31ff9bfc14466b4a60adb71698259015_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

31ff9bfc14466b4a60adb71698259015_JaffaCakes118
Size

750KB
MD5

31ff9bfc14466b4a60adb71698259015
SHA1

93dfa1f2cfafad11c1a30d46a5556f1925c1feab
SHA256

2218e26da78f1fb9b5fe2166f749683212df9b26ced31f4710c28479caa2673d
SHA512

60692a930ee77e22098764fef967d389a80352d8a8faf7e8d4d57d50a03a456632f7d83f33eeaa1928144e68f9d33d574fbc89374260514b6e457a76da92c516
SSDEEP

12288:/tWyUIhiAqJxhOu0ovbXX74iyoSJC0FVO44xSms6M0Zgw961aaa15kbsHoi1gw:wyfKJxheOH745ohMvqsj0ZgX1aaieUZ

Score

7^/10

vmprotect upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/qqct/SkinH.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/qqct/SkinH.dll	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/qqct/QQ餐厅大师.app	vmprotect

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/qqct/QQRestaurantHelper.dll
unpack001/qqct/QQ餐厅大师.app
unpack001/qqct/QQ餐厅大师.exe
unpack001/qqct/SkinH.dll

Files

31ff9bfc14466b4a60adb71698259015_JaffaCakes118
.rar
qqct/QQRestaurantHelper.dll
.dll windows:4 windows x86 arch:x86

3b7bdace2c4e8626bc3045142fd9df74

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

skinh

SkinH_Attach_Res

kernel32

GetFileTime
CreateThread
ExitThread
RtlUnwind
GetCommandLineA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapAlloc
HeapFree
RaiseException
TerminateProcess
HeapSize
HeapReAlloc
SetStdHandle
GetFileType
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FileTimeToLocalFileTime
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetCPInfo
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
FileTimeToSystemTime
GetProcessVersion
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
EnterCriticalSection
GetFullPathNameW
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
GetLastError
FormatMessageW
LocalFree
lstrcpynW
lstrcmpiW
InterlockedDecrement
GlobalUnlock
MulDiv
InterlockedIncrement
GetThreadLocale
GlobalFree
ResumeThread
WaitForSingleObject
GlobalLock
lstrcmpW
GlobalAlloc
lstrlenW
GetCurrentThread
lstrlenA
GetVersion
lstrcatW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrcpyW
GetModuleHandleA
FreeLibrary
SetLastError
GetCurrentProcess
FlushInstructionCache
GetPrivateProfileStringW
GetTempPathW
MoveFileW
ExitProcess
WriteFile
SetFileTime
CreateDirectoryW
WideCharToMultiByte
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
LockResource
MultiByteToWideChar
Sleep
DeleteFileW
WritePrivateProfileStringW
GetFileSize
FindFirstFileW
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindClose
CreateFileW
ReadFile
SetFilePointer
LoadLibraryA
GetProcAddress
VirtualProtect
GetModuleFileNameW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceW
OpenProcess
CloseHandle
GetTickCount
GetEnvironmentVariableA

user32

PostThreadMessageW
RegisterClipboardFormatW
MessageBeep
GetNextDlgGroupItem
SetRect
CopyAcceleratorTableW
LoadStringW
DestroyMenu
GetSysColorBrush
PtInRect
GetClassNameW
UnregisterClassW
CharUpperW
GrayStringW
DrawTextW
TabbedTextOutW
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
CharNextW
MapDialogRect
SetWindowContextHelpId
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetNextDlgTabItem
GetActiveWindow
ValidateRect
GetCursorPos
IsWindowEnabled
MoveWindow
IsDialogMessageW
UpdateWindow
SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
GetSysColor
PeekMessageW
GetFocus
IsWindow
SetFocus
AdjustWindowRectEx
CopyRect
IsWindowVisible
DispatchMessageW
TranslateMessage
ShowWindow
GetMessageW
CreateDialogParamW
PostMessageW
GetSystemMetrics
GetWindowThreadProcessId
GetTopWindow
MessageBoxW
IsChild
GetCapture
WinHelpW
GetClassInfoW
RegisterClassW
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgCtrlID
GetKeyState
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
SetPropW
UnhookWindowsHookEx
GetPropW
RemovePropW
DefWindowProcW
GetMessageTime
GetDesktopWindow
GetForegroundWindow
GetAncestor
WindowFromPoint
SetTimer
GetClientRect
SetWindowPos
GetMenuState
OffsetRect
SystemParametersInfoW
PostQuitMessage
DestroyWindow
CreateDialogIndirectParamW
LoadIconW
SetWindowTextW
SetWindowLongW
GetWindowTextW
CallWindowProcW
SendMessageW
GetDlgItem
DialogBoxParamW
EndDialog
EndPaint
GetParent
BeginPaint
SetCursor
LoadCursorW
GetWindowRect
EnableWindow
wsprintfW
SetForegroundWindow
SetActiveWindow
GetWindowPlacement
IsIconic
RegisterWindowMessageW
GetMessagePos
GetLastActivePopup
GetWindow
GetWindowLongW

gdi32

GetMapMode
LPtoDP
DPtoLP
Escape
ExtTextOutW
RectVisible
PtVisible
GetWindowExtEx
SelectObject
DeleteObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
DeleteDC
GetStockObject
GetDeviceCaps
GetBkColor
GetTextColor
CreateBitmap
GetObjectW
SetBkColor
GetClipBox
TextOutW
SetTextColor
SetBkMode
GetViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

comctl32

ord17

oledlg

OleUIBusyW

ole32

CoInitialize
OleInitialize
CLSIDFromProgID
CLSIDFromString
StgOpenStorageOnILockBytes
CoUninitialize
CreateILockBytesOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoFreeUnusedLibraries
CoGetClassObject

olepro32

ord253

oleaut32

VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SysFreeString
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
VariantCopy
VariantChangeType
VariantTimeToSystemTime
SysStringLen

urlmon

URLDownloadToFileW

psapi

GetModuleFileNameExW

wininet

InternetCanonicalizeUrlW
InternetGetLastResponseInfoW
HttpQueryInfoW
HttpSendRequestW
InternetQueryDataAvailable
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetCloseHandle
InternetOpenW
InternetCrackUrlW
InternetConnectW
HttpOpenRequestW

shlwapi

PathFindFileNameW
SHRegGetValueW
SHSetValueW

Exports

Exports

QQRestaurantHelper

Sections

.text
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
qqct/QQ餐厅大师.app
.exe windows:5 windows x86 arch:x86

8243598379bf73aaa7dae9b6f32ca4d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
RaiseException
ExitThread
CreateThread
HeapSize
SetStdHandle
GetFileType
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
SetErrorMode
GetStartupInfoW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetFileTime
GetFileSizeEx
FindFirstFileW
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
lstrlenA
WritePrivateProfileStringW
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
CreateEventW
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
GetModuleHandleA
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageW
LocalFree
MulDiv
InterlockedDecrement
GetModuleFileNameW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleW
GetProcAddress
GetVersionExA
GetThreadLocale
InterlockedIncrement
Sleep
SetFileTime
WriteFile
CreateDirectoryW
GetFileAttributesW
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
CreateFileW
lstrlenW
FreeLibrary
LoadLibraryW
GetWindowsDirectoryW
TerminateThread
SetFilePointer
GetModuleFileNameA
CreateFileA
FindClose
FindFirstFileA
ReadFile
CloseHandle
ExitProcess
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
GetCurrentProcess
WideCharToMultiByte
LockResource
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetLastError
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
IsWindowVisible
UpdateWindow
GetSubMenu
GetMenuItemID
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
PostThreadMessageW
ScreenToClient
EqualRect
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetDlgItem
GetWindowLongW
OffsetRect
CopyRect
GetDlgCtrlID
GetWindow
CharNextW
wsprintfW
CopyIcon
LoadCursorW
InflateRect
ReleaseDC
GetParent
GetSysColor
IsWindow
SetWindowLongW
SetCursor
SetCapture
RedrawWindow
ReleaseCapture
RegisterClipboardFormatW
PtInRect
PeekMessageW
EnableWindow
MessageBeep
GetNextDlgGroupItem
PostMessageW
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
LoadMenuW
AppendMenuW
GetSystemMenu
LoadIconW
KillTimer
InvalidateRect
MessageBoxW
GetDC
SetForegroundWindow
SetActiveWindow
SetTimer
CharUpperW
SetWindowTextW
UnregisterClassW
GetSysColorBrush
IsDialogMessageW
GetWindowRect
SendMessageW
AdjustWindowRectEx
SetRect
IsRectEmpty
CopyAcceleratorTableW
WindowFromPoint
DestroyMenu
SetWindowContextHelpId
MapDialogRect
GetWindowThreadProcessId
WaitMessage
PostQuitMessage
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
ShowWindow
MoveWindow
GetMenuItemCount
InvalidateRgn

gdi32

SaveDC
RestoreDC
SetBkMode
SetMapMode
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreateRectRgnIndirect
GetRgnBox
GetMapMode
SetBkColor
CreateBitmap
SetTextColor
GetClipBox
GetTextColor
GetBkColor
GetDeviceCaps
CreateFontIndirectW
GetStockObject
GetTextExtentPoint32W
GetObjectW
SetDIBColorTable
SelectObject
GetDIBColorTable
StretchBlt
DeleteObject
CreateDIBSection
SetViewportOrgEx
DeleteDC
CreateCompatibleDC

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegCreateKeyExW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegQueryValueW
RegOpenKeyExW

shell32

ShellExecuteW
Shell_NotifyIconW

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

VariantChangeType
VariantInit
SysStringLen
SysFreeString
VariantCopy
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
SysAllocStringLen
OleCreateFontIndirect

ws2_32

sendto
connect
WSASetLastError
WSAGetLastError
bind
select
socket
recvfrom
inet_addr
closesocket
WSACleanup
WSAStartup
gethostbyname
send
htonl
WSAAsyncSelect
htons
recv
ntohl
accept
inet_ntoa

gdiplus

GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipDisposeImage
GdipAlloc
GdipFree
GdipGetImageGraphicsContext

winmm

sndPlaySoundW

wininet

HttpOpenRequestW
InternetConnectW
HttpSendRequestW
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
HttpQueryInfoW
HttpAddRequestHeadersW
InternetQueryDataAvailable
InternetGetCookieW
InternetGetCookieExA
InternetReadFile
InternetOpenUrlW
DeleteUrlCacheEntryW
InternetOpenW
InternetCloseHandle

Exports

Exports

��Å�6[�Z��3U��0�ex�2��~��e��Ǜ�n��_M��E+��R1��z�n'�4HY��8a��f��/��yPu��/ŭ� ��^oN!�<§�� )(��W.\��\�:+�\� m��B�w^W��a=՛��9 $�Xh�ܜm�]��n}��Oy��z ��JHyPgbj��+��0�昅.=�d�㎍��! '�.w�煃 DP�?q�+�A��Dq0B��k��]S��8м6�05E�(��4Ȝ1};�m��P�f�a�1��x٨ �l��.95�'�/��q�$�#��f�υ4�s��)p��C��]��Ιb�xzw4M�L��[Zk�$C��(��,_�!ղ �gX�+T��R[�Y�u�1��Q�Y�j8�xއY��HL/8��+o�� @6�Z �#�8HM�V�z��WC��Я��c�E9�)�.��w � e�U��[�/�d� �A�W�AF5��~��7 ^��N�$�פ�C��OK U��`n1��}(�ɜ\B�ޖ�;�j��fǥ�{?�'fG�*I�Y��E�wqD��X��hjɼ��"P�p��]/�/%cQ�=L��E�K)�� H�54 qAF�oVq�2.iBNI�ܡ�A��,6=��pM�z+t<>��.Uqc�˩�u�"��Kԛ�b1�ph��Z��~f�-&��3��z,р�uВo��z�E��j��8W��e��M��m��+��w��3o��dB9�� y�$��k��nF�X�۪��@��=W�1Kg��k%x~9oE��>%��p��>.��L�C�Z/ ��+�1}�. �z<�`ܩ��<��azAx�_C��!�&��~&��z��;ባ� �C8��N�Zv�~6�k�C��^/e�6~Ե(J·�� G�|k �̓ƽ��;��7S�L��(t�w��9�Z�Tܒ��#Z>�[N ��k�.yr��G'��m}Ǻ��?�O�8��U�C��]��N��%�&l��N�ڦn�X��Q�)�z�b>��w��m��7�-�Ñ\34�)��0|>�Ю�(�5ؔ�"��Я{�#�>��'7f'� I�X}>�ZҢb��X��E�ų�+�OG�e ��Q�1��OJ�N�&7i��jV��5��3��4�3>�WZ��.ϑ�pFt��1��2<�S�P'��K�Q�<��,��mw�I�$[�U��rS��jJ��M��F��(z�M�[;�yN�@:��_u� ��_�X��*�m."FIץ� .;P<VY�[��{w�-�ӛ��|O�)�G�P��;~�z{��h�s�7��}��!̳�f�V��YӢ��w�)�1g��ws P�|�o��|��+T��}�r�� wHVۼAW5M� M��vx� qW��J�� (L��d�s�%��LA��^��Q}��"�yg=�֏z� ��޶��~��N��#+�M|7��a ��-G�,�N�۪�9�r�x�W�d �ja�>o��X�7S_��7~��,�J�xRqvwڮH'��8�py��58�@k��2��k��9v��E��$ZD�6��Q�?�'@/ᇘ�'U[n��=�y|��aaW�ĵ�m׼�;6�H��]��O!��K�r��j|��ⵌ� H��m��镱z n&�G��d��L=q;!��E�n��ͨ�daǡ��k�cGh��L��K!��a�ء��e@��a�ҨaKXqWX��8mE�H��R��Δw��-�ܐw��G\��ݾ0@��|H5�˹�5h��wp��#��4Nu��4_�>��D��wdd�4�e��fV��f�Ei�X+�4��{V��s��'�8��x�� b)�zX*�� QgB�aeRN��Z�u��{o��~�'{ŭ�ۖ�m}��D�7Ǘ��]B��Q[ �$d�:^%�Y��uu��Y2�dþ��d<�F R��Y��|��q�t z�F��˛o��ry�h`�5W�o�XGm�(��U[�'k��X�w>��?��l�(�i�K��5-�0��5x ��N��j�*�h2<��S�-(A��Y/�`�(�3m0��4�w��Yv_�-C��,��d�!:��q�1�:��;h�'��e��l�, I�mҜ9t�u��d�vK,��9�AQu��߼q̋;��0+{gU�F�b�3�x��IR��>4u��,�J��U�?.F��h-�O�fVD�[��+`Po :C��)'�bD��ָY\|Bs1��0B�!��e}쮓�\��4z�( ��"��ϕRP�ne��6��N�o� ��eJTS��c�nQ䐨XM.�Lm�?�W�#3S�8E��{&��?l��c�K讫��8�!��PN\�sF��O��{��8_j9�X��),x�뚶#o�ZK�Q��{:og��n��l�7�6/�{�ơ�ܗ0`�ø��@��l×VCn�@kdh'�}9!��1e��z��0��J¿��@P/<��_g��w��6j�5�uN��ڬ�EzC ��M�|f�V��ɥ��J��-O��)�rg`��:2�A��Z� at]܂�Y��Z��vV05v�-P�'��OD=� ��?��b�7��ymd#9�˿�6�ZQ��ē�{e�UW�1�RsH��/|��%�]c��o��מ;m�y�*k�^�� >�Qƀ��4J�4�ҥ��4��ɑ�ذg��(>��I(��DG��ݕ@�>��٧��45�N�+�8��[GJ� �k��E.�}Á�p?��s�jV�t��*7j��]"�#C��8��_nV��Ġ�6YؖV^�c��h��

Sections

.text
Size: - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
qqct/QQ餐厅大师.exe
.exe windows:4 windows x86 arch:x86

4e46f1e9cfb076432dd8ccc7b6286c6d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
SetFilePointer
GetTickCount
CreateFileA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
VirtualAlloc
HeapReAlloc

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
qqct/SkinH.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

SkinH_Adjust_HSV
SkinH_Aero
SkinH_Aero_Adjust
SkinH_Alpha
SkinH_Alpha_Menu
SkinH_Attach
SkinH_Attach_Ex
SkinH_Attach_Ext
SkinH_Attach_Res
SkinH_Attach_ResEx
SkinH_Detach
SkinH_Detach_Ex
SkinH_DisMove
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_TitleMenuBar

Sections

UPX0
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 79KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qqct/config.xml
.xml
qqct/data.xml
.xml

Sharing

General

Malware Config

Signatures

Files

3b7bdace2c4e8626bc3045142fd9df74

Headers

File Characteristics

Imports

skinh

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

urlmon

psapi

wininet

shlwapi

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 173KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 52KB - Virtual size: 67KB

.rsrc Size: 32KB - Virtual size: 30KB

.reloc Size: 28KB - Virtual size: 27KB

8243598379bf73aaa7dae9b6f32ca4d5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

gdiplus

winmm

wininet

Exports

Exports

Sections

.text Size: - Virtual size: 481KB

.rdata Size: - Virtual size: 108KB

.data Size: - Virtual size: 29KB

.rsrc Size: 114KB - Virtual size: 130KB

.vmp0 Size: - Virtual size: 49KB

.vmp1 Size: - Virtual size: 30KB

.tls Size: 512B - Virtual size: 24B

.vmp2 Size: 403KB - Virtual size: 402KB

.reloc Size: 512B - Virtual size: 284B

4e46f1e9cfb076432dd8ccc7b6286c6d

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 1.2MB

Headers

File Characteristics

.text
Size: 176KB - Virtual size: 173KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 52KB - Virtual size: 67KB

.rsrc
Size: 32KB - Virtual size: 30KB

.reloc
Size: 28KB - Virtual size: 27KB

.text
Size: - Virtual size: 481KB

.rdata
Size: - Virtual size: 108KB

.data
Size: - Virtual size: 29KB

.rsrc
Size: 114KB - Virtual size: 130KB

.vmp0
Size: - Virtual size: 49KB

.vmp1
Size: - Virtual size: 30KB

.tls
Size: 512B - Virtual size: 24B

.vmp2
Size: 403KB - Virtual size: 402KB

.reloc
Size: 512B - Virtual size: 284B

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 1.2MB

UPX0
Size: - Virtual size: 132KB

UPX1
Size: 79KB - Virtual size: 80KB

.rsrc
Size: 2KB - Virtual size: 4KB