Behavioral task
behavioral1
Sample
PetLoveQQ/636网址导航.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PetLoveQQ/636网址导航.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PetLoveQQ/Q宠大乐斗管家辅助v11.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
PetLoveQQ/Q宠大乐斗管家辅助v11.5.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
PetLoveQQ/统一下载站.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
PetLoveQQ/统一下载站.url
Resource
win10v2004-20240802-en
General
-
Target
15799f6fd4a4f4e81379005c461e2def_JaffaCakes118
-
Size
1.4MB
-
MD5
15799f6fd4a4f4e81379005c461e2def
-
SHA1
4a86db98fe076cc4152bcdba9d293600d32a7f25
-
SHA256
00dc7f3cebfab39f8e9e4b47c270251b82e7bfbaaf3105a79890d8ff86b63cbe
-
SHA512
2906d4169c482f0076f8da9e301ce5ab7b50323c395df8b279d983edd0f5bd37dca190087c4a5af75779140d82b92a210c264e0f16cf1308819db5fd89f5e1e4
-
SSDEEP
24576:MReWosvCmrJsqUibXZsXv40KqZWwWbqE9ph7esr9VeoLT3XIZGk/pF6o8aPJnD:qZzYizOf4LiWBbqE5r9Ve6XIZt6vEJnD
Malware Config
Signatures
-
resource yara_rule static1/unpack001/PetLoveQQ/Q宠大乐斗管家辅助v11.5.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PetLoveQQ/Q宠大乐斗管家辅助v11.5.exe
Files
-
15799f6fd4a4f4e81379005c461e2def_JaffaCakes118.rar
-
PetLoveQQ/636网址导航.url.url
-
PetLoveQQ/Q宠大乐斗管家辅助v11.5.exe.exe windows:5 windows x86 arch:x86
9f414ae1985807acfdc59ae559b800a7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileType
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawStateA
gdi32
ScaleWindowExtEx
winmm
waveOutOpen
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CoRevokeClassObject
oleaut32
VariantTimeToSystemTime
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
accept
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 848KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 297KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 289KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 943KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
PetLoveQQ/UeKc.edb
-
PetLoveQQ/打开程序图标或者软件不见了必看.txt
-
PetLoveQQ/统一下载站.url.url
-
PetLoveQQ/说明.txt