Static task
static1
Behavioral task
behavioral1
Sample
QPPressKey/QPPressKey.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
QPPressKey/QPPressKey.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
QPPressKey/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
QPPressKey/新云软件.url
Resource
win10v2004-20240412-en
General
-
Target
f0c9076c80f02dfd73c5449b11ddbc6f_JaffaCakes118
-
Size
613KB
-
MD5
f0c9076c80f02dfd73c5449b11ddbc6f
-
SHA1
264880f5353c546c9cb0f8de6426e5d8c0445b47
-
SHA256
0304f26bad00a448e3dbce5e513011bac14a81bb5cd5ebe309a44fe0bbc79452
-
SHA512
d4734b0e519307b0152394a7d32c09edc7cfdcf1e0d3848f23bfca5cf873128943420746c0f0092295394d28daa11fc244a4719e51b5a77913069fdd65179a37
-
SSDEEP
12288:KjNLvLdk9fG7rTk3xKfmqNM6C9kF0su1Ta5eoBazKRT4be90qlWTi:KpLvLGfeTSIOq5ykFBf5eoUKT790SWTi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QPPressKey/QPPressKey.exe
Files
-
f0c9076c80f02dfd73c5449b11ddbc6f_JaffaCakes118.rar
-
QPPressKey/QPPressKey.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 215KB - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 368KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
QPPressKey/新云软件.url.url
-
QPPressKey/脚本/QQ三国.ini
-
QPPressKey/脚本/卓越之剑GE(全体模式).ini
-
QPPressKey/脚本/卓越之剑GE(单体模式).ini