AlphaBlend
GradientFill
TransparentBlt
Overview
overview
7Static
static
7IPShow.dll
windows7-x64
3IPShow.dll
windows10-2004-x64
3MSIMG32.dll
windows7-x64
3MSIMG32.dll
windows10-2004-x64
3QQFun.dll
windows7-x64
3QQFun.dll
windows10-2004-x64
3QQHook.dll
windows7-x64
3QQHook.dll
windows10-2004-x64
3QQStatus.dll
windows7-x64
3QQStatus.dll
windows10-2004-x64
3新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1IMRecord.dll
windows7-x64
3IMRecord.dll
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
IPShow.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
IPShow.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
MSIMG32.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
MSIMG32.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
QQFun.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
QQFun.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
QQHook.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
QQHook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
QQStatus.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
QQStatus.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
新云软件.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
IMRecord.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
IMRecord.dll
Resource
win10v2004-20240709-en
Target
7621a0916384bf1f9fd8c5cd57d03b57_JaffaCakes118
Size
276KB
MD5
7621a0916384bf1f9fd8c5cd57d03b57
SHA1
8a496b4292460f99041176a649ea9c3967e3ffbf
SHA256
1e329e534086a23fc6a02b244c86e172d4a347b96dd4d430f465f22009540fc1
SHA512
9e1d5935ea63c0f81e8189f13d34d6bfe3c580606446cee1db951a80a4041e0cc73055bc30a57157f8f9abee8975fce2c397a86002a5dae68ddd913ea60ced89
SSDEEP
6144:tXWzM80W9WNq45HV1XiOXmIZNIlmkvPwwK8Ee0Fa+:5U0W9WzRVZifIPcmkU8FEv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack001/IPShow.dll | acprotect |
static1/unpack001/MSIMG32.dll | acprotect |
static1/unpack001/QQFun.dll | acprotect |
static1/unpack001/QQHook.dll | acprotect |
static1/unpack002/QQStatus.dll | acprotect |
static1/unpack003/IMRecord.dll | acprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/IPShow.dll |
unpack001/MSIMG32.dll |
unpack001/QQFun.dll |
unpack001/QQHook.dll |
unpack002/QQStatus.dll |
unpack003/IMRecord.dll |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
AlphaBlend
GradientFill
TransparentBlt
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
QQFunMainWindowCall
QQFunMainWindowControl
QQFunRegisterBuddyMessageWindow
QQFunRegisterGroupMessageWindow
QQFunRegisterHookCallback
QQFunRegisterHookMessageWindow
QQFunRegisterLoginFinishNotifyCallback
QQFunRegisterMessageNotifyCallback
QQFunUnRegisterBuddyMessageWindow
QQFunUnRegisterGroupMessageWindow
QQFunUnRegisterHookCallback
QQFunUnRegisterHookMessageWindow
QQFunUnRegisterLoginFinishNotifyCallback
QQFunUnRegisterMessageNotifyCallback
SysChooseColorEx
SysChooseImageFile
TencentAboutCall
TencentAgreementCall
TencentSwitchCall
_AutoPostChangeStatus
_AutoPostChangeText
_AutoPostInit
_AutoPostUnInit
_ChangeCaptionStatus
_ChangeIPAddress
_ConvertGenderToStr
_GetAddressKernel
_GetCachePath
_GetCameraHook
_GetClientName
_GetCommonPath
_GetGUIDString
_GetIPAgent
_GetIPCacheFile
_GetIPLanMemory
_GetIPSettings
_GetIPTimeout
_GetIconHook
_GetIconHook2
_GetImageHook
_GetMarkHook
_GetMsgHook
_GetNowTime
_GetPluginName
_GetPluginPath
_GetProcAddr
_GetProcessCount
_GetRunFile
_GetRunName
_GetRunPath
_GetRunTime
_GetSessionCount
_GetSessionHook
_GetSessionHook2
_GetSettingFile
_GetSettingFull
_GetSettingInfo
_GetSettingXero
_GetStatusHook
_GetStatusName
_GetStatusNumber
_GetVIPHook
_GetVerAtom
_GetVerByte
_GetVerCode
_GetVerHook
_GetVerMajor
_GetVerMinor
_GetVerProc
_GetVerSave
_GetVerSet
_GetVerSys
_GetVerTemp
_GetVerText
_GetVerTime
_GetVerUser
_IsAutoMemory
_IsAutoPostOK
_IsCameraHook
_IsClientLogin
_IsClientType
_IsIconShow
_IsImageHook
_IsKillPlugin
_IsMsgApply
_IsMsgBuddy
_IsMsgGroup
_IsMsgSystem
_IsOffMessage
_IsPluginKill
_IsQQBuddy
_IsQQNumber
_IsQQOnline
_IsQQOpenBuddy
_IsQQOpenSession
_IsQQWindows
_IsServiceHook
_IsStatusHook
_IsStatusShow
_IsTextAfter
_IsUpdateTime
_IsVIPHook
_IsVersionHook
_IsWheelTop
_PostQQUserNumberAutoMessageText
_QueryBuddyCombineA
_QueryBuddyCombineW
_QueryBuddyGender
_QueryBuddyMailA
_QueryBuddyMailW
_QueryBuddyMainA
_QueryBuddyMainW
_QueryBuddyMarkA
_QueryBuddyMarkW
_QueryBuddyMobileA
_QueryBuddyMobileW
_QueryBuddyNameA
_QueryBuddyNameW
_QueryBuddyNickA
_QueryBuddyNickW
_QueryBuddySplit
_QueryBuddyVersion
_QueryBuddyWindows
_QueryGroupClassA
_QueryGroupClassW
_QueryGroupCode
_QueryGroupCombineA
_QueryGroupCombineW
_QueryGroupCreate
_QueryGroupNameA
_QueryGroupNameW
_QueryGroupNumb
_QueryGroupQQCombineA
_QueryGroupQQCombineW
_QueryGroupQQGenderA
_QueryGroupQQGenderW
_QueryGroupQQNameA
_QueryGroupQQNameW
_QueryGroupQQStatus
_QueryMessageTextA
_QueryMessageTextW
_QueryMessageTime
_QueryQQBuddyArrayCount
_QueryQQBuddyArrayErase
_QueryQQBuddyArrayInit
_QueryQQBuddyArraySize
_QueryQQBuddyArrayToBufferArray
_QueryQQBuddyArrayUnInit
_SetAtferStatus
_SetCameraHook
_SetCameraStatus
_SetFreeMemory
_SetFuckStatus
_SetHelpLoader
_SetIPAgent
_SetIPCacheFile
_SetIPLanMemory
_SetIPSettings
_SetIPTimeout
_SetIconHook
_SetIconHook2
_SetIconLoader
_SetIconStatus
_SetImageHook
_SetImageStatus
_SetKernelHook
_SetMarkHook
_SetMemoryStatus
_SetMsgHook
_SetPluginDisable
_SetPluginEnable
_SetPluginLoader
_SetPluginStatus
_SetServiceStatus
_SetSessionHook
_SetSessionHook2
_SetStatusHook
_SetStatusStatus
_SetTopStatus
_SetUnKernelHook
_SetUpdateStatus
_SetVIPHook
_SetVIPStatus
_SetVersionStatus
_SetWindowShow
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Loader
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IsPassword
IsPasswordEmpty
IsPasswordLength
QQFunViewRecord
ReadPassword
RemovePassword
WritePassword
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE