e6e2e5f60fe62aafc9b1d01d1cfc2287dfaa0d62a98882ce22aa380fb53a6044
- SHA256 e6e2e5f60fe62aafc9b1d01d1cfc2287dfaa0d62a98882ce22aa380fb53a6044
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_q2.0.03.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_q2.0.03.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target e6e2e5f60fe62aafc9b1d01d1cfc2287dfaa0d62a98882ce22aa380fb53a6044
- Size 3.8MB
- Sample260905-cbpsgadk3x
- SHA256 e6e2e5f60fe62aafc9b1d01d1cfc2287dfaa0d62a98882ce22aa380fb53a6044
- MD5 ee5269dd312618ebab7685736b7dcd3d
- SHA1 7c16931b8d4de441eb74f8702da5c4b6d70d2f0f
- SHA512 73a925d6a9da295cef27505b92f534b758a419dc4b972962067da08d8e1ddbc16f61fa444917a020a4ce5319391d30b0581ffcb7aaf77354ed0c5a73aaab0728
- SSDEEP 98304:DrzD02mvV9AfbkGBuMTSE7JqRXkfnq9A1xSN8P:7D0J3AfruMTSEMkfnp1xn
- TLSH T1160633239DBCB847F19A6176F5365637FB04B2328BDC6BB9F45A42FA4D8310881724D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_q2.0.03.exe
File Explorer
-
e6e2e5f60fe62aafc9b1d01d1cfc2287dfaa0d62a98882ce22aa380fb53a6044.zip 3.8MB
-
install_q2.0.03.exe.exe 25.4MB
install_q2.0.03.exe
- IMPHASH cf1d9a74e1b968361bc9958407575708
- SHA256 e13bb8f4cab1afb105779fb52a725730adfb932bd5084537a4325a698ae9b3c3
- MD5 3fff9316fa501788a0be83fbd396eb93
- SHA1 3988e130ec21cabda36c695313d88351f266a3e4
- SHA512 3ed7173a3080659fda19813b70a49b8018f4715520bc7ed495b397adfc86ad79e8a37ee1fcde0797f9dab86958301f8b11c1f8dceeeda633c2a89c43168a540c
- SSDEEP 49152:lKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B460:8jAIMaQi7kmeHh2yeH7rkfvVsX+Nk
- TLSH T11C47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72412
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
LocalFree
GetCurrentProcess
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
MoveFileW
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
GetModuleFileNameW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
GetSystemDirectoryW
GetTickCount
GetLastError
GetFullPathNameW
FreeEnvironmentStringsW
GetFileAttributesW
RtlUnwindEx
OutputDebugStringW
OutputDebugStringA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateDirectoryW
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
ProcessIdToSessionId
Process32NextW
LoadLibraryA
DeleteFileW
Process32FirstW
GetLocalTime
SystemTimeToFileTime
VirtualAlloc
RtlUnwind
user32
CharNextW
LoadStringW
wsprintfW
advapi32
AdjustTokenPrivileges
GetTokenInformation
RegCloseKey
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
InitiateSystemShutdownExW
RegQueryValueExW
LookupPrivilegeValueW
DuplicateTokenEx
OpenProcessToken
OpenServiceW
ole32
CLSIDFromString
setupapi
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW
crypt32
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptQueryObject
shlwapi
PathFileExistsW
PathAppendW
shell32
SHGetKnownFolderPath
SHGetFolderPathW
Name
.text
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24.8MB
Virtual Size
24.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25711,
count=5, id=259, version=25711,
count=142, id=261, version=25711,
count=2, id=265, version=27048,
count=43, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=1, id=262, version=25711,
count=17, id=257, version=25711,
count=178, id=1, productName=Unmarked objects,
count=4, id=261, version=27048,
count=1, id=255, version=27048,
count=1, id=151,
count=1, id=258, version=27048,