StartHook
StopHook
Overview
overview
7Static
static
7QQ宠物�...ok.dll
windows7-x64
1QQ宠物�...ok.dll
windows10-2004-x64
3QQ宠物�...in.exe
windows7-x64
1QQ宠物�...in.exe
windows10-2004-x64
1QQ宠物�...Ex.exe
windows7-x64
1QQ宠物�...Ex.exe
windows10-2004-x64
1QQ宠物�...or.exe
windows7-x64
1QQ宠物�...or.exe
windows10-2004-x64
1QQ宠物�...te.exe
windows7-x64
1QQ宠物�...te.exe
windows10-2004-x64
1QQ宠物�...ll.dll
windows7-x64
7QQ宠物�...ll.dll
windows10-2004-x64
7Behavioral task
behavioral1
Sample
QQ宠物管家060330屠龙倚天绿化配置版/PetSkinHook.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
QQ宠物管家060330屠龙倚天绿化配置版/PetSkinHook.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkin.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkin.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinEx.exe
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinEx.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinMonitor.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinMonitor.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinUpdate.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinUpdate.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
QQ宠物管家060330屠龙倚天绿化配置版/dmshell.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
QQ宠物管家060330屠龙倚天绿化配置版/dmshell.dll
Resource
win10v2004-20240226-en
Target
f9b8d09370dfd6df674177f95813a39d_JaffaCakes118
Size
1.8MB
MD5
f9b8d09370dfd6df674177f95813a39d
SHA1
1e3698a6ea0d932b32a82b182ca79c0fd9f2ff9b
SHA256
abc27554ee895e64e577e04ec876d0a7cd46daccba17ecc2eee856fc681ac7c7
SHA512
3649699f8628856f3d341fb54becd5d8e71c7952e6d377850b67bc2d0f51f1a05f9f812f6076b40521191e947e00466aacf14b2357902878b7130f2fcd8420c6
SSDEEP
49152:JRoAcYuLsOmehDoyD3BTkPXNkQUnXvsgZrJnGFB:3En0WoyD3hkvNkQc/nZ1n8
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack001/QQ宠物管家060330屠龙倚天绿化配置版/dmshell.dll | acprotect |
resource | yara_rule |
---|---|
static1/unpack001/QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinMonitor.exe | aspack_v212_v242 |
resource | yara_rule |
---|---|
static1/unpack001/QQ宠物管家060330屠龙倚天绿化配置版/dmshell.dll | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/QQ宠物管家060330屠龙倚天绿化配置版/PetSkinHook.dll |
unpack001/QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkin.exe |
unpack001/QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinEx.exe |
unpack001/QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinMonitor.exe |
unpack001/QQ宠物管家060330屠龙倚天绿化配置版/QQPetSkinUpdate.exe |
unpack001/QQ宠物管家060330屠龙倚天绿化配置版/dmshell.dll |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
GetKeyboardType
RegQueryValueExA
SysFreeString
UnrealizeObject
ImageList_SetIconSize
Shell_NotifyIconA
waveOutOpen
StartHook
StopHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
GetKeyboardType
RegQueryValueExA
SysFreeString
UnrealizeObject
CreateStreamOnHGlobal
ImageList_SetIconSize
ShellExecuteA
timeGetTime
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
registerMe
stopAd
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE