Behavioral task
behavioral1
Sample
qzone/qzone.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
qzone/qzone.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ɫ.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ɫ.url
Resource
win10v2004-20240802-en
General
-
Target
09e38ae05cb055565db26eb164ff25a9_JaffaCakes118
-
Size
708KB
-
MD5
09e38ae05cb055565db26eb164ff25a9
-
SHA1
1940feb5f26bb6e4974929a5867ba3c08b6e4845
-
SHA256
da4a9796212be4e375002ba2ef15680e2ab6dca7f8612f5def1f041764b44ed3
-
SHA512
873c0476d1394e17b598bf35e7fe3f01d7fe4acc42d35151442c6e063a20600c74394ca4f24595b01deabeda54cbbc1a2599f3e142eda3721d110ba9d7f4e5f7
-
SSDEEP
12288:KK7x9n1adt0O5o3TanfVSzSWlja3gtSRe94co5zy6LAuXpDgi0NvzUr09:KMn1a3x5GWozSajwIKxLNpDgp9grG
Malware Config
Signatures
-
resource yara_rule static1/unpack001/qzone/qzone.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/qzone/qzone.exe
Files
-
09e38ae05cb055565db26eb164ff25a9_JaffaCakes118.zip
-
qzone/qzone.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 703KB - Virtual size: 704KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ɫ.url
-
ʹ˵.txt