analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

qBal.exe

Full analysis: https://app.any.run/tasks/c1c99edb-4d52-4707-a011-cb72b9faeb87
Verdict: Malicious activity
Analysis date: July 17, 2019, 07:32:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

773E9C3FE26FFF775BBDCA5F2235976D

SHA1:

5601467E422F87EB29706B749E6C5269E4C52B3A

SHA256:

6CDBFF8DCECE683013E4741088FFBC1237CEA9D45333630DBC16F31A4BFECD38

SSDEEP:

196608:6Gvl/JjcLg5MYZzZzN8w6kJl9PqhrwfETlXZbPRNjSpJ08ktnL2JW6:6G1egZWwPJ3QTlpTl8aGl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 292)
      • explorer.exe (PID: 284)
      • qBal.exe (PID: 2768)
    • Application was dropped or rewritten from another process

      • qBal.exe (PID: 2768)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • qBal.exe (PID: 3816)
    • Starts Internet Explorer

      • qBal.exe (PID: 2768)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • qBal.exe (PID: 3816)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3344)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3344)
    • Changes internet zones settings

      • iexplore.exe (PID: 3168)
    • Creates files in the user directory

      • iexplore.exe (PID: 3344)
      • iexplore.exe (PID: 3168)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 3168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 9.2
ProductName: 7-Zip
OriginalFileName: 7z.sfx.exe
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
InternalName: 7z.sfx
FileVersion: 9.2
FileDescription: 7z SFX
CompanyName: Igor Pavlov
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 9.20.0.0
FileVersionNumber: 9.20.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1d262
UninitializedDataSize: -
InitializedDataSize: 51200
CodeSize: 127488
LinkerVersion: 6
PEType: PE32
TimeStamp: 2010:11:18 17:27:33+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 18-Nov-2010 16:27:33
Detected languages:
  • English - United States
CompanyName: Igor Pavlov
FileDescription: 7z SFX
FileVersion: 9.20
InternalName: 7z.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFilename: 7z.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.20

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 18-Nov-2010 16:27:33
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001F01A
0x0001F200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.59059
.rdata
0x00021000
0x00005A5C
0x00005C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.16805
.data
0x00027000
0x00004D98
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.10058
.sxdata
0x0002C000
0x00000004
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x0002D000
0x00001BC0
0x00001C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.29296

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.41402
688
UNKNOWN
English - United States
RT_VERSION
2
1.68942
296
UNKNOWN
English - United States
RT_ICON
7
3.16186
392
UNKNOWN
English - United States
RT_STRING
13
3.27682
756
UNKNOWN
English - United States
RT_STRING
14
2.58196
114
UNKNOWN
English - United States
RT_STRING
32
1.10136
46
UNKNOWN
English - United States
RT_STRING
38
2.11169
72
UNKNOWN
English - United States
RT_STRING
44
2.76378
148
UNKNOWN
English - United States
RT_STRING
45
1.07875
44
UNKNOWN
English - United States
RT_STRING
66
3.07708
244
UNKNOWN
English - United States
RT_STRING

Imports

KERNEL32.dll
MSVCRT.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start qbal.exe searchprotocolhost.exe no specs explorer.exe no specs qbal.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3816"C:\Users\admin\AppData\Local\Temp\qBal.exe" C:\Users\admin\AppData\Local\Temp\qBal.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7z SFX
Exit code:
0
Version:
9.20
292"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
284C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2768"C:\Users\admin\Desktop\qBal\qBal.exe" C:\Users\admin\Desktop\qBal\qBal.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3168"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
qBal.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3344"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3168 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
4 973
Read events
4 695
Write events
0
Delete events
0

Modification events

No data
Executable files
16
Suspicious files
6
Text files
33
Unknown types
10

Dropped files

PID
Process
Filename
Type
3816qBal.exeC:\Users\admin\Desktop\qBal\log.txttext
MD5:7A64EE217CA1202E7D20A9CAF33247B4
SHA256:CCF2FB39EA5D8FCA6854878CAE69B98F28930083D88AB9FB8B79C88C2D645C63
3816qBal.exeC:\Users\admin\Desktop\qBal\db\rimfire.dbsqlite
MD5:1082BDEC9767CC6C4598DDD4889C80C2
SHA256:0C04864BC9288B6C94BEF0F3063B267AF40A189E070F0759400E2E6832B5C72F
3816qBal.exeC:\Users\admin\Desktop\qBal\doc\qbal_UserManual_en.pdfpdf
MD5:4891C92B20CB0E5DA11F761814C0F543
SHA256:BE9AFF59F0B9E5B42E41DBCE111EF9687D3F209C9FF8171ABB32C841C34F2C03
3816qBal.exeC:\Users\admin\Desktop\qBal\doc\qbal_UserManual_fr.pdfpdf
MD5:B6BA93F6DB6AC0AF2BADE3C832A97EE9
SHA256:7543403230A4396DBC8AA591652831A6F9AA2659DB7013836B1E2CA69A46C1F4
3816qBal.exeC:\Users\admin\Desktop\qBal\db\custom.dbsqlite
MD5:7FD1BCFBD445D46072ADAB7BE33B12AF
SHA256:8B5DE5EA868EA5CB917779B9AC3DC38101D9B3FB05B9B3B59748EF6EA73DA904
3816qBal.exeC:\Users\admin\Desktop\qBal\plugins\sqldrivers\qsqlite.dllexecutable
MD5:BC8BD846240DC64BF346A022DCF2AA1E
SHA256:6376E9C932E08E02C80E2FA42B257F7CA2B26A8C94E57B1D082BD8AE27A444E5
3816qBal.exeC:\Users\admin\Desktop\qBal\plugins\imageformats\qjpeg.dllexecutable
MD5:C992ED5B55E48D2C0D4C3408D0E4FFCC
SHA256:0FD9BD2A4BE14A08C840D06EEB14834446FC8D0688A606E31DA988B251A4BC22
3816qBal.exeC:\Users\admin\Desktop\qBal\translations\qbal_it.qmqm
MD5:D056E63444737B6C06F507378674D388
SHA256:BA320AB84C5DC860F49F16403CFD7E54FF2AB0FCE3F9C323D2361082522C4FB6
3816qBal.exeC:\Users\admin\Desktop\qBal\translations\qbal_fr.qmqm
MD5:C718F0F1D5FFB6C399155399564C3F82
SHA256:2EF1288FAAC85BA7BB1ACCDC6522CA82D68803906D5B5D714ADBB6B5EFB5AC9D
3816qBal.exeC:\Users\admin\Desktop\qBal\db\airgun.dbsqlite
MD5:2EF4FF6EF3BBBBBA1D23CE595C376F4E
SHA256:9B269BA47BBAA569D1151AD1CB4BAF95EA059ED990BE99809944E12DCC291E6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
22
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3168
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
35.157.3.192:443
nexus.ensighten.com
Amazon.com, Inc.
DE
unknown
3344
iexplore.exe
151.101.194.109:443
cdn.jsdelivr.net
Fastly
US
unknown
2.18.232.222:443
www.paypal.com
Akamai International B.V.
whitelisted
3344
iexplore.exe
2.18.232.222:443
www.paypal.com
Akamai International B.V.
whitelisted
3168
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.paypal.com
  • 2.18.232.222
whitelisted
www.paypalobjects.com
  • 2.18.232.222
whitelisted
cdn.jsdelivr.net
  • 151.101.194.109
  • 151.101.130.109
  • 151.101.66.109
  • 151.101.2.109
whitelisted
nexus.ensighten.com
  • 35.157.3.192
  • 35.157.31.226
whitelisted

Threats

No threats detected
Process
Message
qBal.exe
"C:/Users/admin/Desktop/qBal"
qBal.exe
Settings::Settings(QObject*)
qBal.exe
Settings::Settings(QObject*) "\\HKEY_CURRENT_USER\\Software\\ManKonit\\qBal4"
qBal.exe
Shoot::Shoot(int, QObject*) 0
qBal.exe
Shoot::Shoot(int, QObject*) 1
qBal.exe
Shoot::Shoot(int, QObject*) 2
qBal.exe
Shoot::Shoot(int, QObject*) 3
qBal.exe
void Settings::initializeLanguage()
qBal.exe
void Settings::setLanguage(const QString&) ""
qBal.exe
void MainWindow::setLanguage(QString) ""