Behavioral task
behavioral1
Sample
QQgzzBsq/河源下载站-cngr.cn.url
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
QQgzzBsq/河源下载站-cngr.cn.url
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
QQgzzBsq/淘宝热卖.url
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
QQgzzBsq/淘宝热卖.url
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
QQgzzBsq/装逼神器1.3版本.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
QQgzzBsq/装逼神器1.3版本.exe
Resource
win10v2004-20240419-en
General
-
Target
157b62260f840f45cdded71649a80789_JaffaCakes118
-
Size
2.7MB
-
MD5
157b62260f840f45cdded71649a80789
-
SHA1
493bc624457635fe2c2ced5296e7e6811f3302c7
-
SHA256
ad5b92aebc38dd5324fc3c67ff8e5f3c031922f005ed0356514178c30100e43d
-
SHA512
2536332cf9ab00cec88b2361a676a693a6e69a6f9fda87b59aac56cf9d2fc5f74554d1b05f81dac50df14d0fc4ebdb6cf23ad42fb848f3665d41f4cc9735ca69
-
SSDEEP
49152:IvpkYY2rZ/nHx7rtk+yWLHJLjFVIzS/9uFWwBKStMumMzeRCwvyuIZH2OSXdIELl:IvpxR1rNNVIYuFLfSnbwcdICrF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/QQgzzBsq/装逼神器1.3版本.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QQgzzBsq/装逼神器1.3版本.exe
Files
-
157b62260f840f45cdded71649a80789_JaffaCakes118.rar
-
QQgzzBsq/河源下载站-cngr.cn.url.url
-
QQgzzBsq/淘宝热卖.url.url
-
QQgzzBsq/装逼神器1.3版本.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE