'�x���s�@1u�7��L@�R;��:�bQ��[�� ��_ѫ�B-0�ba����"������A�$�v'�`��Z���.&�g�t�)b���J��'ؐSo���9"�{�E�K+���c���#���O��� ����,�����?A"E�T��A*�R^q�!б`K��3 ࣽH����W��be�Κ=gX�?b���^T��;Zj����=z}�V��B-�$q@�k��=�d��B�^��^2rHҒ<��f�I�����JM�ƕ5���&�4=�(�N�pSH��ҥ �3��X� o���6�uI} �*����!��v��`�y]k��`$Ӣ��,wB��~ҫ�bm5�b|5�%�(��Q��\������8�bP����m�'m��AZ����H#.� ���8��w�n���ۿ�o�D芉���~;Y�S��Im��G1�Qr���^}gHRy�<����11fh2�E�l����� aQ��rH����2K������{u@�B��R�K(��-SSa%z���T,S&��c o���%�:�q�-�;���!�Ȃ��Q��V��e�$TeҞ��]��8�r���O�R�ăk���W~�V2������ڿ�NM/�D*8��=�NZ���Èb �s�k��(� (�<ӕ^v%^�d���Ch>� �s@q�#,��W�� oY4y���*:g��#$�d&e4�aj���sS�-��B�D&���K�����840��|�$��f&��%����+��]�^�4�N�b=��K5>9�[-gl"�p�<����Gv ������^��h$�D/�?����bӯ_���4 �!���'9��9>������桳��a���^C��- ��d�P�� (O7}k���_M�4��U�M,nHI\����� �W�=ƖON�UR��� 't���w�k���ʄ���$�r������?8�f)�\c�� ���A�v�Xk ��H�]�)�"Z=e�u�~���[╾�>Fk�s�"�#�ȋ�G�]�)S=HWU����$ ���`��<��8��)�Si�kN�����ZO�ʟ��룠�e�_&��Ș��#�LU�?�ӽb�LS���j����_8C~���A��ңq�q�^�t�[#%� &�=,����v�'��4�F�{���P<H$� |=�i���a���p5��cV����K�[S�;��=�XƈE�E���dв���c�8�����Ѩ�bvɐ�I���W1����Ӭ@k��5;�r�j�!�G�$Ⱦ��R|5�|`86xJR��s �c �����[F���|Q�;(�*�����u�Qs���L+X���rm}o�EB��^�ns4N/-)}�@x��S���%�|�'r*K�������Έt�5|hk�3ِ}���ܺ����`�-/0 L�����fn��ԕO4훱^��+�.m��U��y��+�i���Q�8����ܑ�PAJ�)n*ѧ���lD7��kKJ�o�څXu/Q�ɔsV��,�Q�e�� �/�~Y�8��#�7��FG�V9�Y6�0c)�п@3y�U j�r'�۾?ν�"�f������e���m�sX�s��)��W��l�4Aw��G�l�-ǽ2x'��"�v��2k��Gh?�MO��n3� ���w}eo�r��թ\`����(I�:�ּr��#�d�;uGU����Qv�@�P�䉺>)h�{�<WHd��cF8,��!�*���� w�h$��qXUWji��~95O�:��+��^��)&�_��v4�8����v�&b�����@sF� ~��GQ��/�)�9n�}�j�<a��z���iD<зb]��ʋrHq���T<_�����.��Z;q O*�uКb����^:SM�IB��t�f��T�r�֙�<��LA�@��3�>����C���}�l*l�\?��ez~!7lmi��܅�^�+#��DvTo��ՙiT�S ���<�P~\0��w�H[͎L�t�v{o���������m�YC�(N�ZR�H�T�1�'��s�4ߠ�=$���)�$qa� ��/~l�E�deb���ޱ�24J�z��!9�u�l��$�)��A�r�'�[tc�Y36N>��t��Q^�X!>��]~�>y��]����IMk���!�[����Ckt+J庢hqP�g�C�v��k��A�_MT�VPg\�<�C�D�|��h��tt6�jS������l0�U9ꇸ���`�Z�Ҽ��к��� _ ���΄��2�Lr �ߚ#IL+�τI`C.S�I���D ]?�DFt �1���L�R*� 6rΐl眱� C ���E��mx�碶��l5;���� �*���`���@{� �>��L�5���`��ؤ�Zx��b�Q��V��п0�T�K�mPT,�T��GP�k|F�EΧ6ds� �#��e��\os1uq}�1+h߷�zjQ�Qი�L�6�1���3$���H[�昇2D;o� (,V����٥����r����Z7!� �59�!%�D9Sf�9�:4�:��Ǡ��b�faH�{���z�����K�Q�H�,Ǫ��,ҁ�&~3����R���%�"sLX��uE̖X�BG�+�D���)s� ����BRd� �P����:)t�[��\ڀ���2�����Ӧ�-|l�7pk%�c3����^46S���y�Z���Gg ���fzP^'��9XJ�y���;���SaW�F.��v������ZP�KU�H3|�\<���=%�'~?�z�T��e�����r���d��zq��i��7\�����t}�;ߪ�3�����/P įc1� 1N�S�8Xt��B����A0Q� �b��ۛ<`dܥ!�]6Z� 8��?fh�H�r$-�h[B(������'t㱩��M����VڙG#��uk$���Ņ�5�B1=P1и����}��rL���WB���vt��g��������=|��➮�Ϩi*�_�&����� ��Q���;��41������1� ���ō���$�>����dE��i����f[�^v��������83��f{��0
Behavioral task
behavioral1
Sample
qqxw_dtq/ѧô V3.0.8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
qqxw_dtq/ѧô V3.0.8.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ɫ-ҳ.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ɫ-ҳ.url
Resource
win10v2004-20240802-en
General
-
Target
126cc56b895369b1e0385d13165617ec_JaffaCakes118
-
Size
1.9MB
-
MD5
126cc56b895369b1e0385d13165617ec
-
SHA1
0cf769a51a23eb5756c4074226883c22926730b0
-
SHA256
e42014a57aaf7f82c5ff749daeb106f1984f9b9980635dcd6b01b7a95abfc7ff
-
SHA512
6cc030f61be876ba5149dfa590225a2ac125b5f0925eb74f994f51f397b36ccab5565949fa8ae49a3bca20d70112e87a7031730a56abda273a439d7c43378e03
-
SSDEEP
49152:5DFHlTs4HXmjlv4631KjFLvfmD5PNcuNxFkr9J:5V5JgAQ4lnmpOuHWBJ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/qqxw_dtq/ѧô V3.0.8.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/qqxw_dtq/ѧô V3.0.8.exe
Files
-
126cc56b895369b1e0385d13165617ec_JaffaCakes118.zip
-
qqxw_dtq/ѧô V3.0.8.exe.exe windows:4 windows x86 arch:x86
4568ba78d6db41882f74ce9a6c837085
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
ImageList_SetIconSize
imm32
ImmInstallIMEA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
װؿ.txt
-
ɫ-ҳ.url.url