Static task
static1
Behavioral task
behavioral1
Sample
155320146/qq.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
155320146/qq.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
155320146/项目设计文档.doc
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
155320146/项目设计文档.doc
Resource
win10v2004-20240226-en
General
-
Target
ed7e3ae130be27fe6b773007e02caa5f_JaffaCakes118
-
Size
800KB
-
MD5
ed7e3ae130be27fe6b773007e02caa5f
-
SHA1
77f21d5bc44e0d1f958ce84b4eaf8833734e4d62
-
SHA256
ca7c01468eeb40df3719d71dda39aec3fb753eaa57a14444d2fbe7c018f777c8
-
SHA512
c3effcdd06194ed871ce09c620a94ec9671b796f365765474fe21663284d3587b7edf86e2e5545da19b8e176d375a66d1f68cdea857c2e67f33733b83d1f8f96
-
SSDEEP
12288:7ziABAlnSSGsS2w9uCdnL23xDpdCxThbWRTY6qeWSeylLUSrhcBrWIHm0jXGu88/:lA14uCdwxtCYU6FjBlDlctFJLFn/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/155320146/qq.exe
Files
-
ed7e3ae130be27fe6b773007e02caa5f_JaffaCakes118.rar
-
155320146/1127221014/FndSetup.ini
-
155320146/1127221014/friends.dat
-
155320146/Bug修正记录.txt
-
155320146/FlashForm.dcu
-
155320146/FlashForm.ddp
-
155320146/FlashForm.dfm
-
155320146/FlashForm.pas
-
155320146/FlashForm.~ddp
-
155320146/FlashForm.~dfm
-
155320146/FlashForm.~pas
-
155320146/Frind_friends.dcu
-
155320146/Frind_friends.ddp
-
155320146/Frind_friends.dfm
-
155320146/Frind_friends.pas
-
155320146/Frind_friends.~ddp
-
155320146/Frind_friends.~dfm
-
155320146/Frind_friends.~pas
-
155320146/Var_Share.dcu
-
155320146/Var_Share.pas
-
155320146/Var_Share.~pas
-
155320146/by_user.dcu
-
155320146/by_user.pas
-
155320146/by_user.~pas
-
155320146/dm_share.dcu
-
155320146/dm_share.ddp
-
155320146/dm_share.dfm
-
155320146/dm_share.pas
-
155320146/dm_share.~ddp
-
155320146/dm_share.~dfm
-
155320146/dm_share.~pas
-
155320146/login.dcu
-
155320146/login.ddp
-
155320146/login.dfm
-
155320146/login.pas
-
155320146/login.~ddp
-
155320146/login.~dfm
-
155320146/login.~pas
-
155320146/main.dcu
-
155320146/main.ddp
-
155320146/main.dfm
-
155320146/main.pas
-
155320146/main.~ddp
-
155320146/main.~dfm
-
155320146/main.~pas
-
155320146/msg.dcu
-
155320146/msg.ddp
-
155320146/msg.dfm
-
155320146/msg.pas
-
155320146/msg.~ddp
-
155320146/msg.~dfm
-
155320146/msg.~pas
-
155320146/qq.cfg
-
155320146/qq.dof
-
155320146/qq.dpr
-
155320146/qq.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 925KB - Virtual size: 925KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 12KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
155320146/qq.exe.manifest.xml
-
155320146/qq.res
-
155320146/qq.~dpr
-
155320146/setup.ini
-
155320146/sound/Offline.wav
-
155320146/sound/Online.wav
-
155320146/sound/folder.wav
-
155320146/sound/msg.wav
-
155320146/untAbout.dcu
-
155320146/untAbout.ddp
-
155320146/untAbout.dfm
-
155320146/untAbout.pas
-
155320146/untAbout.~dfm
-
155320146/untAbout.~pas
-
155320146/untSetup.dcu
-
155320146/untSetup.ddp
-
155320146/untSetup.dfm
-
155320146/untSetup.pas
-
155320146/untSetup.~ddp
-
155320146/untSetup.~dfm
-
155320146/untSetup.~pas
-
155320146/user_reg.dcu
-
155320146/user_reg.ddp
-
155320146/user_reg.dfm
-
155320146/user_reg.pas
-
155320146/user_reg.~ddp
-
155320146/user_reg.~dfm
-
155320146/user_reg.~pas
-
155320146/users.dat
-
155320146/下载说明.htm.html .js polyglot
-
155320146/功能完善记录.txt
-
155320146/项目设计文档.doc.doc windows office2003