7b18cf2e2b61290e71d751b5f414ead68c0fa31926727c3383ef3d0aacd9bcfd
- SHA256 7b18cf2e2b61290e71d751b5f414ead68c0fa31926727c3383ef3d0aacd9bcfd
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_q2.0.04.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_q2.0.04.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 7b18cf2e2b61290e71d751b5f414ead68c0fa31926727c3383ef3d0aacd9bcfd
- Size 3.8MB
- Sample260905-ehrazswend
- SHA256 7b18cf2e2b61290e71d751b5f414ead68c0fa31926727c3383ef3d0aacd9bcfd
- MD5 02a097d0e15d8057ac1a4d521aaa6303
- SHA1 3878595311aef5e162bbb8e766a802b987eb6dc4
- SHA512 9b414b7798a4019c58b14038d11921001a046615ee1a7c5a6c052d98c7baf49750065d6ec54b198518789899c107faccf0345b5ff15d558c2a766042637fcc38
- SSDEEP 98304:NjBO55kUqVxA7Mm167UKpRde0AdKn5UothsfEOFmCoBT:lw5SUJ7rKpDbZ5XhLO4T
- TLSH T19E063347DCFDE82AD38EEA7AE9B545C7C11DA173C7FC86B4D82306F94E91812202B456
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_q2.0.04.exe
File Explorer
-
7b18cf2e2b61290e71d751b5f414ead68c0fa31926727c3383ef3d0aacd9bcfd.zip 3.8MB
-
install_q2.0.04.exe.exe 25.4MB
install_q2.0.04.exe
- IMPHASH cf1d9a74e1b968361bc9958407575708
- SHA256 61658feca934efbcaed7d685d73f2d047ddce19f0b5cbd81be0f5fa6bdda9e32
- MD5 2bf507c216735d5400d8a30531bf1b0f
- SHA1 0bd60d70b9e9a980493ea93887917260a5833986
- SHA512 a38c6fbb2ab63faab9beaa76fb9be6f992b0c447950bcda58330324bb36bca10a0e8ec7eea327ce103823c32ca072f0ae415c870c0ecb0bc1e2010ac86580c8c
- SSDEEP 49152:sKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B461:pjAIMaQi7kmeHh2yeH7rkfvVsX+NF
- TLSH T1CA47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72412
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
LocalFree
GetCurrentProcess
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
MoveFileW
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
GetModuleFileNameW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
GetSystemDirectoryW
GetTickCount
GetLastError
GetFullPathNameW
FreeEnvironmentStringsW
GetFileAttributesW
RtlUnwindEx
OutputDebugStringW
OutputDebugStringA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateDirectoryW
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
ProcessIdToSessionId
Process32NextW
LoadLibraryA
DeleteFileW
Process32FirstW
GetLocalTime
SystemTimeToFileTime
VirtualAlloc
RtlUnwind
user32
CharNextW
LoadStringW
wsprintfW
advapi32
AdjustTokenPrivileges
GetTokenInformation
RegCloseKey
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
InitiateSystemShutdownExW
RegQueryValueExW
LookupPrivilegeValueW
DuplicateTokenEx
OpenProcessToken
OpenServiceW
ole32
CLSIDFromString
setupapi
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW
crypt32
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptQueryObject
shlwapi
PathFileExistsW
PathAppendW
shell32
SHGetKnownFolderPath
SHGetFolderPathW
Name
.text
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24.8MB
Virtual Size
24.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25711,
count=5, id=259, version=25711,
count=142, id=261, version=25711,
count=2, id=265, version=27048,
count=43, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=1, id=262, version=25711,
count=17, id=257, version=25711,
count=178, id=1, productName=Unmarked objects,
count=4, id=261, version=27048,
count=1, id=255, version=27048,
count=1, id=151,
count=1, id=258, version=27048,