e:\p3d_branch\QQPets3D1.0Beta6Build307\PDB\Release\QQPetBear.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8e33aa83d2a4757760af0bc4f222e66c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8e33aa83d2a4757760af0bc4f222e66c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8e33aa83d2a4757760af0bc4f222e66c_JaffaCakes118
-
Size
386KB
-
MD5
8e33aa83d2a4757760af0bc4f222e66c
-
SHA1
da69f62813bc879c2874d05cf7515fa95317df01
-
SHA256
90dff6861dfa32cc482ebedea0b4d4293521c493e46d2f29473e6694f031706d
-
SHA512
5289b429eef1287e3e505c776c6c7c5b04bc385ce919c3e413c312fa127f0f1bccd11d0e600c99465e2f0b6a4a0c150fd76d853cbc2a3b19b58711e6e0466c29
-
SSDEEP
6144:E3EYWKIsPUBgz0XaJCYjOaB2E2fx8LUwQKlomm6bEPSp9SpRV+ZV:E3xWKIEsgmaJgZwpBW2qC3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e33aa83d2a4757760af0bc4f222e66c_JaffaCakes118
Files
-
8e33aa83d2a4757760af0bc4f222e66c_JaffaCakes118.exe windows:4 windows x86 arch:x86
a0cfc502943d26d193f5da2cdf166350
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetPrivateProfileStringA
CloseHandle
GetLastError
LoadLibraryA
FreeLibrary
CreateDirectoryA
OutputDebugStringA
DeleteFileA
RemoveDirectoryA
GetFileAttributesExA
WritePrivateProfileStringA
CreateProcessA
FindClose
FindNextFileA
GetModuleHandleA
GetPrivateProfileIntA
FindFirstFileA
GetPrivateProfileSectionA
SetCurrentDirectoryA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
GetLocalTime
SetUnhandledExceptionFilter
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetFileAttributesA
FindFirstFileExA
InterlockedExchange
GetSystemInfo
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
SetFileAttributesA
user32
KillTimer
SetTimer
GetSystemMetrics
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
SetClassLongA
LoadIconA
PtInRect
DefWindowProcA
FindWindowA
GetActiveWindow
CreateWindowExA
AdjustWindowRectEx
ChangeDisplaySettingsA
RegisterClassExA
LoadCursorA
PostQuitMessage
GetDesktopWindow
LoadImageA
MessageBoxA
GetWindowRect
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
shell32
SHGetFolderPathA
commclient
??0SERVICES_ROOM_ID@@QAE@XZ
??0RS_GET_EACH_FRIEND_STATE@@QAE@XZ
??1RS_GET_EACH_FRIEND_STATE@@QAE@XZ
??1SERVICES_ROOM_ID@@QAE@XZ
?IsNeedInitConfig@InstOfSoDataMgr@@QAE_NABUQQ_PET_INFO@@@Z
?instance@InstOfSoDataMgr@@SAPAV1@XZ
?cleanup@InstOfSoDataMgr@@SAXXZ
??1RS_FED_BUY_ITEMS@@QAE@XZ
?GetPetID@PET_ID_RESULT@@QBEXAAUPET_ID@@@Z
??0RQ_QUERY_WEATHER_REPORT@@QAE@XZ
??1RQ_QUERY_WEATHER_REPORT@@QAE@XZ
??0QQ_PET_INFO@@QAE@XZ
??1QQ_PET_INFO@@QAE@XZ
??1PET_ID@@QAE@XZ
??0PET_ID@@QAE@XZ
??1SVC_SVR_INFO@@QAE@XZ
msvcp80
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?length@?$char_traits@D@std@@SAIPBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
winmm
timeEndPeriod
timeKillEvent
timeSetEvent
timeGetTime
timeBeginPeriod
shlwapi
PathAppendA
msvcr80
atoi
vsprintf_s
_itoa_s
__argc
_stricmp
__argv
_access
strchr
strrchr
_snprintf_s
strcpy_s
_purecall
_mbsnbcpy_s
_mbschr
strcat_s
_vsnprintf_s
_mbsrchr
sscanf_s
fseek
ftell
malloc
rewind
fread
??_V@YAXPAX@Z
fopen_s
fclose
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
free
memset
sprintf_s
??3@YAXPAX@Z
_mbscmp
_set_invalid_parameter_handler
_controlfp_s
_localtime64_s
_close
strftime
_fstat64i32
??0exception@std@@QAE@ABQBDH@Z
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
realloc
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
memcpy_s
_aligned_malloc
_aligned_free
_aligned_realloc
_sopen_s
dbghelp
MiniDumpWriteDump
Exports
Exports
CreateInterface
GetMemAlloc
GetServiceInterfaceManager
ReleaseInterface
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tvmp Size: 720KB - Virtual size: 724KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE