Static task
static1
Behavioral task
behavioral1
Sample
Qqunpizan/Q群批赞4.0.1.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Qqunpizan/Q群批赞4.0.1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Qqunpizan/河源下载站-cngr.cn.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Qqunpizan/河源下载站-cngr.cn.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Qqunpizan/淘宝热卖.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Qqunpizan/淘宝热卖.url
Resource
win10v2004-20241007-en
General
-
Target
3a637788e862e4ff438f7fc0ea24f188_JaffaCakes118
-
Size
1.6MB
-
MD5
3a637788e862e4ff438f7fc0ea24f188
-
SHA1
a51c9b3cf61db38ac82ca0085e4ef71d7ec3744b
-
SHA256
8cde6a8c0f5ae4e12eefc74188907cf9c3e283cc5c719b6c9683968bd666bdef
-
SHA512
9e99c1402045751b97b107c6a3a177a9aaf177e89884d0b391ec37a0b2ee895c877d3ae81f799cb03fcabfc21c8b75114c3dc0a82828f8d8b636e785f5f4b969
-
SSDEEP
49152:XUkc2XobnJTni4DDNIAkAZ0uVlFjuNbz6dAp:EfjTnzDNIAkANq4mp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Qqunpizan/Q群批赞4.0.1.exe
Files
-
3a637788e862e4ff438f7fc0ea24f188_JaffaCakes118.rar
-
Qqunpizan/Q群批赞4.0.1.exe.exe windows:4 windows x86 arch:x86
2f4e79d90f88c725acc06d90f2a47758
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
rasapi32
RasHangUpA
iphlpapi
GetAdaptersInfo
winmm
midiStreamRestart
ws2_32
htons
user32
OpenClipboard
gdi32
ExcludeClipRect
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
DragFinish
ole32
StgCreateDocfileOnILockBytes
oleaut32
SafeArrayGetElement
comctl32
ord17
oledlg
ord8
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseFontA
Sections
.text Size: 1.6MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Qqunpizan/河源下载站-cngr.cn.url.url
-
Qqunpizan/淘宝热卖.url.url