QGMTMSYC[.]DLL | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
QGMTMSYC.DLL
Size 475KB
Sample261022-13877avsfx
SHA256 c1dd673fb17769ca4669fd36f45bfca2ec25fac963771cce3c22117c0883ae06
MD5 882164a7cc18cfa56bd57d4ff9674299
SHA1 7dbff4f40e4d32743c3b8189e6ac649611cfff0e
SHA512 b092cb3dda2d9beac1daf13760af3db317a4eebf0848ebc611bb0cacb2dd6c23ce87ecefea778d0d0ccf22d15377fa74b7bec9c3d488941506729344827b8b3a
SSDEEP 6144:sfPAfwphtXZD+rp67souPJ2JhqU1ccH1qgzCm7fIdhQMtRkc36YN8eT7vPtjMtbm:4smY/cVMDb570UpuqUs
TLSH
T1B6A45C1077F80F16F6BF4F79A87815036932FC6FC91AD3AC4C5600AD18BAA558993B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

QGMTMSYC.DLL

.dll 475KB

QGMTMSYC.DLL

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c1dd673fb17769ca4669fd36f45bfca2ec25fac963771cce3c22117c0883ae06
MD5 882164a7cc18cfa56bd57d4ff9674299
SHA1 7dbff4f40e4d32743c3b8189e6ac649611cfff0e
SHA512 b092cb3dda2d9beac1daf13760af3db317a4eebf0848ebc611bb0cacb2dd6c23ce87ecefea778d0d0ccf22d15377fa74b7bec9c3d488941506729344827b8b3a
SSDEEP 6144:sfPAfwphtXZD+rp67souPJ2JhqU1ccH1qgzCm7fIdhQMtRkc36YN8eT7vPtjMtbm:4smY/cVMDb570UpuqUs
TLSH
T1B6A45C1077F80F16F6BF4F79A87815036932FC6FC91AD3AC4C5600AD18BAA558993B63
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

af:6e:7f:91:d1:68:85:96:b5:c0:1f:24:45:37:8e:35:f5:9b:71:56:e0:47:e1:9f:05:71:8e:44:6c:75:37:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

ae:4e:a4:ab:c6:82:64:f8:36:dc:42:24:d7:d9:95:01:2c:c1:37:ad

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:29:97:4e:7c:82:cb:20:16:41:00:00:00:00:00:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

Major OS version

Entry point

464798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

QGMTMSYC.DLL

PE Signature issue

mscoree

dotnet