576622eb7792f122e616aede82993ba0aab8758a7b2fc86fab6675642b0cb81b
- SHA256 576622eb7792f122e616aede82993ba0aab8758a7b2fc86fab6675642b0cb81b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_q2.0.18.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_q2.0.18.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 576622eb7792f122e616aede82993ba0aab8758a7b2fc86fab6675642b0cb81b
- Size 3.8MB
- Sample260903-zpp2qawbme
- SHA256 576622eb7792f122e616aede82993ba0aab8758a7b2fc86fab6675642b0cb81b
- MD5 64ddce4e095cbf3d6b5d80192c820b84
- SHA1 ed277a55bbc1a8a11f4d8b982cf933887e71b30d
- SHA512 2b5b9a1ae7a7ac16eb21c605c2ffe52ed8b934f4114778f7b852d61909282e538193c4d98f3e235cf7f946101d5e0345679d392e04e2c502b8c2af4f782526b2
- SSDEEP 98304:Rx1qT7PMvY1O4CUL+vsaDLwEfllmm3HoJiT+bqQIhq/rsaKUXR:RxAXMgUEIhflMm3IGG22fKUXR
- TLSH T1BC06334B497E2C1BD957E173D9345C1FA71A8A316BCB32F89B0261DC0FA2B06D3594E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_q2.0.18.exe
File Explorer
-
576622eb7792f122e616aede82993ba0aab8758a7b2fc86fab6675642b0cb81b.zip 3.8MB
-
install_q2.0.18.exe.exe 25.4MB
install_q2.0.18.exe
- IMPHASH cf1d9a74e1b968361bc9958407575708
- SHA256 d0d580e73af5913a8100fb5d79e2c919aafd4e4403ac5309b835b4e1e149c0ba
- MD5 be08c84858b0880ebb5441fceb5ce680
- SHA1 60df39a209c27dfa33c2c77865943cabe4cd46e8
- SHA512 7e44daac982f966e94dd97979e3974ce319f55b825cbb4f1e35817fa8bd05065d2272ed0f435beab555c56c45dc640696152a4bd9163bf85ef86070bcb1e6aaf
- SSDEEP 49152:YKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46k:djAIMaQi7kmeHh2yeH7rkfvVsX+N0
- TLSH T14047E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72412
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
LocalFree
GetCurrentProcess
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
MoveFileW
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
GetModuleFileNameW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
GetSystemDirectoryW
GetTickCount
GetLastError
GetFullPathNameW
FreeEnvironmentStringsW
GetFileAttributesW
RtlUnwindEx
OutputDebugStringW
OutputDebugStringA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateDirectoryW
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
ProcessIdToSessionId
Process32NextW
LoadLibraryA
DeleteFileW
Process32FirstW
GetLocalTime
SystemTimeToFileTime
VirtualAlloc
RtlUnwind
user32
CharNextW
LoadStringW
wsprintfW
advapi32
AdjustTokenPrivileges
GetTokenInformation
RegCloseKey
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
InitiateSystemShutdownExW
RegQueryValueExW
LookupPrivilegeValueW
DuplicateTokenEx
OpenProcessToken
OpenServiceW
ole32
CLSIDFromString
setupapi
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW
crypt32
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptQueryObject
shlwapi
PathFileExistsW
PathAppendW
shell32
SHGetKnownFolderPath
SHGetFolderPathW
Name
.text
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24.8MB
Virtual Size
24.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25711,
count=5, id=259, version=25711,
count=142, id=261, version=25711,
count=2, id=265, version=27048,
count=43, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=1, id=262, version=25711,
count=17, id=257, version=25711,
count=178, id=1, productName=Unmarked objects,
count=4, id=261, version=27048,
count=1, id=255, version=27048,
count=1, id=151,
count=1, id=258, version=27048,