Static task
static1
Behavioral task
behavioral1
Sample
qq.vbs
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
qq.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
˵.htm
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
˵.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
QQľ V2009 Beta ɱ.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
QQľ V2009 Beta ɱ.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ڰ.url
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ڰ.url
Resource
win10v2004-20231215-en
General
-
Target
5b28b79e9a42eeaa9b03c48fac5ade10
-
Size
369KB
-
MD5
5b28b79e9a42eeaa9b03c48fac5ade10
-
SHA1
b9ee2e24fda8066a46c6be7da7672cc3a4203176
-
SHA256
ac3cf4a538e04ca912fb811d367131289749ada0d1da65e4432b55eb1d732c1e
-
SHA512
4ee78f0a69fda90bcd9f13bff6c1ccbb925ffbc266f497059d83385e3c20b1b8e7882bcc4e7567f61225c6a53a2dc0ca98901413506ccaddd2aee0161898edc2
-
SSDEEP
6144:HXgh/4QRwTOe1n/HO11sNoVeIt/M+NGapLOag1anfxFbr69b9ahsvjknddSpxbj:HXgxmKQn4AoVzM+9pHXfrbr6okjmd6bj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QQľ V2009 Beta ɱ.exe
Files
-
5b28b79e9a42eeaa9b03c48fac5ade10.zip
-
qq.asp.vbs
-
readme.txt
-
ʹð˵.txt
-
˵.htm.html
-
QQľ V2009 Beta ɱ.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.jxyurph Size: - Virtual size: 856KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vpxpwih Size: 369KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wbcghfe Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RPCrypt Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ڰ.url