531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82

Sharing

Copy URL Twitter E-mail

General

Target
531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82
Size 2.1MB
Sample261027-g98epa11av
SHA256 531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82
MD5 3ac94a8e3706052ee08b7bc3f6bf2921
SHA1 adc00236a6d46924d3cf36ac6b3ee96a59d5678b
SHA512 17eafd75837e0689cfcfee3e62f469f514ac7ec45fc50c40175fb0920ff5a1fa4a36ec2d00ef9b090fc7affc4673d24055ce4cc1570b1cde6306ab1cf27f9b12
SSDEEP 49152:SbUlgQ18NUXYeqcfquJ6hN2TgHk9orCHL/AetqM/7hPeVx:SHQ6NY/iuRbdF2
TLSH
T141A59E2072818039F5B306B29D79E96D455CFE3017655CDFE3C43B2E8A749D2AA31E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82

File Explorer

531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82

.exe 2.1MB

531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82

IMPHASH 6761b8105b49b5422ae95ba904ab91ca
SHA256 531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82
MD5 3ac94a8e3706052ee08b7bc3f6bf2921
SHA1 adc00236a6d46924d3cf36ac6b3ee96a59d5678b
SHA512 17eafd75837e0689cfcfee3e62f469f514ac7ec45fc50c40175fb0920ff5a1fa4a36ec2d00ef9b090fc7affc4673d24055ce4cc1570b1cde6306ab1cf27f9b12
SSDEEP 49152:SbUlgQ18NUXYeqcfquJ6hN2TgHk9orCHL/AetqM/7hPeVx:SHQ6NY/iuRbdF2
TLSH
T141A59E2072818039F5B306B29D79E96D455CFE3017655CDFE3C43B2E8A749D2AA31E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

758408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\git\qbextforwegame\pdb\Release_91\qbclient.pdb

libcef

cef_browser_host_create_browser cef_v8context_get_current_context cef_v8value_create_string cef_v8value_create_object cef_v8value_create_function cef_task_runner_get_for_thread cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_string_multimap_append cef_drag_data_create cef_string_multimap_alloc cef_string_multimap_free cef_get_extensions_for_mime_type cef_quit_message_loop cef_run_message_loop cef_shutdown cef_initialize cef_stream_reader_create_for_file cef_stream_writer_create_for_handler cef_execute_process cef_post_delayed_task cef_post_task cef_currently_on cef_api_hash cef_command_line_get_global cef_command_line_create cef_string_map_free cef_string_map_alloc cef_string_list_free cef_string_list_alloc cef_cookie_manager_get_global_manager cef_process_message_create cef_string_userfree_utf16_free cef_log cef_string_utf16_set cef_string_ascii_to_utf16 cef_string_wide_to_utf8 cef_string_utf16_cmp cef_string_utf16_to_utf8 cef_string_utf8_clear cef_string_utf8_to_utf16 cef_string_utf16_clear

opengl32

glVertex2f glTexSubImage2D glTexParameteri glTexImage2D glTexEnvf glRotatef wglCreateContext glViewport glPushAttrib glPopMatrix glPopAttrib glPixelStorei glOrtho glMatrixMode glLoadIdentity glLineWidth glInterleavedArrays glVertex2i glPushMatrix glHint glGenTextures glEnd glEnable glBegin glBindTexture glDrawArrays glBlendFunc glClear glDisable glDeleteTextures wglDeleteContext glColor4f glColor3f glClearColor wglMakeCurrent

gdiplus

GdiplusShutdown GdiplusStartup

kernel32

GetStdHandle GetModuleHandleExW ExitProcess RemoveDirectoryW GetFullPathNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW CreateDirectoryW GetFileAttributesExW DeleteFileW RtlUnwind CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore GetVersionExW LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount MultiByteToWideChar WideCharToMultiByte RtlCaptureContext GetProcAddress OpenProcess GetCurrentProcess GetCurrentProcessId SetUnhandledExceptionFilter GetCurrentThreadId IsDebuggerPresent WaitForMultipleObjects CloseHandle DuplicateHandle CreateEventW GetModuleFileNameW GetModuleHandleA GetModuleHandleW CreateProcessW SearchPathW LocalFree DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException GetLastError SetLastError DeleteCriticalSection MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW IsBadReadPtr LockResource FreeLibrary TerminateProcess CreateThread Sleep LoadResource SizeofResource LoadLibraryW LoadLibraryExA OutputDebugStringA OutputDebugStringW FindResourceW FindResourceExW GetLocalTime SetEvent WaitForSingleObject GetCommandLineW GetEnvironmentVariableW GetFileAttributesW lstrcpynW lstrcatW lstrlenW GlobalAlloc GlobalSize GlobalLock GlobalUnlock FindClose FindFirstFileW FindNextFileW SetEnvironmentVariableW GetWindowsDirectoryW GetFileAttributesA GetTickCount GetPrivateProfileIntW GetPrivateProfileStringW MulDiv SetErrorMode SetEnvironmentVariableA VirtualProtect VirtualFree InterlockedCompareExchange VirtualAlloc GetCurrentThread FlushInstructionCache VirtualQuery EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection ReadFile WriteFile SetFilePointer SetEndOfFile CreateFileW SetFileAttributesW FlushFileBuffers InitializeCriticalSection ResetEvent GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceCounter GetStringTypeW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteConsoleW GetACP GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetCurrentDirectoryW SetStdHandle GetModuleFileNameA

user32

ReleaseCapture GetSystemMetrics GetDC ReleaseDC BeginPaint EndPaint GetCapture SetPropW GetPropA SetCursor GetCursorPos SetCapture ScreenToClient WindowFromPoint UnionRect PtInRect SetClassLongW GetParent LoadCursorW LoadIconW GetAncestor GetMessagePos OffsetRect IsRectEmpty MessageBoxW DispatchMessageW TranslateMessage GetMessageW RegisterClipboardFormatW LoadCursorA GetClassNameW FindWindowExW ClientToScreen SendMessageW IsWindow GetWindowThreadProcessId RegisterWindowMessageW PostMessageA SetWindowPos IsZoomed SetPropA GetPropW GetClientRect GetWindowRect GetWindowLongW SetWindowLongW SetParent TrackMouseEvent GetMessageTime DefWindowProcW GetDoubleClickTime RegisterClassExW CreateWindowExW IsChild DestroyWindow IsWindowVisible SetFocus GetKeyState EqualRect

gdi32

GetDeviceCaps DeleteObject CreateRectRgn PtInRegion CombineRgn SwapBuffers SetRectRgn ChoosePixelFormat SetPixelFormat

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

DragQueryFileW DragFinish SHGetFolderPathW CommandLineToArgvW ShellExecuteW

ole32

OleUninitialize OleInitialize ReleaseStgMedium DoDragDrop RevokeDragDrop CoTaskMemAlloc RegisterDragDrop CoTaskMemFree

oleaut32

SysAllocString

shlwapi

StrCpyW StrStrIW PathAppendA PathRemoveFileSpecA PathAppendW PathRemoveFileSpecW PathFileExistsW

ws2_32

ntohl WSAStartup socket htons htonl closesocket WSACleanup bind

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA

Name

.text

Size

994KB

Virtual Size

994KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

310KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared_

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

803KB

Virtual Size

804KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

531266e714dca79342c43fde969703177eb8407b2cfd998dec5fc693f6ebca82

libcef

opengl32

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

version

generic