qnbd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
qnbd.exe
Size 4.2MB
Sample261002-msbbhsxemd
SHA256 cb093eecf19f1770ade4a191cfe95c42b39048cd68425a79a601e95a9935e888
MD5 137c1f9c0039e6dea8a5b3e3a9b1ed18
SHA1 22c1113d426941cfb3a6101e15d35aaeb6a489a6
SHA512 e9553e22a62c87eb77fcf2b7213bb47e17cda6876bcdf3b9b13f998c8ba5c538cd15259c5709cc4105baf393b511d90d66fcd0f49289b5446f10679f52b4ec2d
SSDEEP 49152:xfQFK2g+X3Q9ENhHKbGMMbcMyM2nngv0tQDxtImhy0AX8y5R9XoOy74BdKp9OMRW:OFK9NOAmX5hy1My5nXxc4qp/Rkl
TLSH
T1AB16F15A62A120ACC277C078CA8B5517EB7D741A07300AFB23E5C5992FB37F1657F21A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
qnbd.exe

File Explorer

qnbd.exe

.exe 4.2MB

qnbd.exe

IMPHASH b324a76cf635cf0b7d74854e3fc670ba
SHA256 cb093eecf19f1770ade4a191cfe95c42b39048cd68425a79a601e95a9935e888
MD5 137c1f9c0039e6dea8a5b3e3a9b1ed18
SHA1 22c1113d426941cfb3a6101e15d35aaeb6a489a6
SHA512 e9553e22a62c87eb77fcf2b7213bb47e17cda6876bcdf3b9b13f998c8ba5c538cd15259c5709cc4105baf393b511d90d66fcd0f49289b5446f10679f52b4ec2d
SSDEEP 49152:xfQFK2g+X3Q9ENhHKbGMMbcMyM2nngv0tQDxtImhy0AX8y5R9XoOy74BdKp9OMRW:OFK9NOAmX5hy1My5nXxc4qp/Rkl
TLSH
T1AB16F15A62A120ACC277C078CA8B5517EB7D741A07300AFB23E5C5992FB37F1657F21A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1466044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

WSAEventSelect WSAEnumNetworkEvents WSACreateEvent htonl listen WSAResetEvent freeaddrinfo sendto ioctlsocket send gethostname getaddrinfo WSACloseEvent recvfrom WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername accept select __WSAFDIsSet WSACleanup WSAStartup WSAIoctl WSASetLastError getsockname socket setsockopt getsockopt htons ntohs

crypt32

CertGetCertificateChain CryptBinaryToStringA CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateChain CryptStringToBinaryA CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertFreeCertificateContext CertFindCertificateInStore

wldap32

ord301 ord200 ord30 ord79 ord143 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord217 ord46 ord211 ord45 ord60

normaliz

IdnToAscii

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW GetModuleHandleW CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileSizeEx CreateFileA VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA Sleep GetTickCount GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FormatMessageW SetLastError IsDebuggerPresent AllocConsole VirtualFreeEx QueryFullProcessImageNameW GetConsoleWindow GetCurrentProcessId MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GetModuleFileNameA SetConsoleCtrlHandler Process32First WriteProcessMemory SetConsoleTitleA GetStdHandle SetConsoleMode SetCurrentConsoleFontEx Module32Next CreateMutexA GetVolumeInformationA Module32First OpenProcess RtlVirtualUnwind GetConsoleMode GetLastError AttachConsole Process32Next CloseHandle FreeConsole CreateThread VirtualAllocEx ExitProcess ReadProcessMemory CreateToolhelp32Snapshot

user32

GetWindowRect IsWindowVisible CallNextHookEx GetAsyncKeyState GetCursorInfo SetWindowsHookExA GetWindowTextA GetWindowLongA SetWindowDisplayAffinity EnumWindows TranslateMessage PeekMessageA GetKeyNameTextW PostQuitMessage GetDesktopWindow GetWindowTextLengthA FindWindowA UpdateWindow SendInput GetWindowLongW AdjustWindowRectEx DispatchMessageA GetKeyState LoadCursorA DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors ScreenToClient MapVirtualKeyW WindowFromPoint ShowWindow GetCapture SetWindowLongA ClientToScreen IsChild TrackMouseEvent GetMonitorInfoA GetForegroundWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus BringWindowToTop SetCapture SetCursor SetWindowLongW GetClientRect UnregisterClassA SetProcessDPIAware IsWindowUnicode RegisterClassExA ReleaseCapture SetForegroundWindow IsIconic SetCursorPos ReleaseDC GetCursorPos OpenClipboard GetMessageA EmptyClipboard GetClipboardData SetClipboardData SetWindowTextW CloseClipboard

gdi32

GetDeviceCaps

msvcp140

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Xtime_get_ticks _Thrd_sleep _Cnd_do_broadcast_at_thread_exit ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Throw_C_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_counter ?_Incref@facet@locale@std@@UEAAXXZ _Thrd_detach ??Bid@locale@std@@QEAA_KXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_destroy __std_exception_copy __std_terminate _CxxThrowException __C_specific_handler __current_exception_context __current_exception memchr memcmp strrchr strchr memset memcpy strstr

api-ms-win-crt-stdio-l1-1-0

fputs fwrite _get_stream_buffer_pointers __p__commode _wfopen freopen_s _read _write _close fread _set_fmode _fseeki64 __stdio_common_vsscanf __stdio_common_vsprintf fsetpos __stdio_common_vfprintf fputc fseek _lseeki64 feof ftell ungetc fclose setvbuf fgetpos fgets fflush _open fgetc fopen __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _errno terminate system _getpid __sys_errlist _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __sys_nerr _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _c_exit

api-ms-win-crt-heap-l1-1-0

_callnewh free realloc _set_new_mode calloc malloc

api-ms-win-crt-string-l1-1-0

strcspn toupper strcmp isspace strncpy strncmp strspn strpbrk _strdup isupper tolower

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-convert-l1-1-0

wcstombs atoi atof strtol strtod strtoull strtoll strtoul

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 _gmtime64 strftime _localtime64

api-ms-win-crt-math-l1-1-0

fmodf sinf sqrtf cosf log ldexp roundf powf _dsign __setusermatherr acosf pow logf atan2f _dclass ceilf

api-ms-win-crt-filesystem-l1-1-0

_unlink _fstat64 _access _stat64 _unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-environment-l1-1-0

getenv

advapi32

CryptHashData CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptImportKey CryptDestroyHash CryptDestroyKey CryptEncrypt