new[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
new.7z
Size 1.8MB
Sample260816-mec8yscf79
SHA256 3baa8351ad7793c26727ff2b6812ed769e90d0f37cc6cfec8e140a04d052fbb1
MD5 4ebae3cccbc599294434080592255b49
SHA1 a5353db65f971b01c35c49f5d9e551cb2b39231a
SHA512 79e76b3d24b784e21ec57db103edc7e589c9ed3ac6ab421b2be9b73d42d08001d88788d559a5de49080bb302020f11c44b2b6660aa1a4e778205b033f5960291
SSDEEP 24576:2zvW0OuQoEWOMtwiczLBV+apCsoDuJoJJaC4j5yDSn7nzEa7PK18tRRPcYGgBnKr:AvW02Bl8e14sUuLxlc8Qa7Pc4vPCEKMo
TLSH
T1779533F793E992FF29F8F014123913EDE90ED6E2947967A1C545C087BCCB0A6046E1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/new/QFAdminUtil_win32 (1)/QDecrypt.com
unpack001/new/QFAdminUtil_win32 (1)/QDecrypt.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/new/QFAdminUtil_win32 (1)/vsapi32.dll

File Explorer

new.7z

.7z 1.8MB
new/QFAdminUtil_win32 (1)/QDecrypt.com

.exe 952KB
new/QFAdminUtil_win32 (1)/QDecrypt.exe

.exe 2.7MB
new/QFAdminUtil_win32 (1)/vsapi32.dll

.dll 1.7MB
new/a4897c1b.zip

.zip 2KB

new.7z

SHA256 3baa8351ad7793c26727ff2b6812ed769e90d0f37cc6cfec8e140a04d052fbb1
MD5 4ebae3cccbc599294434080592255b49
SHA1 a5353db65f971b01c35c49f5d9e551cb2b39231a
SHA512 79e76b3d24b784e21ec57db103edc7e589c9ed3ac6ab421b2be9b73d42d08001d88788d559a5de49080bb302020f11c44b2b6660aa1a4e778205b033f5960291
SSDEEP 24576:2zvW0OuQoEWOMtwiczLBV+apCsoDuJoJJaC4j5yDSn7nzEa7PK18tRRPcYGgBnKr:AvW02Bl8e14sUuLxlc8Qa7Pc4vPCEKMo
TLSH
T1779533F793E992FF29F8F014123913EDE90ED6E2947967A1C545C087BCCB0A6046E1A7
MD5 SHA1 SHA512 SSDEEP TLSH

new/QFAdminUtil_win32 (1)/QDecrypt.com

IMPHASH c76f6b4310a871f309c4d3c3e38f8b7e
SHA256 fec18f885bc9b84835873b54705efa4e92b47fe50e9c9a8b0ff935f1d173758d
MD5 be6086b33699a2c56233cd55c36ecfca
SHA1 bc9ae30e3fc72d3a40c864095cbeb4c55b51ccdf
SHA512 f64d44dd3048d74a62b627e72a569d8d72a84a0696eb55d09d49d0d1fe77e68a59e44dcef3ce7b94f83043b0302b52d81c4489b81550d429d1ca58c595180562
SSDEEP 24576:grGha+IYGXRz8vgobejS932cUSUsjs6666666l:KGEhX9obH932cUSUsjT
TLSH
T1C3255B11FBDEE076D96712B50820862E513ABE4517384BCFE3983E1F49362C2AC7675E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

489980

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\HUA2\dsa\apps\tools\QDecrypt\release consolemode\QDecrypt.pdb

vsapi32

ord622

kernel32

CreateFileW GetFileAttributesW FindClose FindFirstFileW CloseHandle GetTempPathW GetTempFileNameW GetFileType CopyFileW SetCurrentDirectoryW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryW Sleep GetCurrentThreadId InterlockedIncrement InterlockedDecrement WaitForSingleObject TlsSetValue ExitProcess TlsGetValue GetProcAddress GetCurrentProcess TlsFree TlsAlloc GetModuleHandleW FindNextFileW GetEnvironmentVariableW GetCurrentProcessId GetCPInfo IsValidCodePage TerminateProcess FormatMessageW GetModuleFileNameW GetCurrentThread RaiseException OutputDebugStringW FreeLibrary GetModuleHandleA ReadFile WriteFile WaitForMultipleObjects SetEvent IsBadReadPtr IsBadStringPtrA GetSystemTimeAsFileTime ExpandEnvironmentStringsW GetStringTypeW GetStringTypeA EnumSystemLocalesA GetLocaleInfoA GetDateFormatA GetTimeFormatA GetDriveTypeA SetEnvironmentVariableA GetCurrentDirectoryA WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileA LoadLibraryA GetOEMCP HeapSize GetTickCount QueryPerformanceCounter SetLastError GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle VirtualAlloc VirtualFree HeapCreate HeapDestroy LCMapStringW LocalFree MultiByteToWideChar WideCharToMultiByte GetVersionExW DebugBreak GetLastError SetThreadLocale GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetACP CompareStringW SetEndOfFile LCMapStringA GetTimeZoneInformation GetFullPathNameW CompareStringA SetEnvironmentVariableW InterlockedExchange HeapFree GetCommandLineA GetVersionExA HeapAlloc GetProcessHeap RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc SetStdHandle DeleteFileW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer MoveFileW

user32

DdePostAdvise DdeConnect DdeNameService DdeCreateStringHandleW DdeClientTransaction DdeDisconnect DdeInitializeW DdeGetLastError DdeCreateDataHandle DdeGetData DdeFreeDataHandle DdeQueryStringW DdeUninitialize DdeFreeStringHandle MsgWaitForMultipleObjects GetMessageW DispatchMessageW SetTimer KillTimer PeekMessageW DestroyWindow UnregisterClassW RegisterClassW CreateWindowExW PostThreadMessageW MessageBoxW DefWindowProcW

advapi32

RegSetValueExW RegQueryValueExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegCreateKeyExW RegOpenKeyExW RegCloseKey GetUserNameW RegDeleteKeyW

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc

ole32

CoCreateInstance

new/QFAdminUtil_win32 (1)/QDecrypt.exe

IMPHASH e0981f00acdc3b8f7610d180b8b856e3
SHA256 6a7c5676594dfc44bb5c2d3363cc4006ae57a2ac16cad6cd088aba96434a52ab
MD5 c694c93801796870df895aaa4f07722b
SHA1 ecf845c3833a0c36ef3d8309d2cddaf25198070a
SHA512 c6f2cc9b61c8eee80ad1634171a000d766dcf809d5924be568437e05d571b6bc02d680cdf8316dcd6f395809ae284f0f437a88392beab168d3a42f72d925ba96
SSDEEP 49152:dnYi6rOCgUUCz5i1+yRbVqdjNCm9X9RcUKUsjVLdcmkTwbx:x17uMxM9XSzx
TLSH
T14FD55C01FBDBC1B4DEB712B00461C61F5929BE4517389FD7E3983E1E99326C2AC36269
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1608362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\HUA2\dsa\apps\tools\QDecrypt\release\QDecrypt.pdb

vsapi32

ord628 ord622

rpcrt4

UuidToStringW RpcStringFreeW

comctl32

ImageList_Add ImageList_ReplaceIcon ImageList_Replace ImageList_Remove ImageList_Draw ImageList_SetBkColor ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragMove ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ord16 ImageList_GetImageCount ImageList_GetIconSize ImageList_Destroy ord17 ImageList_Create

kernel32

lstrlenA GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA VirtualAlloc VirtualFree HeapCreate HeapDestroy LCMapStringW LCMapStringA GetTimeZoneInformation SetFilePointer FlushFileBuffers GetConsoleMode GlobalSize GetFullPathNameW MoveFileW DeleteFileW HeapReAlloc SetStdHandle IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind GetStartupInfoA HeapAlloc GetVersionExA GetCommandLineA HeapFree InterlockedExchange LoadLibraryA CreateFileA GetOEMCP GetCurrentDirectoryA GetDriveTypeA GetTimeFormatA GetDateFormatA GetLocaleInfoA EnumSystemLocalesA GetStringTypeA GetStringTypeW GetProcessHeap HeapSize GlobalUnlock GlobalLock GlobalFree GlobalAlloc SetLastError MulDiv GetCommandLineW SetErrorMode SetConsoleCursorPosition FillConsoleOutputCharacterW WriteConsoleW WriteConsoleA GetStdHandle GetConsoleScreenBufferInfo ReadConsoleOutputCharacterA FreeConsole ExpandEnvironmentStringsW GetSystemTimeAsFileTime SetEnvironmentVariableA SetEnvironmentVariableW GetConsoleOutputCP CompareStringA SetEvent WaitForMultipleObjects WriteFile ReadFile IsBadStringPtrA IsBadReadPtr FindNextFileW GetModuleHandleA FreeLibrary GetModuleFileNameW TerminateProcess GetModuleHandleW IsValidCodePage GetCPInfo GetCurrentProcessId GetEnvironmentVariableW OutputDebugStringW RaiseException GetCurrentThread WideCharToMultiByte GetVersionExW TlsAlloc TlsFree GetCurrentProcess GetProcAddress TlsGetValue ExitProcess TlsSetValue WaitForSingleObject InterlockedDecrement InterlockedIncrement GetCurrentThreadId Sleep LoadLibraryW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SetThreadLocale GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetACP SetCurrentDirectoryW CopyFileW GetFileType FormatMessageW LocalFree GetTempFileNameW GetLastError GetFileTime GetTempPathW FileTimeToLocalFileTime FileTimeToSystemTime CloseHandle MultiByteToWideChar FindFirstFileW FindClose GetFileAttributesW CreateFileW DebugBreak FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetTickCount CompareStringW SetEndOfFile GetConsoleCP QueryPerformanceFrequency

user32

DrawTextW CreateIconIndirect UnionRect EndPaint BeginPaint GetWindowDC DestroyCursor TranslateAcceleratorW CreateAcceleratorTableW DestroyAcceleratorTable GetDoubleClickTime CreateMenu AppendMenuW ModifyMenuW RemoveMenu InsertMenuItemW InsertMenuW CreatePopupMenu SetMenuItemInfoW GetSubMenu DestroyMenu GetMenuState LoadImageW DestroyIcon GetIconInfo LoadBitmapW LoadIconW ValidateRect DrawIconEx DrawFrameControl GetWindowTextLengthW GetWindowTextW GetClassNameW MessageBeep GetDialogBaseUnits SetWindowRgn GetDlgItem CreateDialogParamW InflateRect PtInRect UnregisterHotKey RegisterHotKey SetWindowsHookExW GetMenuItemCount GetMenuItemInfoW SystemParametersInfoW BeginDeferWindowPos EndDeferWindowPos MapWindowPoints CopyRect DeferWindowPos UpdateWindow SetCursorPos ReleaseCapture SetFocus GetClientRect GetSysColor IsWindow CallWindowProcW FillRect InvalidateRect IsDialogMessageW TrackPopupMenu GetCapture CallNextHookEx UnhookWindowsHookEx ChildWindowFromPointEx GetWindow GetActiveWindow GetMessageTime IsWindowEnabled IsWindowVisible ClientToScreen SetRect RedrawWindow SetParent WindowFromPoint GetParent ScrollWindow EnableScrollBar SetScrollInfo GetScrollInfo SetCapture GetFocus EnableWindow GetAsyncKeyState VkKeyScanW MapVirtualKeyW GetDC ReleaseDC TranslateMessage PostQuitMessage GetCursorPos GetMessagePos GetDesktopWindow GetWindowRect GetSystemMenu EnableMenuItem DrawMenuBar GetWindowPlacement CreateDialogIndirectParamW SetWindowTextW OffsetRect DrawFocusRect HideCaret keybd_event ChildWindowFromPoint FindWindowExW ValidateRgn GetSysColorBrush CheckMenuItem GetUpdateRgn CheckMenuRadioItem SetWindowPos MoveWindow GetWindowLongW SetWindowLongW FlashWindow GetSystemMetrics IsIconic IsZoomed SetForegroundWindow ShowWindow BringWindowToTop GetKeyState DdePostAdvise DrawStateW DrawEdge RegisterClipboardFormatW GetClipboardFormatNameW ChangeDisplaySettingsW EnumDisplaySettingsW IsClipboardFormatAvailable AdjustWindowRectEx DdeConnect DdeNameService DdeCreateStringHandleW DdeClientTransaction DdeDisconnect DdeInitializeW DdeGetLastError DdeCreateDataHandle DdeGetData DdeFreeDataHandle DdeQueryStringW DdeUninitialize DdeFreeStringHandle LoadCursorW SetCursor SendMessageW MsgWaitForMultipleObjects GetMessageW DispatchMessageW PeekMessageW DestroyWindow UnregisterClassW SetTimer KillTimer DefWindowProcW RegisterClassW PostMessageW CreateWindowExW PostThreadMessageW MessageBoxW ShowCursor wsprintfW ScreenToClient SetMenu

gdi32

SetROP2 SetViewportOrgEx CreateCompatibleDC DeleteDC GetPixel SetPixel PolyBezier SetWindowOrgEx SetWindowExtEx SetViewportExtEx SetMapMode SelectClipRgn CreateSolidBrush GetBkColor SetStretchBltMode ExtSelectClipRgn ExtFloodFill GetCharABCWidthsW GetTextExtentExPointW CreateCompatibleBitmap BitBlt Arc Pie Polygon SetPolyFillMode PolyPolygon Rectangle RoundRect GetOutlineTextMetricsW GetStockObject MaskBlt DeleteObject StretchDIBits StretchBlt GetRgnBox EqualRgn PtInRegion RectInRegion Polyline CombineRgn GetPaletteEntries GetNearestPaletteIndex CreatePalette CreateHatchBrush CreatePatternBrush SaveDC RestoreDC CreateRectRgnIndirect CreateBitmap CreatePen SetTextAlign CreateICW ExtCreatePen CreateDIBSection GetDIBits CreateDIBitmap GetDIBColorTable EnumFontFamiliesExW SetAbortProc StartDocW EndDoc StartPage EndPage CreateDCW GetEnhMetaFileW DeleteEnhMetaFile GetEnhMetaFileHeader CreateEnhMetaFileW PlayEnhMetaFile CloseEnhMetaFile GetSystemPaletteEntries GetObjectW GetClipBox SetBkMode SetTextColor SetBkColor MoveToEx LineTo CreateFontIndirectW GetDeviceCaps GetRegionData ExtCreateRegion OffsetRgn ExtTextOutW ExcludeClipRect SetBrushOrgEx CreateRectRgn GdiFlush GetTextExtentPoint32W SelectPalette RealizePalette Ellipse GetTextMetricsW SelectObject

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

comdlg32

PrintDlgW ChooseColorW ChooseFontW GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError PageSetupDlgW

advapi32

RegSetValueExW RegQueryValueExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegCreateKeyExW RegOpenKeyExW RegCloseKey GetUserNameW RegDeleteKeyW

shell32

ExtractIconW DragQueryFileW DragQueryPoint DragFinish DragAcceptFiles SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc ExtractIconExW

ole32

RevokeDragDrop CoLockObjectExternal CoTaskMemAlloc OleInitialize OleUninitialize CoCreateInstance ReleaseStgMedium OleSetClipboard OleFlushClipboard OleIsCurrentClipboard OleGetClipboard RegisterDragDrop

new/QFAdminUtil_win32 (1)/vsapi32.dll

IMPHASH 2c2e79147833b5350b97c355d7168fcb
SHA256 7898fc65bfb0f93eb2a5134dae8b8efdeb279d07278d53176b8d22812ba8ea6a
MD5 144b85f2e6937ef8e0375e851cc66805
SHA1 81008024956c4edb1f1eaeff2bcad8a89073d2fc
SHA512 f21893449d3d7cde8e87f937f9b89949ef4ba3c743dbb48c1b0f75097111a5aec5658c1ea23ebea0c02b19b3d22930f4f8ec55f86757c78bef4a3ae7d95d24e1
SSDEEP 24576:/Fpw/1LTM9gc7uapTcLprrneZyOEkh611hO0BdGlF09Ha67SzivsLsTH9O2ZZc+9:ksic7IfeZyTPBAl+0hLsTL4JclAc
TLSH
T14785BF52B6A285E2C8560232D15F67362E7D9D3607299CC7BFC83884B933BD1A733752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3f:fa:7d:ef:25:d0:0a:59:62:dd:61:fe:29:85:fd:e6:0a:ae:ef:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Chains

Jul 23, 2013

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Minor OS version

Major OS version

Entry point

454081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\VSAPI\src\source\dllsrc\vsapiw32\vsapi32\PGO_2005\vsapi32.pdb

kernel32

WideCharToMultiByte EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetFileAttributesA SetFileAttributesA GetFileAttributesW GetLastError SetFileAttributesW InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId FindFirstFileA FindClose FindNextFileA GetFileTime OutputDebugStringA DuplicateHandle CloseHandle CreateFileA GetFileSize GlobalMemoryStatus SetFilePointer SetEndOfFile GetCurrentProcess SetFileTime WriteFile ReadFile CreateFileW HeapFree HeapAlloc FindFirstFileW FindNextFileW FileTimeToSystemTime FileTimeToLocalFileTime DeleteFileW GetSystemTimeAsFileTime MoveFileA CreateDirectoryW GetDriveTypeW MoveFileW GetDriveTypeA GetCurrentDirectoryA SetCurrentDirectoryA GetFullPathNameW SetEnvironmentVariableW GetCurrentDirectoryW SetCurrentDirectoryW GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree FatalAppExitA VirtualAlloc HeapReAlloc GetProcAddress GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThread GetFullPathNameA GetTimeZoneInformation SetHandleCount GetFileType GetStartupInfoA RtlUnwind Sleep LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryA GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CompareStringA CompareStringW SetEnvironmentVariableA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize GetLocaleInfoW DeleteFileA RemoveDirectoryA CreateDirectoryA

FreeVirusPattern OleRemoveVirus ReadPatternFile ScanFileVirus VSActOnFile VSActOnFileW VSAddArchProcessExcludeExtName VSAddArchProcessExtName VSAddDataType VSAddProcessExcludeExtName VSAddProcessExtName VSAddSpywareExcludeName VSArchFileNeedProcess VSBackupFile VSBackupFileW VSBackupResource VSBackupResourceW VSBackupVSCData VSBaseName VSCalculateCRC VSCharType VSCheckPatternFile VSCheckPatternFileW VSCleanEncryptedVirus VSCleanVirus VSCleanVirusW VSClearArchProcessExcludeExtNameTable VSClearArchProcessExtNameTable VSClearProcessExcludeExtNameTable VSClearProcessExtNameTable VSClearSpywareExcludeNameTable VSCloseFile VSCloseIOFromHandle VSCloseResource VSConvertCharacter VSCopyFile VSCopyFileFD VSCopyFileW VSCrc32 VSCreateDirectoryTree VSDCIsCompressed VSDataType VSDataTypeFD VSDecompress VSDecompressFile VSDelDataType VSDelUserDecodeFunc VSDeleteArchProcessExcludeExtName VSDeleteArchProcessExtName VSDeleteProcessExcludeExtName VSDeleteProcessExtName VSDeleteSpywareExcludeName VSDeleteUnusedPattern VSDisablePattern VSEncBackupFile VSEncBackupFileW VSFileNeedProcess VSFileNeedProcessW VSFileType VSFindFirst VSFindNewestPattern VSFindNext VSFormatDate VSFormatDateTime VSFreePatternList VSFreePatternNode VSGetActiveScanFlag VSGetArchProcessExcludeExtName VSGetArchProcessExcludeExtNumber VSGetArchProcessExtName VSGetArchProcessExtNumber VSGetArchProcessExtTableSize VSGetBackupEncodeFlag VSGetBackupFileInfo VSGetBackupFileInfoW VSGetCharacterEnvType VSGetCleanBackupFlag VSGetCleanZipFlag VSGetConfChangeFlag VSGetConfig VSGetConfigEx VSGetCurrentPatternFileInternalVersion VSGetCurrentPatternFileVersion VSGetDataTypeInfo VSGetDebug VSGetDecodeFlag VSGetDecompressLayer VSGetDefaultExcludeExtList VSGetDefaultExcludeExtListSize VSGetDefaultExtList VSGetDefaultExtListSize VSGetDefaultHospitalPath VSGetDefaultPatternFile VSGetDefaultPatternPath VSGetDefaultTempPath VSGetDetectableVirusNumber VSGetEncodeAction VSGetEncryptTempFileFlag VSGetExpandLiteFlag VSGetExtractAmgFlag VSGetExtractArchiveFlag VSGetExtractFileCountLimit VSGetExtractFileRatioLimit VSGetExtractFileSizeLimit VSGetExtractFileSizeLimitByVSDT VSGetExtractPath VSGetGenericVirusReport VSGetHeuristicLevel VSGetKeepDecompressFileFlag VSGetLastPattern VSGetLastPatternW VSGetLogFilePath VSGetLogFlag VSGetMemoryDecompressSize VSGetMsgScanLayer VSGetMultiPatternFilesInfo VSGetNormalizeMemScanFlag VSGetOleEmbedScanLayer VSGetPatternHandle VSGetPatternInternalVersion VSGetPatternInternalVersionW VSGetPatternList VSGetPatternPath VSGetPatternPathW VSGetPatternProperty VSGetProcessAllFileFlag VSGetProcessAllFileInArcFlag VSGetProcessAllSubDirFlag VSGetProcessExcludeExtName VSGetProcessExcludeExtNumber VSGetProcessExtName VSGetProcessExtNumber VSGetProcessExtTableSize VSGetProcessMemScanFlag VSGetRTFScanLayer VSGetRedAlertFlag VSGetScanBPFlag VSGetScanGenericMacroFlag VSGetScanJavaFlag VSGetScanMacroFlag VSGetScanMemoryFlag VSGetScanTask VSGetScanTaskStatus VSGetScriptTrapFlag VSGetSmartDecompressFlag VSGetSoftMiceFlag VSGetSpywareExcludeName VSGetSpywareExcludeNameEx VSGetSpywareExcludeNumber VSGetStripMacroFlag VSGetTempPath VSGetUserName VSGetVSCInfo VSGetVSDebug VSGetVSVerboseLevel VSGetVerboseLevel VSGetVersion VSGetVersionString VSGetVirusAction VSGetVirusDetectionInfo VSGetVirusHospitalPath VSGetVirusInfo VSGetVirusNameInfo VSGetVirusNameInfoEx VSGetVirusPatternInfo VSGetVirusPatternInfoEx VSGetVirusPatternInformation VSGetVirusPropertyByName VSGetVolume VSInit VSIsDir VSIsFullPathName VSIsNewerEngine VSIsTwoByteWord VSLog VSLseekResource VSMatch VSMergeDir VSMkdir VSNoVolumeName VSOpenFile VSOpenFileW VSOpenIOFromHandle VSOpenResource VSPatternVersionToString VSProcessDir VSProcessFile VSQuit VSReadControlPattern VSReadFile VSReadLog VSReadPattern VSReadPatternInFile VSReadPatternInFileW VSReadResource VSReadVirusPattern VSRemoveAllTempFile VSRemoveWhiteChar VSResetConfChangeFlag VSResetScanCounter VSResourceDataType VSResourceSize VSRestoreFile VSRestoreFileW VSScanBP VSScanDir VSScanFile VSScanFileFD VSScanResource VSScanShellCode VSSearchArchProcessExcludeExtName VSSearchArchProcessExtName VSSearchProcessExcludeExtName VSSearchSpywareExcludeName VSSeekFile VSSetActiveScanFlag VSSetAdvFileInfoCallBackFunc VSSetAskActionFunc VSSetBackupEncodeFlag VSSetCharacterEnvType VSSetCleanBackupFlag VSSetCleanZipFlag VSSetConfig VSSetConfigEx VSSetCountFileFlag VSSetDataTypeFD VSSetDataTypeInfo VSSetDebug VSSetDecodeFlag VSSetDecompressLayer VSSetDefaultHospitalPath VSSetDefaultPatternFile VSSetDefaultPatternPath VSSetDefaultTempPath VSSetEncodeAction VSSetEncryptTempFileFlag VSSetExpandLiteFlag VSSetExtractAmgFlag VSSetExtractArchiveFlag VSSetExtractFileCountLimit VSSetExtractFileRatioLimit VSSetExtractFileSizeLimit VSSetExtractFileSizeLimitByVSDT VSSetExtractPath VSSetFeedbackCallBackFunc VSSetHeuristicLevel VSSetKeepDecompressFileFlag VSSetLogFilePath VSSetLogFilePathFunc VSSetLogFlag VSSetMemoryDecompressSize VSSetMsgScanLayer VSSetNormalizeMemScanFlag VSSetOleEmbedCallBackFunc VSSetOleEmbedScanLayer VSSetPatternPath VSSetPostExtractArchFunc VSSetPreExtractArchFunc VSSetProcessAllFileFlag VSSetProcessAllFileInArcFlag VSSetProcessAllSubDirFlag VSSetProcessFileCallBackFunc VSSetProcessMemScanFlag VSSetRTFScanLayer VSSetRedAlertFlag VSSetRenameFileNameFunc VSSetScanBPFlag VSSetScanGenericMacroFlag VSSetScanJavaFlag VSSetScanMacroFlag VSSetScanMemoryFlag VSSetScriptTrapFlag VSSetSmartDecompressFlag VSSetSoftMiceFlag VSSetStripMacroFlag VSSetTempPath VSSetUserDecodeFunc VSSetUserLogFunc VSSetVSCInfo VSSetVSDebug VSSetVSVerboseLevel VSSetVerboseLevel VSSetVirusAction VSSetVirusHospitalPath VSSetVolume VSSizeOfFile VSStoreVSCData VSStricmp VSStringToPatternVersion VSStrip VSStrnicmp VSSwapLong VSSwapLongTable VSSwapShort VSSwapShortTable VSToLowerString VSToUpperString VSUpdateZip VSVirusScan VSVirusScanFile VSVirusScanFileW VSVirusScanFileWithoutFNFilter VSWriteFile VSWriteResource _VSIScanEnableSignature _VSIScanGetVirusInfo _VSIScanGetVirusInfoEx _VSScanVirusInMemory

new.7z

new/QFAdminUtil_win32 (1)/QDecrypt.com

vsapi32

kernel32

user32

advapi32

shell32

ole32

generic

new/QFAdminUtil_win32 (1)/QDecrypt.exe

vsapi32

rpcrt4

comctl32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

generic

new/QFAdminUtil_win32 (1)/vsapi32.dll

PE Signature issue

kernel32

generic

new/a4897c1b.zip