Static task
static1
Behavioral task
behavioral1
Sample
QiDian/QiDian.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
QiDian/QiDian.exe
Resource
win10v2004-20240709-en
General
-
Target
4cde7986552b25a33448b1c1432b67b0_JaffaCakes118
-
Size
15KB
-
MD5
4cde7986552b25a33448b1c1432b67b0
-
SHA1
4a39e1e0bd14f5aa70ce62f0ab0c9519518df2d7
-
SHA256
e9816a94b754018daede08e9ac146f3befc8916f59d9594974f4367e35f40ebc
-
SHA512
3d9686bfc426bf2d1290177b06262278ba390a84032289e0346a906b628e3c4efff67300f1cc27cc913e11f70302db29d6df12daab87aa60ad9cbeef044d48ee
-
SSDEEP
384:iGwOm6I0qdhueUP0AXvJHRgqnJsYEOyVx+WqwhHVR:iGwOm6qbue+0kJHpsK24xkHv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QiDian/QiDian.exe
Files
-
4cde7986552b25a33448b1c1432b67b0_JaffaCakes118.rar
-
QiDian/QiDian.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE