qedit.zip
- SHA256 282398aa835586d1c38144e1e6708d51a711c15742a8c26862faad918c0fdcab
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
QEDITOR.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
QEDITOR.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
THEGUN.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
THEGUN.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target qedit.zip
- Size 59KB
- Sample260912-plcl4sbf73
- SHA256 282398aa835586d1c38144e1e6708d51a711c15742a8c26862faad918c0fdcab
- MD5 99ca64eb8d0aaf742c7fc7f26523697c
- SHA1 f92deee83a2115239744e931b0c8578633640185
- SHA512 930ba6f18db65ecd4e2c5ea5846b44d0a46c314f9082221b8102d6fa0700dbf40c1dfe4b5ac778e3811fdc8ef39cf9517c72d160a0585075558b4900294bafb6
- SSDEEP 1536:J+ItA0/8OFd707QvIRDFqVjQWBOPZZJY54pgVhshtaKZ:JdT/zb70svINIjQcORM4pgbsWKZ
- TLSH T175530254FB31D758F8B70BBD4F30059B78CC20EE2C53916625B49C6A904C3D69B92DAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/QEDITOR.EXE unpack001/THEGUN.EXE
File Explorer
-
qedit.zip.zip 59KB
-
INSTALL.TXT2KB
-
QEDITOR.EXE.exe 42KB
-
QEDITOR.HLP56KB
-
README.TXT3KB
-
THEGUN.EXE.exe 18KB
INSTALL.TXT
- SHA256 44df5c015a6eefaf460692e455ab16c8bdf31d9f303e3b5fd96fadaf59913ae7
- MD5 260e5093a393dcbe465e3f309e9e4d7e
- SHA1 20f1e50e54d49e125c552df5e677d48ce82ce3ac
- SHA512 c33600420718a68d828b822f96ff7fb57e9c21b5949428f646fc45305d4bcae727d97cb2ec4853655c3c77a58a4ee279bf4639907c9ff660e6cbb369ea8a18c7
- TLSH T1F25143AFA74903B305000793830E67D6F726C4DC35A951A1346D971E323296543BBAEE
- MD5 SHA1 SHA512 TLSH
QEDITOR.EXE
- IMPHASH 4d66a10d1f7cfeb4de2f6c94ab8b5a9b
- SHA256 3ccfd00fadc39af652d1d90020a91e92da76893063936c13b911421041a4e726
- MD5 2e223a946168d4b1deb57b4124d4c708
- SHA1 f643225aa5c967f094b3e4aa3c49efb75c2a0143
- SHA512 425151521d2a1bcf21ab407c438c01fba21f427cd8cb827cb5f8960214b1726f050bba8ea9f3242b494152253681312016b8435b2f88ee7bf3cb342ee6ee446b
- SSDEEP 768:KX9DQESfJ3Ae19d5xEzKp9TSRUr3yhMERjRh1BPU+z:YkECF19d5xa1mCFRjRtv
- TLSH T16E134D427BD4C559D07C523C4D619752A92BBC705A3A8A3BB6CC368F2B77640CC18BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
77824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegOpenKeyExA
RegCloseKey
kernel32
CloseHandle
CreateFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
GetCommandLineA
GetCurrentDirectoryA
GetEnvironmentStringsA
GetFileSize
GetFileType
GetLastError
GetModuleHandleA
GetStartupInfoA
GetSystemInfo
GetVersionExA
GlobalAlloc
GlobalFree
OutputDebugStringA
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetErrorMode
SetFilePointer
WriteFile
GetModuleFileNameA
GetTickCount
LoadLibraryA
WinExec
oleaut32
SysAllocStringByteLen
SysFreeString
SysStringByteLen
user32
DialogBoxIndirectParamA
EndDialog
GetDlgItem
GetWindowTextA
MessageBeep
MessageBoxA
SetFocus
AppendMenuA
BeginPaint
CallWindowProcA
CreateDialogParamA
CreateWindowExA
DefWindowProcA
DeleteMenu
DialogBoxParamA
DispatchMessageA
DrawMenuBar
EndPaint
GetClientRect
GetDC
GetMessageA
GetSubMenu
GetSystemMetrics
GetWindowRect
GetWindowTextLengthA
InvalidateRect
LoadBitmapA
LoadCursorA
LoadIconA
LoadMenuA
MoveWindow
PostMessageA
RegisterClassExA
SendMessageA
SetCursor
SetMenu
SetWindowLongA
SetWindowTextA
ShowWindow
TrackPopupMenu
TranslateMessage
UpdateWindow
ValidateRect
WinHelpA
PostQuitMessage
gdi32
DeleteObject
GetStockObject
MoveToEx
SetMapMode
shell32
DragQueryFileA
ShellAboutA
DragAcceptFiles
comdlg32
PrintDlgA
GetOpenFileNameA
GetSaveFileNameA
comctl32
InitCommonControls
CreateToolbarEx
CreateStatusWindowA
EDITPROC
FIND_PROC
OPTIONS_PROC
REPLACE_PROC
WNDPROC
Name
.text
Size
19KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.link
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.
Size
1024B
Virtual Size
705B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
QEDITOR.HLP
- SHA256 34f12df69309792fd0de1cb3402d66ad8737a45d38a1f2816265a9d4a1755263
- MD5 aeb00493da7f0352c444294aa89b6dba
- SHA1 dc6af4e4cb013cd5dbe2b7c5254eaeff8c323b02
- SHA512 56af11ba36ee63ba9f881ee81ecee0e1d46bf617991f363c60273309adc565757bee765e76bf5a26446b8c2d628c499e030e18eec1a5fe45d85d191967f46167
- SSDEEP 384:pZHXDYZUUT8qMoLl+dhvqXqKM7mDZzU2LX:jwUToihSXrjFr
- TLSH T12343DB597DAEB8EDC08400328E5BB7AC3574BD65BC00A917A7BA3E5FD4B9350D52930C
- MD5 SHA1 SHA512 SSDEEP TLSH
README.TXT
- SHA256 61f4f66eb766c1f429a99cc6a67ca578e703829822146d00150f177ed664f69a
- MD5 5c94a7f1e029db6613e3d1a1d12838fc
- SHA1 3791ac1993cfa09bc5fa4f8a43e085e57391fd86
- SHA512 c111c72ea9bc80f3ee83cb61c2c9117041ef5e6a217011a778485a1b79028af869c9835f8099573df5451c47b33d4a0af95024e46f839cac9494cd088ccf3962
- TLSH T13171546F9385237700260290C34EB5A5FB1994AE237A85A5386DC71D37729A807BE5EC
- MD5 SHA1 SHA512 TLSH
THEGUN.EXE
- IMPHASH 64b2cc27f0d537f879d7ae92477c0081
- SHA256 c22636dd71748be54aaf936abb36922760a6162a6101fe6b5dea87593e4a433c
- MD5 8a62e2385337e798c6f4a8e53c11b37a
- SHA1 1f677887ec9fac6ccb621dade8051514708b26e1
- SHA512 001f4f0f27e283bde629bbe55142a3901d382ffb6d3f3fc1070391eef721da561e98bc9b052874d5f47a1adaa027e92163ebb3b228bb6b5ba7d4242119c0c9c3
- SSDEEP 384:KGpMvVJfQTdFhs8k2A8ZKy9P9kOMPxevEXS8tekF:KGeIpkGKy9P96
- TLSH T158827B2261FCCCC2E1241B380E1767160C06FE950AB6D5A3B39D77AE7FBB5468D147A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegOpenKeyExA
RegCloseKey
kernel32
CloseHandle
CreateFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
GetCommandLineA
GetCurrentDirectoryA
GetEnvironmentStringsA
GetFileSize
GetFileType
GetLastError
GetModuleHandleA
GetStartupInfoA
GetSystemInfo
GetVersionExA
GlobalAlloc
GlobalFree
OutputDebugStringA
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetErrorMode
SetFilePointer
WriteFile
LoadLibraryA
oleaut32
SysAllocStringByteLen
SysFreeString
SysStringByteLen
user32
DialogBoxIndirectParamA
EndDialog
GetDlgItem
GetWindowTextA
MessageBeep
MessageBoxA
SetFocus
BeginPaint
CallWindowProcA
CreateDialogParamA
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
EndPaint
GetClientRect
GetDC
GetMessageA
GetSystemMetrics
GetWindowTextLengthA
InvalidateRect
LoadCursorA
LoadIconA
LoadMenuA
MoveWindow
RegisterClassExA
SendMessageA
SetMenu
SetWindowLongA
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow
PostQuitMessage
gdi32
GetStockObject
MoveToEx
SetMapMode
shell32
DragQueryFileA
ShellAboutA
DragAcceptFiles
comdlg32
PrintDlgA
GetOpenFileNameA
GetSaveFileNameA
EDITPROC
FIND_PROC
WNDPROC
Name
.text
Size
9KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.link
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rloc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.
Size
1024B
Virtual Size
705B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE