Static task
static1
Behavioral task
behavioral1
Sample
yc12/source/MAKE.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
yc12/source/MAKE.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
yc12/yC.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
yc12/yC.exe
Resource
win10v2004-20240802-en
General
-
Target
a2fb9aee40a68ab3c3e08f3ef68e53e2_JaffaCakes118
-
Size
21KB
-
MD5
a2fb9aee40a68ab3c3e08f3ef68e53e2
-
SHA1
23c0f4bc036a2045d1792b680b6078258833fd0a
-
SHA256
9526d231911a6d96a0f457dbf39bc7493ca171dbe75025d14fc82e14d5adcad1
-
SHA512
89cece9a5d9cd11a19146d9dfcb7488425173c4f149572754bb27f3687bf57ea5d7548ea037986ad8bbc28bc4c914e9d206606d11d85152880805afb1b6dc4c4
-
SSDEEP
384:RN+/DcV8eswA5XDl1NMSIZDVa8Wq+qkCrjC6+ovv0tIpnNiwQM/cEjxis:vm6r1op1OSw+wrf6WNiVM/cA9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/yc12/yC.exe
Files
-
a2fb9aee40a68ab3c3e08f3ef68e53e2_JaffaCakes118.rar
-
yc12/history.tXt
-
yc12/source/CryptStuff.ASM
-
yc12/source/MAKE.BAT
-
yc12/source/MAKE.PIF
-
yc12/source/PER.ASM
-
yc12/source/Rsrc.res
-
yc12/source/resource.inc
-
yc12/source/yC.asm
-
yc12/source/yC12src-release.txt
-
yc12/yC.exe.exe windows:4 windows x86 arch:x86
19b40acde5c7f7e93956d92dff7e793b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateFileA
ExitProcess
GetFileSize
GetModuleHandleA
GetTickCount
GlobalAlloc
GlobalFree
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
user32
CheckDlgButton
DialogBoxParamA
EndDialog
IsDlgButtonChecked
LoadIconA
MessageBoxA
SendMessageA
SetDlgItemTextA
comdlg32
GetOpenFileNameA
shell32
DragAcceptFiles
DragFinish
DragQueryFileA
imagehlp
ImageRvaToSection
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
yc12/下载说明.htm.html .js polyglot