae7a23203be20e5
SHA512 1c4d001a9a63189e6ead0e92a713daab32caae665663a6d3a9d14c317b9250791b59e83a8a4c47d0bf3e2f565c9efe0e0480f5de774ea7dc7bbc77c07d8c01d7
SSDEEP 49152:mPquWzUg5Yv8cB2iKeRpz6iar9FJ3n1Az2ryj98b:mI5Y0w2itptaZFS
TLSH
T173A5BF53F2E187A9C11A933885B35B0AE7357864AF2117DF17A437746FA33E05E3A290
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

477696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetOpenA HttpSendRequestA InternetCloseHandle InternetReadFile HttpOpenRequestA InternetConnectA

advapi32

RegCreateKeyExA SetSecurityInfo CryptGetHashParam CryptReleaseContext RegOpenKeyExA CryptDestroyHash RegSetValueExA CryptAcquireContextA RegCloseKey RegQueryValueExA InitializeAcl CryptCreateHash CryptHashData

iphlpapi

GetAdaptersInfo

kernel32

WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW GetModuleFileNameA SizeofResource SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle GetTempPathW GetVolumeInformationA WaitForSingleObject LocalAlloc GetModuleHandleA SetUnhandledExceptionFilter GetTempPathA GetFileAttributesA GetCurrentThread LockResource CloseHandle CreateThread LoadResource GetThreadContext GetProcAddress LocalFree ExitProcess GetCurrentProcessId CreateProcessW GetComputerNameA GetExitCodeProcess DeviceIoControl CreateFileW CreateToolhelp32Snapshot Process32NextW Process32FirstW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GetModuleHandleW GetSystemTimeAsFileTime AcquireSRWLockExclusive FindResourceW ReleaseSRWLockExclusive InitializeSListHead Sleep

user32

FindWindowA UpdateWindow PeekMessageA LoadCursorA ScreenToClient ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState DispatchMessageA SetWindowPos GetSystemMetrics ShowWindow GetAsyncKeyState SetWindowLongA GetWindowLongA MessageBoxA SetLayeredWindowAttributes SetMenu TranslateMessage GetCursorPos

shell32

ShellExecuteA

ole32

CoInitialize

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_copy __C_specific_handler __std_exception_destroy __current_exception_context __std_terminate strstr memchr memcmp memcpy memmove memset __current_exception

api-ms-win-crt-stdio-l1-1-0

fread _fseeki64 _get_stream_buffer_pointers __stdio_common_vsscanf fsetpos __p__commode ungetc setvbuf fgetpos _wfopen __stdio_common_vsprintf _set_fmode fwrite __acrt_iob_func fgetc __stdio_common_vsprintf_s fseek fclose fflush fputc ftell __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc realloc

api-ms-win-crt-string-l1-1-0

strcmp strlen strncmp tolower toupper wcslen wcscpy_s

api-ms-win-crt-math-l1-1-0

tanf acosf fmax sqrtf ceilf ldexp sqrt powf asin __setusermatherr fmodf cosf atan2 sinf

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-runtime-l1-1-0

system _register_thread_local_exe_atexit_callback _c_exit __p___argv terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argc _get_initial_narrow_environment _initterm _initterm_e exit _exit

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale