Behavioral task
behavioral1
Sample
QQ飞车保镖[稳定刷边境][全模式加速度][秒杀剧情任务][刷全商城东西]3.25[A版].exe
Resource
win7-20240729-en
General
-
Target
c9276535d25568fb08647a4d7671a6e6_JaffaCakes118
-
Size
1.3MB
-
MD5
c9276535d25568fb08647a4d7671a6e6
-
SHA1
39370719f0fc576c7d969195fca5d0fef23dbcd3
-
SHA256
e7db50e060ff36315b3d9916183ef08d189197a65453aeb2aebf22d103f48243
-
SHA512
7e4ea8e3cb08d25cfa82e68a4ebdada3d5c9174abe4f0346b542103ad4f2666b61f50be63ecf172a08e7d5b3a50b7caa0594c715cf2939be193495a29fa1fc5a
-
SSDEEP
24576:O+zbhBR73vWqpxxX1fWXK/2xkQo2VVVnoSth0xr0B85YwKk98gMFLp:O+zt35xX1dMvl9t2+GfLEFLp
Malware Config
Signatures
-
resource yara_rule static1/unpack001/QQ飞车保镖[稳定刷边境][全模式加速度][秒杀剧情任务][刷全商城东西]3.25[A版].exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QQ飞车保镖[稳定刷边境][全模式加速度][秒杀剧情任务][刷全商城东西]3.25[A版].exe
Files
-
c9276535d25568fb08647a4d7671a6e6_JaffaCakes118.zip
-
QQ飞车保镖[稳定刷边境][全模式加速度][秒杀剧情任务][刷全商城东西]3.25[A版].exe.exe windows:4 windows x86 arch:x86
97076c9b43cbe054e71751ed7de8cf73
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
MulDiv
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetWindowPos
MessageBoxA
gdi32
SetViewportOrgEx
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CoFreeUnusedLibraries
oleaut32
SysAllocStringByteLen
comctl32
ord17
oledlg
ord8
ws2_32
recvfrom
wininet
InternetConnectA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 548KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ