f6b0b3f3cf3aee09d084a81dd02bb666158104ac9a11d3c88537ce6c50a2728f
- SHA256 f6b0b3f3cf3aee09d084a81dd02bb666158104ac9a11d3c88537ce6c50a2728f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_q2.0.08.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_q2.0.08.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target f6b0b3f3cf3aee09d084a81dd02bb666158104ac9a11d3c88537ce6c50a2728f
- Size 3.8MB
- Sample260905-k7tejada22
- SHA256 f6b0b3f3cf3aee09d084a81dd02bb666158104ac9a11d3c88537ce6c50a2728f
- MD5 5a6cb6099cabc6f911535317ce69800f
- SHA1 224377a15322407384ba6887f750b6013cb6b77a
- SHA512 ffddbf7849a2704b5ecc8809a887c982aa856b245ee4da85d2798909ba95f631670e166ecba3b24119b5ea81f8f10bdf1db5a798587e770afdf992bda7bf1889
- SSDEEP 98304:vnLCfyNn2kaRnqMRlgnd2ngrANK38pvxjxi0pN94u:vOC2tn1sJri7ppNau
- TLSH T1E306330BD07CAF3BD096E3B9EA3525079A247D36F7E9B7F9D08B46F60E5085290852C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install_q2.0.08.exe
File Explorer
-
f6b0b3f3cf3aee09d084a81dd02bb666158104ac9a11d3c88537ce6c50a2728f.zip 3.8MB
-
install_q2.0.08.exe.exe 25.4MB
install_q2.0.08.exe
- IMPHASH cf1d9a74e1b968361bc9958407575708
- SHA256 838ff6caca6dfbf81fc3bb9c2c4d605ce2ccf4fdf9ac7bd97baa170d0216572a
- MD5 2809c4e684969319f787940760d7049d
- SHA1 8f79edbf75a540299e882a89affd69874fa05954
- SHA512 2d6fbe0703ccf5ec4b6c283ff7d4111d977bb0e9b56dfc476ae74584095e40fdf25e5c85a0134d03a2d4e4ce749f81465e9eefe44e2d2a144a90c455e58a1ed6
- SSDEEP 49152:lKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46G:8jAIMaQi7kmeHh2yeH7rkfvVsX+NW
- TLSH T1DA47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72412
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
LocalFree
GetCurrentProcess
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
MoveFileW
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
GetModuleFileNameW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
GetSystemDirectoryW
GetTickCount
GetLastError
GetFullPathNameW
FreeEnvironmentStringsW
GetFileAttributesW
RtlUnwindEx
OutputDebugStringW
OutputDebugStringA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateDirectoryW
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
ProcessIdToSessionId
Process32NextW
LoadLibraryA
DeleteFileW
Process32FirstW
GetLocalTime
SystemTimeToFileTime
VirtualAlloc
RtlUnwind
user32
CharNextW
LoadStringW
wsprintfW
advapi32
AdjustTokenPrivileges
GetTokenInformation
RegCloseKey
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
InitiateSystemShutdownExW
RegQueryValueExW
LookupPrivilegeValueW
DuplicateTokenEx
OpenProcessToken
OpenServiceW
ole32
CLSIDFromString
setupapi
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW
crypt32
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptQueryObject
shlwapi
PathFileExistsW
PathAppendW
shell32
SHGetKnownFolderPath
SHGetFolderPathW
Name
.text
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24.8MB
Virtual Size
24.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25711,
count=5, id=259, version=25711,
count=142, id=261, version=25711,
count=2, id=265, version=27048,
count=43, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=1, id=262, version=25711,
count=17, id=257, version=25711,
count=178, id=1, productName=Unmarked objects,
count=4, id=261, version=27048,
count=1, id=255, version=27048,
count=1, id=151,
count=1, id=258, version=27048,