Behavioral task
behavioral1
Sample
qdradio/千度收音机.exe
Resource
win7-20240704-en
General
-
Target
8c3e203468dec5797150fc80a81ef54e_JaffaCakes118
-
Size
497KB
-
MD5
8c3e203468dec5797150fc80a81ef54e
-
SHA1
0b880bb93610a91da2ac552300df51ccb7054f89
-
SHA256
8e08e8264d21508732c51be5e0aea872b91238a25b034d6f94c1f24abc1a63cf
-
SHA512
d0181ce9a2c33b0f8eb2e5b46676e6977b9ed8779b475c121557785d9001d8f5517892589dbd426a7c68b321fd5f1fb3df3b767a2d6524491b53fbbc0b1524ed
-
SSDEEP
12288:/RWyuBMktxdQqEzCi9k/EzjFQoA9rAKkBQ1IbX+fdxO/2X:GNrdXm9kczjFQjjmQa4E2X
Malware Config
Signatures
-
resource yara_rule static1/unpack001/qdradio/千度收音机.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/qdradio/千度收音机.exe unpack002/out.upx
Files
-
8c3e203468dec5797150fc80a81ef54e_JaffaCakes118.rar
-
qdradio/千度收音机.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 972KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 496KB - Virtual size: 500KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 664KB - Virtual size: 662KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 276KB - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 429KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ