yuki4onna[.]exe | Triage™

Resubmissions

05/01/2023, 10:35

230105-mm6v8sbf7610

12/12/2022, 12:09

221212-pbfk1sbc738

Sharing

Copy URL Twitter E-mail

General

Target
yuki4onna.exe
Size 5.8MB
Sample221212-pbfk1sbc73
SHA256 322787eaae64efff2b1a5fc2e8d7f4b9b1ad44fb075cf082ade1b2a7c5ded76e
MD5 6bdd7747ce0c482573958130ca93d1ef
SHA1 e6c5e9ea9a0634722d2842d274870d8ceff7ff43
SHA512 fa2dcb54c8543b3a0fe306a14f9b40700f6bef6410fee60aedd69a6b18ea43b7bbf5f63d1f96db4dcd05a4db7461148f5970a27fb128d78d04a55aac21536b23
SSDEEP 98304:Bs4j1PRaSQasZMIJblDH4Mdf4HTNCxbKj4v2ol6LmXg717+uqivWzC3tO4JNxlfI:VPRiasqIhlLfdoT80ZD622itz9F4
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

yuki4onna.exe

.exe 5.8MB

yuki4onna.exe

IMPHASH 5780e08c9c78220a0c99027a41bbbfa4
SHA256 322787eaae64efff2b1a5fc2e8d7f4b9b1ad44fb075cf082ade1b2a7c5ded76e
MD5 6bdd7747ce0c482573958130ca93d1ef
SHA1 e6c5e9ea9a0634722d2842d274870d8ceff7ff43
SHA512 fa2dcb54c8543b3a0fe306a14f9b40700f6bef6410fee60aedd69a6b18ea43b7bbf5f63d1f96db4dcd05a4db7461148f5970a27fb128d78d04a55aac21536b23
SSDEEP 98304:Bs4j1PRaSQasZMIJblDH4Mdf4HTNCxbKj4v2ol6LmXg717+uqivWzC3tO4JNxlfI:VPRiasqIhlLfdoT80ZD622itz9F4
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

20:7a:8c:d2:e2:10:db:af:47:84:fd:24:2d:50:38:8a:0d:ce:bf:9e:8d:54:92:11:8e:c7:d8:5d:6f:1a:35:d2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

9525609

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

WriteFile WriteConsoleW WaitForMultipleObjects WaitForSingleObject VirtualQuery VirtualFree VirtualAlloc SwitchToThread SuspendThread SetWaitableTimer SetUnhandledExceptionFilter SetProcessPriorityBoost SetEvent SetErrorMode SetConsoleCtrlHandler ResumeThread PostQueuedCompletionStatus LoadLibraryA LoadLibraryW SetThreadContext GetThreadContext GetSystemInfo GetSystemDirectoryA GetStdHandle GetQueuedCompletionStatusEx GetProcessAffinityMask GetProcAddress GetEnvironmentStringsW GetConsoleMode FreeEnvironmentStringsW ExitProcess DuplicateHandle CreateWaitableTimerExW CreateThread CreateIoCompletionPort CreateFileA CreateEventA CloseHandle AddVectoredExceptionHandler GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

CharUpperBuffW

Name

.text

Size

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.symtab

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ

Name

.text1

Size

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text2

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text3

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ