kadbuffer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
kadbuffer.exe
Size 335KB
Sample261027-znw4msgx2r
SHA256 5532d75aa60ce1780b9539639870bfa8e4f9c3f3285244bfad9c64b4842520ed
MD5 acaed99068cacdc61a7929c845e0298d
SHA1 8f436b758739a10cc8434972f97acd75ea4e8bff
SHA512 9be61a54adadf45bb90ed8f2800dea39c8eaebac3f04cf7b9d8f2af03b2e29b8e48dd4bd0128120b01c6ddc08551300eccb8e996e5c963564ba020057f47102a
SSDEEP 6144:CnupHkAPiAkGByTHRNS9JjkScbzoHS/id9999kF8Ec5OCXpWZGdl3TKSXlpC2aWv:CnupHkA3BybRNS9JjkScbzoHS6d9999D
TLSH
T1BE742AD177C94CCAEA01813D85D2D321753CB8E78722DB23722C77351F52A926ADA72E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kadbuffer.exe

File Explorer

kadbuffer.exe

.exe 335KB

kadbuffer.exe

IMPHASH c4768ae4e64660809f91f2029720750e
SHA256 5532d75aa60ce1780b9539639870bfa8e4f9c3f3285244bfad9c64b4842520ed
MD5 acaed99068cacdc61a7929c845e0298d
SHA1 8f436b758739a10cc8434972f97acd75ea4e8bff
SHA512 9be61a54adadf45bb90ed8f2800dea39c8eaebac3f04cf7b9d8f2af03b2e29b8e48dd4bd0128120b01c6ddc08551300eccb8e996e5c963564ba020057f47102a
SSDEEP 6144:CnupHkAPiAkGByTHRNS9JjkScbzoHS/id9999kF8Ec5OCXpWZGdl3TKSXlpC2aWv:CnupHkA3BybRNS9JjkScbzoHS6d9999D
TLSH
T1BE742AD177C94CCAEA01813D85D2D321753CB8E78722DB23722C77351F52A926ADA72E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qt5core

_Z20qResourceFeatureZlibv _Z21qRegisterResourceDataiPKhS0_S0_ _Z22qInstallMessageHandlerPFv9QtMsgTypeRK18QMessageLogContextRK7QStringE _Z23qUnregisterResourceDataiPKhS0_S0_ _Z5qHashRK7QStringj _Z7qstrcmpRK10QByteArrayPKc _Z9qCompressPKhii _ZN10QArrayData10deallocateEPS_yy _ZN10QArrayData11shared_nullE _ZN10QByteArrayC1EPKci _ZN10QByteArrayaSERKS_ _ZN11QDataStream12setByteOrderENS_9ByteOrderE _ZN11QDataStream12writeRawDataEPKci _ZN11QDataStreamC1EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE _ZN11QDataStreamD1Ev _ZN11QDataStreamlsEi _ZN11QDataStreamlsEs _ZN11QFileDevice5closeEv _ZN11QMetaObject10ConnectionD1Ev _ZN11QMetaObject14normalizedTypeEPKc _ZN11QMetaObject8activateEP7QObjectPKS_iPPv _ZN11QTextStreamlsERK7QString _ZN11QTextStreamlsEc _ZN11QTextStreamlsEi _ZN14QStandardPaths16writableLocationENS_16StandardLocationE _ZN16QCoreApplication18applicationDirPathEv _ZN16QCoreApplication18setApplicationNameERK7QString _ZN16QCoreApplication19setOrganizationNameERK7QString _ZN16QCoreApplication21setApplicationVersionERK7QString _ZN18QCryptographicHash4hashERK10QByteArrayNS_9AlgorithmE _ZN4QDir18toNativeSeparatorsERK7QString _ZN4QDir20fromNativeSeparatorsERK7QString _ZN4QDirC1ERK7QString _ZN4QDirD1Ev _ZN4QUrl13fromLocalFileERK7QString _ZN4QUrlC1ERK7QStringNS_11ParsingModeE _ZN4QUrlD1Ev _ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE _ZN5QFile6removeERK7QString _ZN5QFileC1ERK7QString _ZN5QFileD1Ev _ZN6QDebug9putStringEPK5QChary _ZN6QDebugD1Ev _ZN6QMutex4lockEv _ZN6QMutex6unlockEv _ZN6QMutexD1Ev _ZN6QTimer11setIntervalEi _ZN6QTimer16staticMetaObjectE _ZN6QTimer4stopEv _ZN6QTimer5startEv _ZN6QTimer7timeoutENS_14QPrivateSignalE _ZN6QTimerC1EP7QObject _ZN7QObject10childEventEP11QChildEvent _ZN7QObject10timerEventEP11QTimerEvent _ZN7QObject11connectImplEPKS_PPvS1_S3_PN9QtPrivate15QSlotObjectBaseEN2Qt14ConnectionTypeEPKiPK11QMetaObject _ZN7QObject11customEventEP6QEvent _ZN7QObject11deleteLaterEv _ZN7QObject11eventFilterEPS_P6QEvent _ZN7QObject11qt_metacallEN11QMetaObject4CallEiPPv _ZN7QObject11qt_metacastEPKc _ZN7QObject13connectNotifyERK11QMetaMethod _ZN7QObject16disconnectNotifyERK11QMetaMethod _ZN7QObject16staticMetaObjectE _ZN7QObject5eventEP6QEvent _ZN7QObjectC2EPS_ _ZN7QObjectD2Ev _ZN7QString11reallocDataEjb _ZN7QString13toUtf8_helperERKS_ _ZN7QString15fromUtf8_helperEPKci _ZN7QString16fromAscii_helperEPKci _ZN7QString17fromLatin1_helperEPKci _ZN7QString6appendERKS_ _ZN7QString9fromUtf16EPKti _ZN7QStringaSERKS_ _ZN8QVariantC1ERK7QString _ZN8QVariantC1Eb _ZN8QVariantC1Ei _ZN8QVariantD1Ev _ZN9QDateTime15currentDateTimeEv _ZN9QDateTimeD1Ev _ZN9QFileInfo6existsERK7QString _ZN9QFileInfoC1ERK7QString _ZN9QFileInfoD1Ev _ZN9QHashData11free_helperEPFvPNS_4NodeEE _ZN9QHashData11shared_nullE _ZN9QHashData12allocateNodeEi _ZN9QHashData13detach_helperEPFvPNS_4NodeEPvEPFvS1_Eii _ZN9QHashData6rehashEi _ZN9QHashData8freeNodeEPv _ZN9QIODevice5writeEPKcx _ZN9QIODevice7readAllEv _ZN9QListData11detach_growEPii _ZN9QListData11shared_nullE _ZN9QListData5eraseEPPv _ZN9QListData6appendEv _ZN9QListData6detachEi _ZN9QListData7disposeEPNS_4DataE _ZN9QListData7reallocEi _ZN9QMetaType22registerNormalizedTypeERK10QByteArrayPFvPvEPFS3_S3_PKvEi6QFlagsINS_8TypeFlagEEPK11QMetaObject _ZN9QMetaType25registerConverterFunctionEPKN9QtPrivate25AbstractConverterFunctionEii _ZN9QMetaType27unregisterConverterFunctionEii _ZN9QMetaType30hasRegisteredConverterFunctionEii _ZN9QSaveFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE _ZN9QSaveFile6commitEv _ZN9QSaveFileC1ERK7QString _ZN9QSaveFileD1Ev _ZN9QSettings8setValueERK7QStringRK8QVariant _ZN9QSettingsC1ENS_6FormatENS_5ScopeERK7QStringS4_P7QObject _ZN9QSettingsD1Ev _ZN9QtPrivate12argToQStringE11QStringViewyPPKNS_7ArgBaseE _ZN9QtPrivate16QStringList_joinEPK11QStringListPK5QChari _ZNK10QByteArray3midEii _ZNK10QByteArray5toHexEv _ZNK10QByteArray6isNullEv _ZNK11QMetaObject9classNameEv _ZNK11QObjectData17dynamicMetaObjectEv _ZNK12QMapNodeBase8nextNodeEv _ZNK14QMessageLogger4infoEv _ZNK14QMessageLogger7warningEv _ZNK4QDir13entryInfoListE6QFlagsINS_6FilterEES0_INS_8SortFlagEE _ZNK4QDir6mkpathERK7QString _ZNK4QUrl4hostE6QFlagsINS_25ComponentFormattingOptionEE _ZNK4QUrl6schemeEv _ZNK4QUrl7isValidEv _ZNK4QUrl8toStringE12QUrlTwoFlagsINS_19UrlFormattingOptionENS_25ComponentFormattingOptionEE _ZNK5QDate3dayEv _ZNK5QDate4yearEv _ZNK5QDate5monthEv _ZNK5QTime4hourEv _ZNK5QTime6minuteEv _ZNK5QTime6secondEv _ZNK7QString3argExii5QChar _ZNK7QString8endsWithERKS_N2Qt15CaseSensitivityE _ZNK8QVariant5toIntEPb _ZNK8QVariant8toStringEv _ZNK9QDateTime4dateEv _ZNK9QDateTime4timeEv _ZNK9QDateTime8toStringERK7QString _ZNK9QFileInfo12absolutePathEv _ZNK9QFileInfo16absoluteFilePathEv _ZNK9QFileInfo4sizeEv _ZNK9QFileInfo5isDirEv _ZNK9QFileInfo6isFileEv _ZNK9QFileInfo8fileNameEv _ZNK9QIODevice11errorStringEv _ZNK9QIODevice6isOpenEv _ZNK9QSettings5valueERK7QStringRK8QVariant _ZeqRK7QStringS1_

qt5gui

_ZN15QGuiApplication11focusWindowEv _ZN15QGuiApplication15topLevelWindowsEv _ZN15QGuiApplication4execEv _ZN15QGuiApplicationC1ERiPPci _ZN15QGuiApplicationD1Ev _ZN16QDesktopServices7openUrlERK4QUrl _ZNK7QWindow5winIdEv

qt5network

_ZN13QNetworkReply16staticMetaObjectE _ZN13QNetworkReply8finishedEv _ZN13QNetworkReply9sslErrorsERK5QListI9QSslErrorE _ZN15QNetworkRequest12setAttributeENS_9AttributeERK8QVariant _ZN15QNetworkRequest12setRawHeaderERK10QByteArrayS2_ _ZN15QNetworkRequest18setTransferTimeoutEi _ZN15QNetworkRequest9setHeaderENS_12KnownHeadersERK8QVariant _ZN15QNetworkRequestC1ERK4QUrl _ZN15QNetworkRequestD1Ev _ZN21QNetworkAccessManager3getERK15QNetworkRequest _ZN21QNetworkAccessManager4postERK15QNetworkRequestRK10QByteArray _ZN21QNetworkAccessManagerC1EP7QObject _ZN21QNetworkAccessManagerD1Ev _ZN9QSslError16staticMetaObjectE _ZN9QSslErrorC1ERKS_ _ZN9QSslErrorC1Ev _ZN9QSslErrorD1Ev _ZNK13QNetworkReply5errorEv _ZNK13QNetworkReply6headerEN15QNetworkRequest12KnownHeadersE _ZNK13QNetworkReply9attributeEN15QNetworkRequest9AttributeE _ZNK9QSslError11errorStringEv

qt5qml

_ZN11QQmlContext18setContextPropertyERK7QStringP7QObject _ZN11QQmlContext18setContextPropertyERK7QStringRK8QVariant _ZN21QQmlApplicationEngine11rootObjectsEv _ZN21QQmlApplicationEngine4loadERK4QUrl _ZN21QQmlApplicationEngineC1EP7QObject _ZN21QQmlApplicationEngineD1Ev _ZNK10QQmlEngine11rootContextEv

comdlg32

GetSaveFileNameW

libgcc_s_seh-1

_Unwind_Resume __emutls_get_address

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _initterm _lock _onexit _unlock abort calloc exit fflush fprintf fputc free fwrite localeconv malloc memcpy memmove signal strcmp strerror strlen strncmp vfprintf wcslen

libstdc++-6

_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE12_M_constructEyw _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6resizeEyw _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_appendEPKwy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_mutateEyyPKwy _ZSt9terminatev _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZdlPv _ZdlPvy _Znwy __cxa_begin_catch __cxa_end_catch __cxa_guard_acquire __cxa_guard_release __cxa_rethrow __gxx_personality_seh0

Name

.text

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

512B

Virtual Size

329B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

155B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

kadbuffer.exe

qt5core

qt5gui

qt5network

qt5qml

comdlg32

libgcc_s_seh-1

kernel32

msvcrt

libstdc++-6

generic