a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40

Sharing

Copy URL Twitter E-mail

General

Target
a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40
Size 725KB
Sample260820-mpsrdsan5x
SHA256 a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40
MD5 b7a0fa334584421b051ceb46b5667b85
SHA1 f681eb5741e8206589f1b12f1b67ba5c2f99f342
SHA512 a4b748ed04f9941714260039f79cfcbbb38a3bab0f9a241a5a7b9434e9fc03b348f8256e264cceaaf87848cb9fe0677fd49328eb95ccb930ea4043acaa1ece3e
SSDEEP 12288:IBUT/lhotuoMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:2Q/w0eyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T1D1F4F103B5A53F22DAD40279F663D7658DABAFA324641223630B3FDA3D5E7C34E14216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40

File Explorer

a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40

.exe 725KB

a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40

IMPHASH ec200cd291acd2605f65b03119b24a42
SHA256 a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40
MD5 b7a0fa334584421b051ceb46b5667b85
SHA1 f681eb5741e8206589f1b12f1b67ba5c2f99f342
SHA512 a4b748ed04f9941714260039f79cfcbbb38a3bab0f9a241a5a7b9434e9fc03b348f8256e264cceaaf87848cb9fe0677fd49328eb95ccb930ea4043acaa1ece3e
SSDEEP 12288:IBUT/lhotuoMp0yZJwkCnh+M31Yx7oxeROKDMUcHYDybJU/HY3HNkUrsP6xN3Q:2Q/w0eyfwkfSwAeROyDcKkUf67xN3Q
TLSH
T1D1F4F103B5A53F22DAD40279F663D7658DABAFA324641223630B3FDA3D5E7C34E14216
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44799

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\QQMusicPC\pdbRelease\QQMusicExternal.pdb

imm32

ImmDisableIME

kernel32

LeaveCriticalSection DeleteCriticalSection LoadResource LockResource SizeofResource FindResourceW FindResourceExW LoadLibraryW InterlockedIncrement InterlockedDecrement WaitForSingleObject GetModuleFileNameW lstrcmpiW LoadLibraryExW FreeLibrary HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap Sleep GetPrivateProfileStringW OpenProcess VirtualProtect VirtualFree InitializeCriticalSectionAndSpinCount InterlockedCompareExchange VirtualAlloc GetCurrentThreadId SuspendThread ResumeThread GetThreadContext FlushInstructionCache SetThreadContext VirtualQuery SetLastError InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent CreateEventW WaitForSingleObjectEx ResetEvent GetLastError RaiseException MultiByteToWideChar CreateMutexW CloseHandle GetCurrentThread GetModuleHandleW GetProcAddress SetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter OutputDebugStringW EnterCriticalSection GetCurrentProcess

user32

DestroyWindow IsWindow TranslateMessage DispatchMessageW GetMessageW CharNextW

advapi32

RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCloseKey RegDeleteValueW

shell32

SHGetSpecialFolderPathW

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc

oleaut32

VarUI4FromStr

exceptcatch

SetExceptionCatcher

qqmusiccommon

?isEqual@ValueIteratorBase@Json@@IBE_NABV12@@Z ?computeDistance@ValueIteratorBase@Json@@IBEHABV12@@Z ?decrement@ValueIteratorBase@Json@@IAEXXZ ?increment@ValueIteratorBase@Json@@IAEXXZ ?deref@ValueIteratorBase@Json@@IBEAAVValue@2@XZ ??0ValueIterator@Json@@QAE@ABV01@@Z ??0Value@Json@@QAE@ABV01@@Z ??1Value@Json@@QAE@XZ ??4Value@Json@@QAEAAV01@ABV01@@Z ??1CharReaderBuilder@Json@@UAE@XZ ??1Factory@StreamWriter@Json@@UAE@XZ ??1StreamWriter@Json@@UAE@XZ ??1StreamWriterBuilder@Json@@UAE@XZ ??1Writer@Json@@UAE@XZ ??0StyledStreamWriter@Json@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?WriteLog@qqmusic@@YAXHKPB_WZZ ?GetExeFolder@qqmusic@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ ?GetAppVersion@qqmusic@@YAIII@Z ?GetAppSubVersion@qqmusic@@YAIXZ ?GetAppMainVersion@qqmusic@@YAIXZ ??0Value@Json@@QAE@W4ValueType@1@@Z ?CreateInstance@qqmusic@@YAPAXPBD@Z ?GetAppDataFolder@qqmusic@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ ??0Reader@Json@@QAE@XZ ?parse@Reader@Json@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVValue@2@_N@Z ?isMember@Value@Json@@QBE_NPBD@Z ?isString@Value@Json@@QBE_NXZ ??AValue@Json@@QAEAAV01@PBD@Z ?Utf8ToUtf16W@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PBDH@Z ?asCString@Value@Json@@QBEPBDXZ ?isBool@Value@Json@@QBE_NXZ ?asBool@Value@Json@@QBE_NXZ ?isInt@Value@Json@@QBE_NXZ ?asInt@Value@Json@@QBEHXZ ??0Value@Json@@QAE@_N@Z ?toStyledString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?Stop@CQMPThreadPool@@QAEXI@Z ?Instance@CQMPThreadPool@@SAAAV1@XZ ?ReleaseLogModle@qqmusic@@YAXXZ ?write@FastWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?write@StyledWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?what@Exception@Json@@UBEPBDXZ ?newCharReader@CharReaderBuilder@Json@@UBEPAVCharReader@2@XZ ?newStreamWriter@StreamWriterBuilder@Json@@UBEPAVStreamWriter@2@XZ ??1Exception@Json@@UAE@XZ

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_CxxThrowException __CxxFrameHandler3 __std_terminate _purecall wcsstr memset __std_exception_destroy _except_handler4_common __std_exception_copy memmove memcpy

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _errno _invalid_parameter_noinfo __p___argc _controlfp_s _invalid_parameter_noinfo_noreturn __p___wargv

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen wcscmp wcsnlen _wcslwr_s wmemcpy_s wcsncpy_s wcslen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __p__commode _set_fmode __stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

free malloc _recalloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

??0CDownloadPure@QMNetwork@@QAE@ABV01@@Z ??0CDownloadPure@QMNetwork@@QAE@PAVITaskCallback@1@@Z ??0CharReader@Json@@QAE@ABV01@@Z ??0CharReader@Json@@QAE@XZ ??0CharReaderBuilder@Json@@QAE@ABV01@@Z ??0Exception@Json@@QAE@ABV01@@Z ??0Factory@CharReader@Json@@QAE@ABV012@@Z ??0Factory@CharReader@Json@@QAE@XZ ??0Factory@StreamWriter@Json@@QAE@ABV012@@Z ??0Factory@StreamWriter@Json@@QAE@XZ ??0FastWriter@Json@@QAE@ABV01@@Z ??0ILoginHost@@QAE@ABV0@@Z ??0ILoginHost@@QAE@XZ ??0ILyricHost@@QAE@$$QAV0@@Z ??0ILyricHost@@QAE@ABV0@@Z ??0ILyricHost@@QAE@XZ ??0ILyricRenderFactory@@QAE@$$QAV0@@Z ??0ILyricRenderFactory@@QAE@ABV0@@Z ??0ILyricRenderFactory@@QAE@XZ ??0ITaskCallback@QMNetwork@@QAE@$$QAV01@@Z ??0ITaskCallback@QMNetwork@@QAE@ABV01@@Z ??0ITaskCallback@QMNetwork@@QAE@XZ ??0LogicError@Json@@QAE@$$QAV01@@Z ??0LogicError@Json@@QAE@ABV01@@Z ??0Path@Json@@QAE@$$QAV01@@Z ??0Path@Json@@QAE@ABV01@@Z ??0PathArgument@Json@@QAE@$$QAV01@@Z ??0PathArgument@Json@@QAE@ABV01@@Z ??0Reader@Json@@QAE@$$QAV01@@Z ??0Reader@Json@@QAE@ABV01@@Z ??0RuntimeError@Json@@QAE@$$QAV01@@Z ??0RuntimeError@Json@@QAE@ABV01@@Z ??0StaticString@Json@@QAE@PBD@Z ??0StreamWriter@Json@@QAE@ABV01@@Z ??0StreamWriterBuilder@Json@@QAE@ABV01@@Z ??0StyledStreamWriter@Json@@QAE@ABV01@@Z ??0StyledWriter@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@XZ ??1CDownloadPure@QMNetwork@@UAE@XZ ??1CharReader@Json@@UAE@XZ ??1Factory@CharReader@Json@@UAE@XZ ??1FastWriter@Json@@UAE@XZ ??1ILoginHost@@UAE@XZ ??1LogicError@Json@@UAE@XZ ??1Path@Json@@QAE@XZ ??1PathArgument@Json@@QAE@XZ ??1Reader@Json@@QAE@XZ ??1RuntimeError@Json@@UAE@XZ ??1StyledStreamWriter@Json@@QAE@XZ ??1StyledWriter@Json@@UAE@XZ ??4CDownloadPure@QMNetwork@@QAEAAV01@ABV01@@Z ??4CharReader@Json@@QAEAAV01@ABV01@@Z ??4CharReaderBuilder@Json@@QAEAAV01@ABV01@@Z ??4Exception@Json@@QAEAAV01@ABV01@@Z ??4Factory@CharReader@Json@@QAEAAV012@ABV012@@Z ??4Factory@StreamWriter@Json@@QAEAAV012@ABV012@@Z ??4FastWriter@Json@@QAEAAV01@ABV01@@Z ??4Features@Json@@QAEAAV01@$$QAV01@@Z ??4Features@Json@@QAEAAV01@ABV01@@Z ??4ILoginHost@@QAEAAV0@ABV0@@Z ??4ILyricHost@@QAEAAV0@$$QAV0@@Z ??4ILyricHost@@QAEAAV0@ABV0@@Z ??4ILyricRenderFactory2@@QAEAAV0@$$QAV0@@Z ??4ILyricRenderFactory2@@QAEAAV0@ABV0@@Z ??4ILyricRenderFactory@@QAEAAV0@$$QAV0@@Z ??4ILyricRenderFactory@@QAEAAV0@ABV0@@Z ??4ITaskCallback@QMNetwork@@QAEAAV01@$$QAV01@@Z ??4ITaskCallback@QMNetwork@@QAEAAV01@ABV01@@Z ??4LogicError@Json@@QAEAAV01@$$QAV01@@Z ??4LogicError@Json@@QAEAAV01@ABV01@@Z ??4Path@Json@@QAEAAV01@$$QAV01@@Z ??4Path@Json@@QAEAAV01@ABV01@@Z ??4PathArgument@Json@@QAEAAV01@$$QAV01@@Z ??4PathArgument@Json@@QAEAAV01@ABV01@@Z ??4Reader@Json@@QAEAAV01@$$QAV01@@Z ??4Reader@Json@@QAEAAV01@ABV01@@Z ??4RuntimeError@Json@@QAEAAV01@$$QAV01@@Z ??4RuntimeError@Json@@QAEAAV01@ABV01@@Z ??4StaticString@Json@@QAEAAV01@$$QAV01@@Z ??4StaticString@Json@@QAEAAV01@ABV01@@Z ??4StreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StreamWriterBuilder@Json@@QAEAAV01@ABV01@@Z ??4StyledStreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StyledWriter@Json@@QAEAAV01@ABV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@$$QAV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@ABV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@$$QAV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@ABV01@@Z ??4Writer@Json@@QAEAAV01@ABV01@@Z ??8ValueIteratorBase@Json@@QBE_NABV01@@Z ??9ValueIteratorBase@Json@@QBE_NABV01@@Z ??BStaticString@Json@@QBEPBDXZ ??CValueConstIterator@Json@@QBEPBVValue@1@XZ ??CValueIterator@Json@@QBEPAVValue@1@XZ ??DValueConstIterator@Json@@QBEABVValue@1@XZ ??DValueIterator@Json@@QBEAAVValue@1@XZ ??EValueConstIterator@Json@@QAE?AV01@H@Z ??EValueConstIterator@Json@@QAEAAV01@XZ ??EValueIterator@Json@@QAE?AV01@H@Z ??EValueIterator@Json@@QAEAAV01@XZ ??FValueConstIterator@Json@@QAE?AV01@H@Z ??FValueConstIterator@Json@@QAEAAV01@XZ ??FValueIterator@Json@@QAE?AV01@H@Z ??FValueIterator@Json@@QAEAAV01@XZ ??GValueIteratorBase@Json@@QBEHABV01@@Z ??_7CDownloadPure@QMNetwork@@6B@ ??_7CharReader@Json@@6B@ ??_7CharReaderBuilder@Json@@6B@ ??_7Exception@Json@@6B@ ??_7Factory@CharReader@Json@@6B@ ??_7Factory@StreamWriter@Json@@6B@ ??_7FastWriter@Json@@6B@ ??_7ILoginHost@@6B@ ??_7ILyricHost@@6B@ ??_7ILyricRenderFactory@@6B@ ??_7ITaskCallback@QMNetwork@@6B@ ??_7LogicError@Json@@6B@ ??_7RuntimeError@Json@@6B@ ??_7StreamWriter@Json@@6B@ ??_7StreamWriterBuilder@Json@@6B@ ??_7StyledWriter@Json@@6B@ ??_7Writer@Json@@6B@ ??_FStyledStreamWriter@Json@@QAEXXZ ??_FValue@Json@@QAEXXZ ?OnTaskNotify2@ITaskCallback@QMNetwork@@UAEXPADH@Z ?c_str@StaticString@Json@@QBEPBDXZ

Name

.text

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dtc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dtd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

593KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a698ddf27177fefe4ef50472316fbe43aff5421824857322cd5193d34eaa8d40

imm32

kernel32

user32

advapi32

shell32

ole32

oleaut32

exceptcatch

qqmusiccommon

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic