cb20394cae164ed9911eb2310e36783c415dcd179a9131d538c881285c39daec
- SHA256 cb20394cae164ed9911eb2310e36783c415dcd179a9131d538c881285c39daec
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_q2.0.16.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_q2.0.16.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target cb20394cae164ed9911eb2310e36783c415dcd179a9131d538c881285c39daec
- Size 3.8MB
- Sample260903-naerna1yht
- SHA256 cb20394cae164ed9911eb2310e36783c415dcd179a9131d538c881285c39daec
- MD5 07ce64200fdc059c3a1a8e50bd1eea30
- SHA1 b1397e4efe93eb04731323f94ee2700290a60b42
- SHA512 a50721f6a325be60912f2d9de1559e25a059585b94b78b14e49de703241801fcb96f4cd6b991f12eefa8c7f72af22433e1378d86375a131933afaea513ff574e
- SSDEEP 98304:BrzD02mvV9AfbkGBuMTSE7JqRXkfnq9A1xSN8i:9D0J3AfruMTSEMkfnp1x6
- TLSH T1520633239DBCB847F19A9172E5365637FB04B2329BDC6BF9F45A42FA4D8310881724D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_q2.0.16.exe
File Explorer
-
cb20394cae164ed9911eb2310e36783c415dcd179a9131d538c881285c39daec.zip 3.8MB
-
install_q2.0.16.exe.exe 25.4MB
install_q2.0.16.exe
- IMPHASH cf1d9a74e1b968361bc9958407575708
- SHA256 6b96dd3335f849b34dde1934dbe25f25de48244e2a3d044c522ce8644b851c0a
- MD5 5ff887d635caafc7b0857320ee5c47c0
- SHA1 1ea66c7c59cc9dabee4693bb0018c0d4189b4945
- SHA512 0bcf80b970ba4c1d90b61353bc1bdd437e650bf76b4f1b30c0d404747f9d01352e902f80d911d99892151fa91cafb05f361f0fc176102e558568cb5121877b12
- SSDEEP 49152:GKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46I:XjAIMaQi7kmeHh2yeH7rkfvVsX+NY
- TLSH T14A47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72412
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
LocalFree
GetCurrentProcess
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
MoveFileW
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
GetModuleFileNameW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
GetSystemDirectoryW
GetTickCount
GetLastError
GetFullPathNameW
FreeEnvironmentStringsW
GetFileAttributesW
RtlUnwindEx
OutputDebugStringW
OutputDebugStringA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateDirectoryW
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
ProcessIdToSessionId
Process32NextW
LoadLibraryA
DeleteFileW
Process32FirstW
GetLocalTime
SystemTimeToFileTime
VirtualAlloc
RtlUnwind
user32
CharNextW
LoadStringW
wsprintfW
advapi32
AdjustTokenPrivileges
GetTokenInformation
RegCloseKey
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
InitiateSystemShutdownExW
RegQueryValueExW
LookupPrivilegeValueW
DuplicateTokenEx
OpenProcessToken
OpenServiceW
ole32
CLSIDFromString
setupapi
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW
crypt32
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptQueryObject
shlwapi
PathFileExistsW
PathAppendW
shell32
SHGetKnownFolderPath
SHGetFolderPathW
Name
.text
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24.8MB
Virtual Size
24.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25711,
count=5, id=259, version=25711,
count=142, id=261, version=25711,
count=2, id=265, version=27048,
count=43, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=1, id=262, version=25711,
count=17, id=257, version=25711,
count=178, id=1, productName=Unmarked objects,
count=4, id=261, version=27048,
count=1, id=255, version=27048,
count=1, id=151,
count=1, id=258, version=27048,