14b4dffae18ebab6e36667dcdf9dcd26fa5d45a941b5b3dc541e363630f41b0f
- SHA256 14b4dffae18ebab6e36667dcdf9dcd26fa5d45a941b5b3dc541e363630f41b0f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_q0.3.08.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_q0.3.08.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 14b4dffae18ebab6e36667dcdf9dcd26fa5d45a941b5b3dc541e363630f41b0f
- Size 3.4MB
- Sample260830-2cs9qa1enh
- SHA256 14b4dffae18ebab6e36667dcdf9dcd26fa5d45a941b5b3dc541e363630f41b0f
- MD5 5cdf5a21e16795b678d2ee9d78d04fa9
- SHA1 72206bdf21357d3f3f83b672ef4c2f3ba573825d
- SHA512 32b69d0095b897b589adda659d7700b51951bc353afa43bce23093853a99abbdd22cd3d52738a798441d45203f43e261bd8e0c68b663000990e1b92dfb1fee55
- SSDEEP 98304:ge24De6a2XqFXBNKwVhczTI39laJY7mPZLQ63aQdEsJE:gZ4DeOMXBNKQhGUNWAmPlQSav2E
- TLSH T1E9F5338E8CACCE91C697E1349371456B6BB2247A8FD1EA01B173E2CB4DC34BD9946DC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_q0.3.08.exe
File Explorer
-
14b4dffae18ebab6e36667dcdf9dcd26fa5d45a941b5b3dc541e363630f41b0f.zip 3.4MB
-
install_q0.3.08.exe.exe 31.2MB
install_q0.3.08.exe
- IMPHASH 693b9983e2dfb464a405b7abaf658e8e
- SHA256 956e0a75a535e93dc0df56c320d2649062b5dee714d4c28443d943d44b7f5d9b
- MD5 5571f12cadc7ec6da6e20e01f3ee0cf9
- SHA1 f1d5fc3af21ae21474bfa9c3cbb966518aba2c4b
- SHA512 6b9fb66b9775cb16f0c6fdafbecc07481321750384c7c62eb5ae378ad8a1e929bc66b2ae577aa7f9060c1c52cb6c6c4b47720ea42075f6d900093ed8d55319e4
- SSDEEP 98304:5i9U9dbM4EJ3yZLxG8caZfnjIhKnp5l6t4l8xMv4cE:w2vbMxJ35aZfnOElY4lzm
- TLSH T131776012B346898BE476A278484B8F94E321EDB19AB1937773B4731E1FFE34C5E96104
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
204884
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
kernel32
FormatMessageW
RemoveDirectoryW
DeleteFileW
GetFullPathNameW
GetFileSize
GetFileAttributesW
CreateFileW
GetLongPathNameW
CloseHandle
GetVersionExW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetStartupInfoW
GetDriveTypeW
GetLogicalDrives
MultiByteToWideChar
ReadFile
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetModuleHandleW
ExitProcess
SetEvent
TerminateProcess
ExitThread
SetLastError
SetConsoleCtrlHandler
CreateEventW
OpenFile
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetLogicalDriveStringsW
CreateFileMappingW
QueryDosDeviceW
GetTempFileNameW
ExpandEnvironmentStringsW
SetFilePointer
SystemTimeToFileTime
CreateDirectoryW
SetFileTime
WriteFile
LocalFileTimeToFileTime
CreatePipe
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetFilePointerEx
ReadConsoleW
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
GetModuleFileNameW
HeapSize
AreFileApisANSI
GetModuleHandleExW
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
GetLastError
SetConsoleTitleW
GetStdHandle
WriteConsoleW
AllocConsole
GetCommandLineW
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
LoadLibraryExW
OutputDebugStringW
SetEndOfFile
GetTempPathW
RtlVirtualUnwind
RtlCaptureContext
GetCurrentThreadId
GetOEMCP
GetACP
IsProcessorFeaturePresent
GetCPInfo
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
SetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
HeapFree
CreateThread
ResumeThread
HeapAlloc
RtlPcToFileHeader
RaiseException
VirtualAlloc
RtlUnwindEx
wininet
InternetCloseHandle
FtpGetFileSize
HttpQueryInfoW
InternetConnectW
InternetReadFile
FtpOpenFileW
InternetCrackUrlW
InternetOpenUrlW
InternetOpenW
comctl32
InitCommonControlsEx
psapi
GetMappedFileNameW
user32
LoadCursorW
wsprintfW
LoadIconW
DefWindowProcW
GetKeyState
RegisterClassExW
PostQuitMessage
SetActiveWindow
KillTimer
SetForegroundWindow
DialogBoxParamW
EndDialog
LoadStringW
CreateWindowExW
MessageBoxW
SetDlgItemTextW
SendMessageW
SetWindowTextW
SetTimer
ShowWindow
gdi32
GetStockObject
advapi32
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RegConnectRegistryW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
CryptHashData
shell32
CommandLineToArgvW
Name
.text
Size
307KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
30.6MB
Virtual Size
30.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
176KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=12, id=205, version=50929,
count=73, id=207, version=50929,
count=216, id=206, version=50929,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=180, id=1, productName=Unmarked objects,
count=40, id=211, version=51106,
count=1, id=201, productName=VS2012 UPD1 build 51106, version=51106,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD1 build 51106, version=51106,