0521b53165727424a84bb3872f5957ceb1ad1a6ed15bc60f092a011f8552ba45
- SHA256 0521b53165727424a84bb3872f5957ceb1ad1a6ed15bc60f092a011f8552ba45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_q0.3.02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_q0.3.02.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 0521b53165727424a84bb3872f5957ceb1ad1a6ed15bc60f092a011f8552ba45
- Size 2.8MB
- Sample260830-2er5fadf72
- SHA256 0521b53165727424a84bb3872f5957ceb1ad1a6ed15bc60f092a011f8552ba45
- MD5 713bd8d8675f4d7e6857748cd0c83778
- SHA1 a100f0ea257da053555c798014fa68288316985c
- SHA512 ee3aa2afbc67a44d1f52fe1312f69d469819537f446673faccb9ebac33284c037cbacce20d6edb7fd600ffe25a634066c4395a2a7ceedc3135364d90ed60ce38
- SSDEEP 49152:DU0LgyIxlFOfLLe2DN0J58A6urIUqEaq8Hoju1nqvnXYqi41x2TLSowtIQw/nul/:hLgyIxbOGGNouuVaFojuQvnXYG1rFw/e
- TLSH T198D5339784FCBC13E1CC807D19B96BC3120123B47BC7595B7CE9A1E88D9A64854FA4EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_q0.3.02.exe
File Explorer
-
0521b53165727424a84bb3872f5957ceb1ad1a6ed15bc60f092a011f8552ba45.zip 2.8MB
-
install_q0.3.02.exe.exe 25.6MB
install_q0.3.02.exe
- IMPHASH e611cb40dae30a74fa3f15a0e816a66a
- SHA256 d089f485122827cd0ff70d8f7201d4887ce66de7a68377967a95b29fcaf3ec3e
- MD5 075aeb9634f862634994c165cb8d6746
- SHA1 f89c67682b43c3ca33f052c8e846cd471c8628d1
- SHA512 c051d8b002c7526c7fd28a60a3314339f7697dd201c1b7b9fb7e991c11e51c0de04b7d02449f0c3587202e8c84ae68e0733acc261e8bc7e81ffc7f51f4d81a83
- SSDEEP 49152:NF335Swxsg3ID4aV2zgQKTXt5qyUOIoqNlx4oTINDlvD4a8QNoKcj5EXV2qOLHe:r5JC7k0fUOIo6lxfMaEXV2qOL+
- TLSH T153471B46B701CD8AF4665274A49B5FA0E336DD708AB1A33713B53A1D6FFE35C8EA2044
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
91816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gdiplus
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
winmm
PlaySoundW
imm32
ImmGetDefaultIMEWnd
kernel32
LoadLibraryA
GetProcAddress
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
SetCurrentDirectoryW
GetSystemDirectoryW
DeleteFileW
lstrcpynW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
SetEndOfFile
GetStringTypeW
SetFilePointer
WriteConsoleW
ReadFile
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
FlsAlloc
GetCurrentThreadId
SetLastError
FlsFree
FlsSetValue
FlsGetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
GetVersion
HeapSetInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WriteFile
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwindEx
ExitProcess
HeapSize
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
FindResourceW
CloseHandle
lstrcpyW
GetLastError
CreateMutexW
lstrcmpiW
GetSystemDefaultLangID
GetEnvironmentVariableW
lstrlenW
GetModuleFileNameW
GetLocalTime
ExpandEnvironmentStringsA
EncodePointer
DecodePointer
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlPcToFileHeader
RaiseException
GetFileType
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
HeapReAlloc
GetStartupInfoW
GetCommandLineW
FindFirstFileW
WideCharToMultiByte
GetACP
SetErrorMode
FindClose
GetCurrentProcess
FreeLibrary
SetCurrentDirectoryA
MultiByteToWideChar
lstrcatW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetTempPathW
CreateFileW
GetVersionExA
GetModuleHandleA
LoadLibraryW
GetSystemDirectoryA
GetModuleHandleW
GetVersionExW
GetLocaleInfoW
VirtualAlloc
HeapFree
user32
SetWindowTextW
TrackPopupMenuEx
EnableMenuItem
CreateIconIndirect
GetIconInfo
GetRawInputDeviceInfoW
GetRawInputDeviceList
LoadIconW
SetFocus
EndDialog
GetDlgItemInt
IsWindowEnabled
SetDlgItemInt
SystemParametersInfoW
GetWindowRect
GetDlgItem
EnableWindow
DefWindowProcW
PostQuitMessage
DestroyMenu
EndPaint
BeginPaint
ReleaseDC
GetDC
SetWindowPos
GetSystemMetrics
GetClassNameW
GetWindowTextW
KillTimer
PostMessageW
TrackPopupMenu
CheckMenuItem
ModifyMenuW
SetMenuDefaultItem
GetCursorPos
SetForegroundWindow
GetForegroundWindow
DestroyWindow
CreateDialogParamW
GetSubMenu
LoadMenuW
RegisterWindowMessageW
RegisterHotKey
UnregisterHotKey
UpdateWindow
GetWindowTextLengthW
SetLayeredWindowAttributes
CreateWindowExW
RegisterClassExW
LoadCursorW
DispatchMessageW
IsWindow
SendMessageA
EnumChildWindows
GetWindowLongA
CallWindowProcW
GetMonitorInfoW
EnumDisplayMonitors
GetWindowLongPtrW
SetWindowLongPtrW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
DialogBoxIndirectParamW
GetParent
ScreenToClient
MonitorFromPoint
GetMonitorInfoA
GetClientRect
TranslateMessage
GetMessageW
DestroyIcon
CopyIcon
DialogBoxParamW
MessageBoxW
LoadImageW
SetTimer
MessageBeep
keybd_event
SendMessageW
GetKeyState
FindWindowW
GetDlgItemTextW
SetDlgItemTextW
wsprintfW
SendDlgItemMessageW
ShowWindow
gdi32
DeleteDC
CreateCompatibleDC
GetStockObject
GetObjectA
CreateFontIndirectA
GetDIBColorTable
DeleteObject
SetDIBits
SelectObject
SetBkColor
TextOutW
SetTextColor
GetDeviceCaps
GetDIBits
GetObjectW
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
shell32
Shell_NotifyIconW
DragFinish
DragQueryFileW
DragAcceptFiles
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ole32
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
shlwapi
StrCmpNIW
Name
.text
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25.3MB
Virtual Size
25.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=144, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=57, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=1, id=136, version=30729,
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=344, id=1, productName=Unmarked objects,
count=15, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,