Behavioral task
behavioral1
Sample
yjbz.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
yjbz.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
yjbz_gb.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
yjbz_gb.exe
Resource
win10v2004-20231215-en
General
-
Target
0abb892fddc7ed9e49c6d8ee38ad34c1
-
Size
1.3MB
-
MD5
0abb892fddc7ed9e49c6d8ee38ad34c1
-
SHA1
313b55c1eba8bf0fb60644a4c5ef481dcc8a81d6
-
SHA256
10a53bb25aa901cb0b850cf352cf96fd953d6f3d69e5504189674de0e71bf20d
-
SHA512
47ca59f7dba66fbd639954acaadf6b2051e0e57a49ca484e996a7f2f431f38f2aae6b36c18433585ca88480aeacaacfe4bcfbb0339bc2d477ebf5815c5796691
-
SSDEEP
24576:X5MIfN8dwxLX3No9T1z5axWgpbSi4fbAEHiTtujzXp6Vj2kaXegz3q57bwQZ8j:JMqQwxLX9o9T/0Tpbqc5+z51aqQZY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/yjbz.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/yjbz.exe unpack001/yjbz_gb.exe
Files
-
0abb892fddc7ed9e49c6d8ee38ad34c1.rar
-
yjbz.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 556KB - Virtual size: 556KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.snaker Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
yjbz_gb.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
使用说明.txt