Behavioral task
behavioral1
Sample
ys-v1.2/亦思屏幕录像截图专家v1.2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ys-v1.2/亦思屏幕录像截图专家v1.2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
ys-v1.2/新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
ys-v1.2/新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
585f99fcaeb942f04bb2fb471856284e
-
Size
987KB
-
MD5
585f99fcaeb942f04bb2fb471856284e
-
SHA1
de421e025a3b58c431ec76fcdc079d265e674011
-
SHA256
c4791e0d762b660f99b5c00d7aeca57b7fa4bdb9202a8c929492e7edbb31e26e
-
SHA512
7def9cffe4e8bba50bfa89d347a89adf4ccda75bb23f38a7620900b672f80e8f0fcae173be95f0ca58b51b21c94dd42c4d605316556df9b17954024fadb00773
-
SSDEEP
24576:spAKegUII4/Pjt84iNjnapIrvXzcNeGPSVj7grRqoUIaFEDc:sKFgUZ4+4o4MvDpJ744oA
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ys-v1.2/亦思屏幕录像截图专家v1.2.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ys-v1.2/亦思屏幕录像截图专家v1.2.exe
Files
-
585f99fcaeb942f04bb2fb471856284e.rar
-
ys-v1.2/亦思屏幕录像截图专家.jpg.jpg
-
ys-v1.2/亦思屏幕录像截图专家v1.2.exe.exe .ps1 windows:4 windows x86 arch:x86 polyglot
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.ASPack Size: 512B - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ASPack Size: 365KB - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ys-v1.2/使用说明.txt
-
ys-v1.2/新云软件.url.url