qakbot[.]zip | Triage™

General

Target
qakbot.zip
Size 326KB
Sample260903-bb4e7a1xhs
SHA256 c00509708544294aa89ef7bd500dc735a5ffc314433474548357bae516598d01
MD5 9da7b165e28cbfa15429974335599158
SHA1 9a8b6005e40bfc97b5d0070da7f49955bbf10acc
SHA512 47a38b69a5ef9df1001274e510d94ddcdfa62d260946519f2ac48937b770b10bea690e7db157e0ff81e3efa189931ed8b7f572cfebb7b3f0202426068647b764
SSDEEP 6144:TyOQBHbXj7QfSy+Yre/G1M1UaiIJqXyVjy9RyWNDoiHuLKWDh4q:THQHbz0f7BrwGWUapJqXKjy9T9iKWGq
TLSH
T1F46423D0540122F70F6AD53CB4E04E1BAB19795D54042CEA9528EAA1FBEE3627CBF391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
unpack001/0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118

File Explorer

qakbot.zip

.zip 326KB
0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118

.exe 5.9MB

qakbot.zip

SHA256 c00509708544294aa89ef7bd500dc735a5ffc314433474548357bae516598d01
MD5 9da7b165e28cbfa15429974335599158
SHA1 9a8b6005e40bfc97b5d0070da7f49955bbf10acc
SHA512 47a38b69a5ef9df1001274e510d94ddcdfa62d260946519f2ac48937b770b10bea690e7db157e0ff81e3efa189931ed8b7f572cfebb7b3f0202426068647b764
SSDEEP 6144:TyOQBHbXj7QfSy+Yre/G1M1UaiIJqXyVjy9RyWNDoiHuLKWDh4q:THQHbz0f7BrwGWUapJqXKjy9T9iKWGq
TLSH
T1F46423D0540122F70F6AD53CB4E04E1BAB19795D54042CEA9528EAA1FBEE3627CBF391
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118

IMPHASH 5648ee902884284c0765394653b8daaf
SHA256 66d36ffbcdd8919b6527110a03fe917c1e47dac123778945305b3baa395631f0
MD5 0fb531c7f6e841e36cefbaff58c70949
SHA1 3d50ffcef573588c637020ce3f41dd13b14b35f4
SHA512 9c29540a4bd9a22f8f68e41a02c0935602afbd7c4db6171ae8fd45b2b3894d43a78d7c40d2908cf347923d34a7bb2b9b90d9c003996117c9f12ab7d648162eab
SSDEEP 6144:1PIpEvUeazs9JSMeyUPFlsy4SEUY3V2kz5t8FF9SSl9sciUNhK0:BIpqdaNMeyUPFlR4SEU+VpdITiU3b
TLSH
T16C56549215C37F8ED31A3AF1257A12E23F518B4850EE446DC878FE54EE0B9BD908A747
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

Password

infected

PE Signature issue

Digest

4e:81:91:35:41:fa:c8:1d:a2:c2:4c:4d:4c:fc:c4:83:58:79:62:bd

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=IOCRSIHZPSQUIZFOZQ

Chains

Aug 26, 2026

CN=IOCRSIHZPSQUIZFOZQ

Minor OS version

0

Major OS version

5

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

qakbot.zip

0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118

PE Signature issue

kernel32

advapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

qakbot.zip

0fb531c7f6e841e36cefbaff58c70949_JaffaCakes118

PE Signature issue

kernel32

advapi32

generic