Behavioral task
behavioral1
Sample
QQ拒绝好友添加.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
QQ拒绝好友添加.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
使用必读.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
使用必读.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
绿色先锋下载.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
绿色先锋下载.url
Resource
win10v2004-20240426-en
General
-
Target
4b0b765ab3fa22cf4556ad152869bc7d_JaffaCakes118
-
Size
2.0MB
-
MD5
4b0b765ab3fa22cf4556ad152869bc7d
-
SHA1
11bb259e284ee4c931dffd42bcea69733fcdcae2
-
SHA256
0ffb4e4ab4708567c74b03f2d81274b19d05dd0f3be2ceb04d78e587ad3bb868
-
SHA512
e4a516a556f74e1e0de81c929cd5baa385db1091371faa28c1a1aef33922b22c2270757ab76adb5d039b394dfb933b2c939f41b3675b976e4d3645a981c4b7d3
-
SSDEEP
49152:Ru7D5wm326ukl+00LSp/0vWXjepo123KVqCreRFcGJ0fCCew:0XCm38RjWp/IWXjepo12K9re4GJ0afw
Malware Config
Signatures
-
resource yara_rule static1/unpack001/QQ拒绝好友添加.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QQ拒绝好友添加.exe
Files
-
4b0b765ab3fa22cf4556ad152869bc7d_JaffaCakes118.rar
-
QQ拒绝好友添加.exe.exe windows:5 windows x86 arch:x86
c31d8c04c9927869e7d275d74a210c87
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutGetNumDevs
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
EnumResourceLanguagesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MapWindowPoints
gdi32
ScaleViewportExtEx
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
StgCreateDocfileOnILockBytes
oleaut32
VariantCopyInd
comctl32
ImageList_SetBkColor
oledlg
ord8
wininet
HttpQueryInfoA
Sections
.text Size: - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 381KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
使用必读.url
-
绿色先锋下载.url.url