d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f

Sharing

Copy URL Twitter E-mail

General

Target
d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f
Size 924KB
Sample261102-hed32a1wcw
SHA256 d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f
MD5 bc780f1e73238af59fce28e0bdb174f6
SHA1 3f9d4a7209929dce4cc8196771f27b3fcdebed68
SHA512 526510644fe59a6b2224b3621feca32ea4818bbd4dc5effcc0f47a381659227606165054f984ea259bfffdc76a62fbfae35d1b3ff17b7194d286f1c5fdfd40b4
SSDEEP 24576:9JjsDqucrnREbQUq5ALDmI6GttzRVJBOZrPufU+9:9JoIrnREctALCINtb/Buup
TLSH
T17E15F15176996F50E7D40B34F427DB610D2AAF270A64A14FE26A3DFA3C3D3C30D6225A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f

File Explorer

d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f

.exe 924KB

d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f

IMPHASH 0373ffa73f9dfbb313962fc15dd601b4
SHA256 d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f
MD5 bc780f1e73238af59fce28e0bdb174f6
SHA1 3f9d4a7209929dce4cc8196771f27b3fcdebed68
SHA512 526510644fe59a6b2224b3621feca32ea4818bbd4dc5effcc0f47a381659227606165054f984ea259bfffdc76a62fbfae35d1b3ff17b7194d286f1c5fdfd40b4
SSDEEP 24576:9JjsDqucrnREbQUq5ALDmI6GttzRVJBOZrPufU+9:9JoIrnREctALCINtb/Buup
TLSH
T17E15F15176996F50E7D40B34F427DB610D2AAF270A64A14FE26A3DFA3C3D3C30D6225A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\QQMusicPC\pdbRelease\QQMusicService.pdb

qqmusiccommon

?isEqual@ValueIteratorBase@Json@@IBE_NABV12@@Z ?decrement@ValueIteratorBase@Json@@IAEXXZ ?increment@ValueIteratorBase@Json@@IAEXXZ ?deref@ValueIteratorBase@Json@@IBEAAVValue@2@XZ ??0ValueIterator@Json@@QAE@ABV01@@Z ??0Value@Json@@QAE@ABV01@@Z ??0Value@Json@@QAE@W4ValueType@1@@Z ?computeDistance@ValueIteratorBase@Json@@IBEHABV12@@Z ??4Value@Json@@QAEAAV01@ABV01@@Z ??1CharReaderBuilder@Json@@UAE@XZ ??1Factory@StreamWriter@Json@@UAE@XZ ?GetSequenceID@CSeqIDGenerator@@SAXQAE@Z ?IsWindows7OrLater@qqmusic@@YAHXZ ?ExportMemLog@qqmusic@@YAHAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?InitLog@qqmusic@@YAXJJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?newStreamWriter@StreamWriterBuilder@Json@@UBEPAVStreamWriter@2@XZ ?newCharReader@CharReaderBuilder@Json@@UBEPAVCharReader@2@XZ ?what@Exception@Json@@UBEPBDXZ ?write@StyledWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?write@FastWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?a2t@QM@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?WriteLog@qqmusic@@YAXHKPB_WZZ ?EncodeBase64@qqmusic@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PBEH@Z ?t2a@QM@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@H@Z ??0StyledStreamWriter@Json@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??1Writer@Json@@UAE@XZ ??1StreamWriterBuilder@Json@@UAE@XZ ??1StreamWriter@Json@@UAE@XZ ??1Exception@Json@@UAE@XZ

qmnetwork

??_7CHttpProtocolCallback@QMNetwork@@6B@ CreateHttpProtocol InitHttpProtocol

psapi

GetModuleInformation

kernel32

IsProcessorFeaturePresent VirtualAlloc VirtualFree FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW EnterCriticalSection GetProcAddress WritePrivateProfileStringW GetPrivateProfileStringW DeviceIoControl LoadLibraryA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW LoadLibraryExA SetProcessWorkingSetSize SetCurrentDirectoryA VirtualUnlock VirtualLock WaitForSingleObjectEx ReadFileEx ResetEvent CreateFileA RaiseException GetLastError DecodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LoadResource LockResource SizeofResource FindResourceW FindResourceExW CloseHandle SetEvent WaitForSingleObject GetModuleFileNameW GetCurrentThreadId CreateEventW Sleep GetTickCount CreateDirectoryW CopyFileW CreateMutexW GetLocalTime MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent LeaveCriticalSection LoadLibraryW CreateFileW FreeLibrary GetFileSize ReadFile HeapCreate GetVersionExW GetCurrentProcess SetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile

user32

CreateWindowExW DefWindowProcW GetClassInfoExW LoadCursorW SetTimer KillTimer GetWindowLongW SetWindowLongW TranslateMessage PeekMessageW DispatchMessageW GetMessageW UnregisterClassW RegisterClassExW CallWindowProcW

advapi32

RegQueryValueExW RegCloseKey StartServiceCtrlDispatcherW OpenSCManagerW OpenServiceW DeleteService CloseServiceHandle CreateServiceW ChangeServiceConfig2W StartServiceW RegOpenKeyW ControlService QueryServiceStatusEx RegDeleteValueW RegOpenKeyExW RegisterServiceCtrlHandlerW SetServiceStatus

shell32

SHGetSpecialFolderPathW ord165

ole32

CoUninitialize CoInitialize

exceptcatch

SetExceptionCatcher

shlwapi

PathCombineA PathCombineW PathFileExistsW

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_CxxThrowException _except_handler4_common memset memmove __CxxFrameHandler3 __std_terminate __std_exception_copy __std_exception_destroy _purecall wcsrchr memcpy

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _recalloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _seh_filter_exe _get_wide_winmain_command_line _cexit _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _invalid_parameter_noinfo_noreturn _controlfp_s _register_onexit_function _initialize_onexit_table terminate _set_app_type _initialize_wide_environment _initterm _beginthreadex _errno _invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf _set_fmode __stdio_common_vswprintf_s __p__commode

api-ms-win-crt-string-l1-1-0

wcscpy_s _wcsicmp wcsnlen wmemcpy_s strcpy_s

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

??0CharReader@Json@@QAE@ABV01@@Z ??0CharReader@Json@@QAE@XZ ??0CharReaderBuilder@Json@@QAE@ABV01@@Z ??0Exception@Json@@QAE@ABV01@@Z ??0Factory@CharReader@Json@@QAE@ABV012@@Z ??0Factory@CharReader@Json@@QAE@XZ ??0Factory@StreamWriter@Json@@QAE@ABV012@@Z ??0Factory@StreamWriter@Json@@QAE@XZ ??0FastWriter@Json@@QAE@ABV01@@Z ??0LogicError@Json@@QAE@$$QAV01@@Z ??0LogicError@Json@@QAE@ABV01@@Z ??0Path@Json@@QAE@$$QAV01@@Z ??0Path@Json@@QAE@ABV01@@Z ??0PathArgument@Json@@QAE@$$QAV01@@Z ??0PathArgument@Json@@QAE@ABV01@@Z ??0Reader@Json@@QAE@$$QAV01@@Z ??0Reader@Json@@QAE@ABV01@@Z ??0RuntimeError@Json@@QAE@$$QAV01@@Z ??0RuntimeError@Json@@QAE@ABV01@@Z ??0StaticString@Json@@QAE@PBD@Z ??0StreamWriter@Json@@QAE@ABV01@@Z ??0StreamWriterBuilder@Json@@QAE@ABV01@@Z ??0StyledStreamWriter@Json@@QAE@ABV01@@Z ??0StyledWriter@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@XZ ??1CharReader@Json@@UAE@XZ ??1Factory@CharReader@Json@@UAE@XZ ??1FastWriter@Json@@UAE@XZ ??1LogicError@Json@@UAE@XZ ??1Path@Json@@QAE@XZ ??1PathArgument@Json@@QAE@XZ ??1Reader@Json@@QAE@XZ ??1RuntimeError@Json@@UAE@XZ ??1StyledStreamWriter@Json@@QAE@XZ ??1StyledWriter@Json@@UAE@XZ ??4CharReader@Json@@QAEAAV01@ABV01@@Z ??4CharReaderBuilder@Json@@QAEAAV01@ABV01@@Z ??4Exception@Json@@QAEAAV01@ABV01@@Z ??4Factory@CharReader@Json@@QAEAAV012@ABV012@@Z ??4Factory@StreamWriter@Json@@QAEAAV012@ABV012@@Z ??4FastWriter@Json@@QAEAAV01@ABV01@@Z ??4Features@Json@@QAEAAV01@$$QAV01@@Z ??4Features@Json@@QAEAAV01@ABV01@@Z ??4LogicError@Json@@QAEAAV01@$$QAV01@@Z ??4LogicError@Json@@QAEAAV01@ABV01@@Z ??4Path@Json@@QAEAAV01@$$QAV01@@Z ??4Path@Json@@QAEAAV01@ABV01@@Z ??4PathArgument@Json@@QAEAAV01@$$QAV01@@Z ??4PathArgument@Json@@QAEAAV01@ABV01@@Z ??4Reader@Json@@QAEAAV01@$$QAV01@@Z ??4Reader@Json@@QAEAAV01@ABV01@@Z ??4RuntimeError@Json@@QAEAAV01@$$QAV01@@Z ??4RuntimeError@Json@@QAEAAV01@ABV01@@Z ??4StaticString@Json@@QAEAAV01@$$QAV01@@Z ??4StaticString@Json@@QAEAAV01@ABV01@@Z ??4StreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StreamWriterBuilder@Json@@QAEAAV01@ABV01@@Z ??4StyledStreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StyledWriter@Json@@QAEAAV01@ABV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@$$QAV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@ABV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@$$QAV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@ABV01@@Z ??4Writer@Json@@QAEAAV01@ABV01@@Z ??8ValueIteratorBase@Json@@QBE_NABV01@@Z ??9ValueIteratorBase@Json@@QBE_NABV01@@Z ??BStaticString@Json@@QBEPBDXZ ??CValueConstIterator@Json@@QBEPBVValue@1@XZ ??CValueIterator@Json@@QBEPAVValue@1@XZ ??DValueConstIterator@Json@@QBEABVValue@1@XZ ??DValueIterator@Json@@QBEAAVValue@1@XZ ??EValueConstIterator@Json@@QAE?AV01@H@Z ??EValueConstIterator@Json@@QAEAAV01@XZ ??EValueIterator@Json@@QAE?AV01@H@Z ??EValueIterator@Json@@QAEAAV01@XZ ??FValueConstIterator@Json@@QAE?AV01@H@Z ??FValueConstIterator@Json@@QAEAAV01@XZ ??FValueIterator@Json@@QAE?AV01@H@Z ??FValueIterator@Json@@QAEAAV01@XZ ??GValueIteratorBase@Json@@QBEHABV01@@Z ??_7CharReader@Json@@6B@ ??_7CharReaderBuilder@Json@@6B@ ??_7Exception@Json@@6B@ ??_7Factory@CharReader@Json@@6B@ ??_7Factory@StreamWriter@Json@@6B@ ??_7FastWriter@Json@@6B@ ??_7LogicError@Json@@6B@ ??_7RuntimeError@Json@@6B@ ??_7StreamWriter@Json@@6B@ ??_7StreamWriterBuilder@Json@@6B@ ??_7StyledWriter@Json@@6B@ ??_7Writer@Json@@6B@ ??_FStyledStreamWriter@Json@@QAEXXZ ??_FValue@Json@@QAEXXZ ?c_str@StaticString@Json@@QBEPBDXZ

Sharing

General

Malware Config

Signatures

File Explorer

d80f93a557842df67b3bed35f286e650fdcda49f4d41293db1da8dee50f3313f

qqmusiccommon

qmnetwork

psapi

kernel32

user32

advapi32

shell32

ole32

exceptcatch

shlwapi

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic