Q-SYS UCI Viewer Installer 9[.]3[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Q-SYS UCI Viewer Installer 9.3.1.exe
Size 48.0MB
Sample260812-ermn6aycnd
SHA256 64b9b5c37d566c90b599f7537154d4882812e05dd64f51f6c71230fa9e1003f4
MD5 16c7a49ef15b8c16d26bc09ff6fefd58
SHA1 7003d5066601f2efdcdcb230cbba5fd3a4b127b7
SHA512 972146be28c43b8897b82293d42832c33938deed315cc8b0540cdbd8b8473331e2f1cd05956c66ba09790c007a22c3ba8ebece5964d6a9cb34d1c69a4fadbb6d
SSDEEP 786432:vNeHqBZhU7L7h5cBZDwmaFmXhd/7xT8H9m6TNmFOqRbchK4IDyCitBWSuFQ3CfOH:lKqBLuh5cBVZ/Xhd/7xIHs6TMOpKbywM
TLSH
T1D7B7334677AF9679FAB726B188B4447A067F7CA683388BDF230D001D8B716C15CB4366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Q-SYS UCI Viewer Installer 9.3.1.exe

.exe 48.0MB

Q-SYS UCI Viewer Installer 9.3.1.exe

IMPHASH b48671fed9d5ca4906417d42fcdb066b
SHA256 64b9b5c37d566c90b599f7537154d4882812e05dd64f51f6c71230fa9e1003f4
MD5 16c7a49ef15b8c16d26bc09ff6fefd58
SHA1 7003d5066601f2efdcdcb230cbba5fd3a4b127b7
SHA512 972146be28c43b8897b82293d42832c33938deed315cc8b0540cdbd8b8473331e2f1cd05956c66ba09790c007a22c3ba8ebece5964d6a9cb34d1c69a4fadbb6d
SSDEEP 786432:vNeHqBZhU7L7h5cBZDwmaFmXhd/7xT8H9m6TNmFOqRbchK4IDyCitBWSuFQ3CfOH:lKqBLuh5cBVZ/Xhd/7xIHs6TMOpKbywM
TLSH
T1D7B7334677AF9679FAB726B188B4447A067F7CA683388BDF230D001D8B716C15CB4366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

c1:d3:83:38:4b:dd:22:d6:41:9c:21:6a:f8:f4:e9:89:53:3d:f0:3c:df:c8:1f:17:f2:10:cc:f4:5f:8f:15:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=QSC\, LLC,O=QSC\, LLC,L=Costa Mesa,ST=California,C=US

Chains

Jan 19, 2022

CN=QSC\, LLC,O=QSC\, LLC,L=Costa Mesa,ST=California,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=QSC\, LLC,O=QSC\, LLC,L=Costa Mesa,ST=California,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Digest

a8:8e:f5:fd:85:3c:64:5c:ab:16:91:ee:59:97:10:d0:4d:c3:5e:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=QSC\, LLC,O=QSC\, LLC,L=Costa Mesa,ST=California,C=US

Chains

Jan 19, 2022

CN=QSC\, LLC,O=QSC\, LLC,L=Costa Mesa,ST=California,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=QSC\, LLC,O=QSC\, LLC,L=Costa Mesa,ST=California,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=QSC\, LLC,O=QSC\, LLC,L=Costa Mesa,ST=California,C=US

Serial Number

37:dc:02:fd:79:08:13:9e:c5:a7:7f:21

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 15, 2021 - Dec 15, 2024

Minor OS version

Major OS version

Entry point

141896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError ResetEvent CreateEventW CloseHandle MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryW GetModuleFileNameW FormatMessageW LocalFree GetWindowsDirectoryW CreateFileW SetFileTime SetFileAttributesW RemoveDirectoryW CreateDirectoryW GetFileInformationByHandle DeleteFileW GetShortPathNameW GetFullPathNameW lstrlenW GetCurrentDirectoryW GetTempFileNameW FindClose FindFirstFileW FindNextFileW GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile DeleteCriticalSection GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects GetCurrentProcessId InitializeCriticalSection QueryPerformanceCounter GetTickCount Sleep LocalAlloc GetProcAddress SetCurrentDirectoryW GetSystemDefaultUILanguage GetUserDefaultUILanguage SetThreadUILanguage SetThreadLocale GetVersion GetCommandLineW CreateProcessW GetExitCodeProcess FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP GetLocaleInfoA IsValidCodePage GetOEMCP RaiseException GetACP GetCPInfo LoadLibraryA RtlUnwind InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime WaitForSingleObject SetEvent GetVersionExW VirtualAlloc GetCurrentThreadId VirtualFree GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapFree HeapAlloc ExitThread CreateThread HeapReAlloc GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate GetModuleHandleW ExitProcess GetModuleFileNameA TlsGetValue

user32

SetForegroundWindow CharUpperW GetWindowRect DestroyWindow RegisterWindowMessageW AdjustWindowRect LoadImageW LoadIconW KillTimer SetTimer EndDialog IsDlgButtonChecked SetDlgItemTextW GetDlgItem SetWindowTextW GetWindowTextW GetWindowTextLengthW LoadStringW DialogBoxParamW CreateDialogParamW SystemParametersInfoW PeekMessageW GetDesktopWindow MessageBoxW SendMessageW GetWindowLongW SetWindowLongW ShowWindow MoveWindow PostMessageW

gdi32

GetObjectW

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW ShellExecuteExW

ole32

CoInitializeEx CoInitialize CoCreateInstance

oleaut32

SysAllocStringLen SysFreeString VariantClear SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

Q-SYS UCI Viewer Installer 9.3.1.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic