Behavioral task
behavioral1
Sample
QQ飞车小子变态加速0107-2版.exe
Resource
win7-20240903-en
General
-
Target
2516f8588db1c31e8cdbb2485be360a1_JaffaCakes118
-
Size
1.0MB
-
MD5
2516f8588db1c31e8cdbb2485be360a1
-
SHA1
bfa195a89b69646a6939b62ed86819dba874333c
-
SHA256
6186ae8b8c0528bf1e7dd22b5128644f3bb8992d74b17872fe8517481ac1e927
-
SHA512
62d1d552f1d694336a127d065e78f982d2c8640817cdcf7eb60e70f9303ca2e8bd8c28dd298f1f8badfae491cbc9fc8718fe992e2e4e47774845f21ac7ee75e5
-
SSDEEP
24576:A6ztccN+ziiNPXn9lnXRYdt+vfIVGJAM6XkgIciY6xS:AiicN+ziqPX9lnXRYdt+vfIVWABk1ju
Malware Config
Signatures
-
resource yara_rule static1/unpack001/QQ飞车小子变态加速0107-2版.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QQ飞车小子变态加速0107-2版.exe
Files
-
2516f8588db1c31e8cdbb2485be360a1_JaffaCakes118.rar
-
QQ飞车小子变态加速0107-2版.exe.exe windows:4 windows x86 arch:x86
44dadea9dca9385aff7e8b8a8c78c6d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsBadWritePtr
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallNextHookEx
MessageBoxA
gdi32
SetMapMode
winmm
waveOutClose
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
CoRegisterMessageFilter
oleaut32
UnRegisterTypeLi
comctl32
ord17
oledlg
ord8
ws2_32
accept
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 664KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 421KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1024KB - Virtual size: 1022KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE