Behavioral task
behavioral1
Sample
QQ超级农夫/QQFarmer.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
QQ超级农夫/QQFarmer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
QQ超级农夫/下载新版本.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
QQ超级农夫/下载新版本.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
QQ超级农夫/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
QQ超级农夫/新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
b9580cc4a5e3ffc6eb36cd9cf0094354
-
Size
896KB
-
MD5
b9580cc4a5e3ffc6eb36cd9cf0094354
-
SHA1
ff2c9615ec3832109043f60732748739614d15e3
-
SHA256
bc08a8fbecb1d7768ac4648dac7bb8aa63ccd1b37071ae31e97d7c8d17922d2d
-
SHA512
3e85f7aa2f6ec3bb960599f5a5bd9f4060907eb1f1128f36d68f704fae2ee2a0a8d9ecda85c44466881dc6ec0c37ed91c9ffe29f4fec926cd880cd00a315c471
-
SSDEEP
24576:9+lHIkvNWmt0bzkFqzGW161toMzr1KA1TDW:9+thvHt0bqcgoMUIT6
Malware Config
Signatures
-
resource yara_rule static1/unpack001/QQ超级农夫/QQFarmer.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QQ超级农夫/QQFarmer.exe
Files
-
b9580cc4a5e3ffc6eb36cd9cf0094354.rar
-
QQ超级农夫/QQFarmer.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 632KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 18KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 217KB - Virtual size: 972KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 71KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
QQ超级农夫/下载新版本.url
-
QQ超级农夫/新云软件.url.url