Static task
static1
Behavioral task
behavioral1
Sample
44819258/QQSpy 2003/QQSpy.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
44819258/QQSpy 2003/QQSpy.exe
Resource
win10v2004-20231215-en
General
-
Target
2440131e6bb181d4dcb186cd21425bc3
-
Size
202KB
-
MD5
2440131e6bb181d4dcb186cd21425bc3
-
SHA1
16827b43a7380ab5ea0fca69da95e2f8d2632aa1
-
SHA256
fb8718e30754e6b9afe846fc5a6a1caf6754d82609ce27194750a1b6bf159536
-
SHA512
eeca61d42b602d4eaf333c28e1588d0e6519637c5b152256eaad1e4b22c290662761153fdb96646e8418d78c4672d0e096fa38c9cf9ec907a2b8e96c71064e9f
-
SSDEEP
6144:KmJBHvQwZL58Q52Hk7Ig9Iyz4uXo8j4pgz2nBibL5:KmJBHIwZt8Q52k7IesCo8j4nnBibL5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/44819258/QQSpy 2003/QQSpy.exe
Files
-
2440131e6bb181d4dcb186cd21425bc3.rar
-
44819258/QQSpy 2003/FMain.dcu
-
44819258/QQSpy 2003/FMain.dfm
-
44819258/QQSpy 2003/FMain.pas
-
44819258/QQSpy 2003/FMain.~dfm
-
44819258/QQSpy 2003/FMain.~pas
-
44819258/QQSpy 2003/QQSpy.cfg
-
44819258/QQSpy 2003/QQSpy.dof
-
44819258/QQSpy 2003/QQSpy.dpr
-
44819258/QQSpy 2003/QQSpy.exe.exe windows:4 windows x86 arch:x86
3c0e70bfa5f73f1f1cef484e2bcb5bf8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
user32
MessageBoxA
Sections
8651631 Size: 166KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
3279353 Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
8605714 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
5729129 Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
5943725 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2022366 Size: 512B - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
6799663 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
44819258/QQSpy 2003/QQSpy.res
-
44819258/QQSpy 2003/QQSpy.~dpr
-
44819258/下载说明.htm.html .js polyglot