1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57

Sharing

Copy URL Twitter E-mail

General

Target
1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57
Size 1.5MB
Sample260930-h7a7vavthv
SHA256 1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57
MD5 fa3d5d4824be530f224ff32a4ef57d81
SHA1 ce60662e4b2b44bd2bc289b0a8138b7a8a25515c
SHA512 7d96bb22653e3bc9161871f6e9e8bae151ee8396c8767cd5b2d0acf5816159f5790a9a8d64849615a90efc25296a41b0f799b290e4c4b9354018cfe90d8a703a
SSDEEP 24576:hy8GsV0TBt3byAUHWreGf+jY+JqRp5fl9NJ:88GsV0ltLyvH88YzRp5/NJ
TLSH
T1AC75E00172D9AEA1D1DA5630F9A7E3614CBAEF630E75A61722163FCE7C6C3C31819316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57

File Explorer

1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57

.exe 1.5MB

1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57

IMPHASH d31de66c69ad4b3287572508eaa77662
SHA256 1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57
MD5 fa3d5d4824be530f224ff32a4ef57d81
SHA1 ce60662e4b2b44bd2bc289b0a8138b7a8a25515c
SHA512 7d96bb22653e3bc9161871f6e9e8bae151ee8396c8767cd5b2d0acf5816159f5790a9a8d64849615a90efc25296a41b0f799b290e4c4b9354018cfe90d8a703a
SSDEEP 24576:hy8GsV0TBt3byAUHWreGf+jY+JqRp5fl9NJ:88GsV0ltLyvH88YzRp5/NJ
TLSH
T1AC75E00172D9AEA1D1DA5630F9A7E3614CBAEF630E75A61722163FCE7C6C3C31819316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\QQMusicPC\pdbRelease\QQMusicSvr.pdb

shlwapi

PathFileExistsW

ws2_32

closesocket htons htonl WSAStartup

qqmusiccommon

?Read@CFile@QM@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Open@CFile@QM@@QAE_NPB_W_N1@Z ??1CFile@QM@@QAE@XZ ??0CFile@QM@@QAE@XZ ?GetTempFolder@QM@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ ?GetSharedInstance_ConfigInfo@qqmusic@@YAPAVIConfigInfo@@XZ ??1CQMPEvent@@QAE@XZ ??0CQMPEvent@@QAE@HHPB_W@Z ??1CQMPThreadSink@@UAE@XZ ??0CQMPThreadSink@@QAE@XZ ?StopThread@CQMPThreadSink@@UAEXAAV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@K@Z ?TermThread@CQMPThreadSink@@QAEXXZ ??1?$CQMPAutoLock@VCQMPCritSec@@@@QAE@XZ ??0?$CQMPAutoLock@VCQMPCritSec@@@@QAE@PAVCQMPCritSec@@@Z ?newStreamWriter@StreamWriterBuilder@Json@@UBEPAVStreamWriter@2@XZ ?newCharReader@CharReaderBuilder@Json@@UBEPAVCharReader@2@XZ ?QueryEventByTime@CQMPThreadSink@@QAEPAXV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@PAXK_N@Z ?write@StyledWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?write@FastWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ??1CQMPCritSec@@QAE@XZ ??0CQMPCritSec@@QAE@XZ ?t2ui64@QM@@YA_KV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?WriteLog@qqmusic@@YAXHKPB_WZZ ??0StyledStreamWriter@Json@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??1Writer@Json@@UAE@XZ ??1StreamWriterBuilder@Json@@UAE@XZ ??1StreamWriter@Json@@UAE@XZ ??1Factory@StreamWriter@Json@@UAE@XZ ??1CharReaderBuilder@Json@@UAE@XZ ??4Value@Json@@QAEAAV01@ABV01@@Z ?GetICQMApiSvr@@YAJPAPAUICQMApiSvr@@@Z ?IsThreadRunning@CQMPThreadSink@@QAE_NV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@@Z ?a2t@QM@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?GetQmpThread@CQMPThreadPool@@QAE?AV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@PAVCQMPThreadSink@@H@Z ?Instance@CQMPThreadPool@@SAAAV1@XZ ?BeginThread@CQMPThreadSink@@QAE_NV?$CQMPSharePtr@VCQMPThread@@$0A@$00@@@Z ??0CQMPThreadBase@@QAE@XZ ??1CQMPThreadBase@@UAE@XZ ?IsThreadRunning@CQMPThreadBase@@QAE_NXZ ??1Exception@Json@@UAE@XZ ?StopThread@CQMPThreadBase@@QAEXK@Z ?Stop@CQMPThreadPool@@QAEXI@Z ?BeginThread@CQMPThreadBase@@QAE_NXZ ?QueryEvent@CQMPThreadBase@@QAEPAXPAX_N@Z ?what@Exception@Json@@UBEPBDXZ ??0Value@Json@@QAE@W4ValueType@1@@Z ?isEqual@ValueIteratorBase@Json@@IBE_NABV12@@Z ??0Value@Json@@QAE@ABV01@@Z ??0ValueIterator@Json@@QAE@ABV01@@Z ?deref@ValueIteratorBase@Json@@IBEAAVValue@2@XZ ?increment@ValueIteratorBase@Json@@IAEXXZ ?decrement@ValueIteratorBase@Json@@IAEXXZ ?computeDistance@ValueIteratorBase@Json@@IBEHABV12@@Z

kernel32

FlushInstructionCache IsProcessorFeaturePresent InterlockedPushEntrySList VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter ResetEvent WaitForSingleObjectEx GetStartupInfoW QueryPerformanceCounter GetCurrentProcess IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList CreateThread CreateEventW WaitForSingleObject GetCommandLineW GetLongPathNameW SetUnhandledExceptionFilter TerminateProcess GetCurrentProcessId DecodePointer WideCharToMultiByte lstrlenA lstrcmpiA LoadLibraryExW lstrcmpiW FreeLibrary MultiByteToWideChar SetLastError GetCurrentThreadId OpenProcess LeaveCriticalSection EnterCriticalSection InterlockedIncrement CreateFileMappingA OpenFileMappingA MapViewOfFile InterlockedDecrement DeleteCriticalSection CreateProcessW InitializeCriticalSectionAndSpinCount RaiseException Sleep GetModuleHandleW GetProcAddress CreateEventA GetLastError SetEvent GetTickCount UnmapViewOfFile FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap GetPrivateProfileStringW GetTempPathW GetTempFileNameW lstrlenW DeleteFileW CreateFileW GetFileSize SetFilePointer ReadFile CloseHandle WriteFile GetModuleFileNameW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetSystemTimeAsFileTime

user32

CharUpperW PostThreadMessageW CharNextW CreateWindowExW LoadCursorW GetMessageW SendMessageW FindWindowW UnregisterClassW SendMessageTimeoutW DispatchMessageW TranslateMessage GetWindowLongW PostQuitMessage PeekMessageW MsgWaitForMultipleObjects PostMessageW KillTimer SetTimer GetClassInfoExW RegisterClassExW GetWindowThreadProcessId DestroyWindow GetDesktopWindow CallWindowProcW DefWindowProcW SetWindowLongW

advapi32

RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

ole32

CoReleaseServerProcess CoAddRefServerProcess CoTaskMemAlloc CoUninitialize CoTaskMemRealloc CoInitialize StringFromGUID2 CoCreateInstance CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoTaskMemFree

oleaut32

SysStringLen VarUI4FromStr LoadTypeLi UnRegisterTypeLi RegisterTypeLi VariantInit SysFreeString VariantCopy VariantClear LoadRegTypeLi SysAllocString

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

wininet

InternetCrackUrlA

vcruntime140

_except_handler4_common _CxxThrowException wcsrchr wcsstr memcmp _purecall __std_exception_destroy __CxxFrameHandler3 __std_terminate memset memcpy memmove __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _errno _c_exit _resetstkoflw _exit exit _invalid_parameter_noinfo _controlfp_s _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e

api-ms-win-crt-convert-l1-1-0

_ui64toa_s

api-ms-win-crt-string-l1-1-0

wcsnlen wcsncpy_s _wcslwr_s wcslen wcscmp _wcsicmp strlen wcscpy_s wmemcpy_s wcscat_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s _set_fmode __stdio_common_vswprintf __stdio_common_vsprintf __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc _recalloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

??0?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@ABV0@@Z ??0?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??0CDownloadPure@QMNetwork@@QAE@ABV01@@Z ??0CDownloadPure@QMNetwork@@QAE@PAVITaskCallback@1@@Z ??0CharReader@Json@@QAE@ABV01@@Z ??0CharReader@Json@@QAE@XZ ??0CharReaderBuilder@Json@@QAE@ABV01@@Z ??0Exception@Json@@QAE@ABV01@@Z ??0Factory@CharReader@Json@@QAE@ABV012@@Z ??0Factory@CharReader@Json@@QAE@XZ ??0Factory@StreamWriter@Json@@QAE@ABV012@@Z ??0Factory@StreamWriter@Json@@QAE@XZ ??0FastWriter@Json@@QAE@ABV01@@Z ??0ILoginHost@@QAE@ABV0@@Z ??0ILoginHost@@QAE@XZ ??0ILyricHost@@QAE@$$QAV0@@Z ??0ILyricHost@@QAE@ABV0@@Z ??0ILyricHost@@QAE@XZ ??0ILyricRenderFactory@@QAE@$$QAV0@@Z ??0ILyricRenderFactory@@QAE@ABV0@@Z ??0ILyricRenderFactory@@QAE@XZ ??0ITaskCallback@QMNetwork@@QAE@$$QAV01@@Z ??0ITaskCallback@QMNetwork@@QAE@ABV01@@Z ??0ITaskCallback@QMNetwork@@QAE@XZ ??0LogicError@Json@@QAE@$$QAV01@@Z ??0LogicError@Json@@QAE@ABV01@@Z ??0Path@Json@@QAE@$$QAV01@@Z ??0Path@Json@@QAE@ABV01@@Z ??0PathArgument@Json@@QAE@$$QAV01@@Z ??0PathArgument@Json@@QAE@ABV01@@Z ??0Reader@Json@@QAE@$$QAV01@@Z ??0Reader@Json@@QAE@ABV01@@Z ??0RuntimeError@Json@@QAE@$$QAV01@@Z ??0RuntimeError@Json@@QAE@ABV01@@Z ??0StaticString@Json@@QAE@PBD@Z ??0StreamWriter@Json@@QAE@ABV01@@Z ??0StreamWriterBuilder@Json@@QAE@ABV01@@Z ??0StyledStreamWriter@Json@@QAE@ABV01@@Z ??0StyledWriter@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@XZ ??0XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@J@Z ??0XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@ABV01@@Z ??0XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??1?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??1CDownloadPure@QMNetwork@@UAE@XZ ??1CharReader@Json@@UAE@XZ ??1Factory@CharReader@Json@@UAE@XZ ??1FastWriter@Json@@UAE@XZ ??1ILoginHost@@UAE@XZ ??1LogicError@Json@@UAE@XZ ??1Path@Json@@QAE@XZ ??1PathArgument@Json@@QAE@XZ ??1Reader@Json@@QAE@XZ ??1RuntimeError@Json@@UAE@XZ ??1StyledStreamWriter@Json@@QAE@XZ ??1StyledWriter@Json@@UAE@XZ ??1XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAE@XZ ??4?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXABV0@@Z ??4?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXPAVCQMPThread@@@Z ??4?$Int2Tp@$00@@QAEAAU0@$$QAU0@@Z ??4?$Int2Tp@$00@@QAEAAU0@ABU0@@Z ??4?$Int2Tp@$0A@@@QAEAAU0@$$QAU0@@Z ??4?$Int2Tp@$0A@@@QAEAAU0@ABU0@@Z ??4CDownloadPure@QMNetwork@@QAEAAV01@ABV01@@Z ??4CharReader@Json@@QAEAAV01@ABV01@@Z ??4CharReaderBuilder@Json@@QAEAAV01@ABV01@@Z ??4Exception@Json@@QAEAAV01@ABV01@@Z ??4Factory@CharReader@Json@@QAEAAV012@ABV012@@Z ??4Factory@StreamWriter@Json@@QAEAAV012@ABV012@@Z ??4FastWriter@Json@@QAEAAV01@ABV01@@Z ??4Features@Json@@QAEAAV01@$$QAV01@@Z ??4Features@Json@@QAEAAV01@ABV01@@Z ??4ILoginHost@@QAEAAV0@ABV0@@Z ??4ILyricHost@@QAEAAV0@$$QAV0@@Z ??4ILyricHost@@QAEAAV0@ABV0@@Z ??4ILyricRenderFactory2@@QAEAAV0@$$QAV0@@Z ??4ILyricRenderFactory2@@QAEAAV0@ABV0@@Z ??4ILyricRenderFactory@@QAEAAV0@$$QAV0@@Z ??4ILyricRenderFactory@@QAEAAV0@ABV0@@Z ??4ITaskCallback@QMNetwork@@QAEAAV01@$$QAV01@@Z ??4ITaskCallback@QMNetwork@@QAEAAV01@ABV01@@Z ??4LogicError@Json@@QAEAAV01@$$QAV01@@Z ??4LogicError@Json@@QAEAAV01@ABV01@@Z ??4Path@Json@@QAEAAV01@$$QAV01@@Z ??4Path@Json@@QAEAAV01@ABV01@@Z ??4PathArgument@Json@@QAEAAV01@$$QAV01@@Z ??4PathArgument@Json@@QAEAAV01@ABV01@@Z ??4Reader@Json@@QAEAAV01@$$QAV01@@Z ??4Reader@Json@@QAEAAV01@ABV01@@Z ??4RuntimeError@Json@@QAEAAV01@$$QAV01@@Z ??4RuntimeError@Json@@QAEAAV01@ABV01@@Z ??4StaticString@Json@@QAEAAV01@$$QAV01@@Z ??4StaticString@Json@@QAEAAV01@ABV01@@Z ??4StreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StreamWriterBuilder@Json@@QAEAAV01@ABV01@@Z ??4StyledStreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StyledWriter@Json@@QAEAAV01@ABV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@$$QAV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@ABV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@$$QAV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@ABV01@@Z ??4Writer@Json@@QAEAAV01@ABV01@@Z ??4XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEAAV01@ABV01@@Z ??4XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXABV01@@Z ??4XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXPAVCQMPThread@@@Z ??8ValueIteratorBase@Json@@QBE_NABV01@@Z ??9ValueIteratorBase@Json@@QBE_NABV01@@Z ??BStaticString@Json@@QBEPBDXZ ??C?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QBEPAVCQMPThread@@XZ ??CValueConstIterator@Json@@QBEPBVValue@1@XZ ??CValueIterator@Json@@QBEPAVValue@1@XZ ??DValueConstIterator@Json@@QBEABVValue@1@XZ ??DValueIterator@Json@@QBEAAVValue@1@XZ ??EValueConstIterator@Json@@QAE?AV01@H@Z ??EValueConstIterator@Json@@QAEAAV01@XZ ??EValueIterator@Json@@QAE?AV01@H@Z ??EValueIterator@Json@@QAEAAV01@XZ ??FValueConstIterator@Json@@QAE?AV01@H@Z ??FValueConstIterator@Json@@QAEAAV01@XZ ??FValueIterator@Json@@QAE?AV01@H@Z ??FValueIterator@Json@@QAEAAV01@XZ ??GValueIteratorBase@Json@@QBEHABV01@@Z ??_7CDownloadPure@QMNetwork@@6B@ ??_7CharReader@Json@@6B@ ??_7CharReaderBuilder@Json@@6B@ ??_7Exception@Json@@6B@ ??_7Factory@CharReader@Json@@6B@ ??_7Factory@StreamWriter@Json@@6B@ ??_7FastWriter@Json@@6B@ ??_7ILoginHost@@6B@ ??_7ILyricHost@@6B@ ??_7ILyricRenderFactory@@6B@ ??_7ITaskCallback@QMNetwork@@6B@ ??_7LogicError@Json@@6B@ ??_7RuntimeError@Json@@6B@ ??_7StreamWriter@Json@@6B@ ??_7StreamWriterBuilder@Json@@6B@ ??_7StyledWriter@Json@@6B@ ??_7Writer@Json@@6B@ ??_FStyledStreamWriter@Json@@QAEXXZ ??_FValue@Json@@QAEXXZ ??_FXCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEXXZ ?AddRef@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEJXZ ?Dec@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@AAEJU?$Int2Tp@$00@@@Z ?Free@XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@AAEXU?$Int2Tp@$0A@@@@Z ?Inc@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@AAEJU?$Int2Tp@$00@@@Z ?IsValid@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QBE_NXZ ?OnTaskNotify2@ITaskCallback@QMNetwork@@UAEXPADH@Z ?Release@XCount@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEJXZ ?Release@XData@?$CQMPSharePtr@VCQMPThread@@$0A@$00@@QAEJ_N@Z ?c_str@StaticString@Json@@QBEPBDXZ

Sharing

General

Malware Config

Signatures

File Explorer

1432d8637504b664813685e960f94e3a05cdf7b4d00aa8312efcfcb5ac327e57

shlwapi

ws2_32

qqmusiccommon

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

wininet

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic