YoMan[.]exe | Triage™

General

Target
YoMan.exe
Size 29KB
Sample230202-g2zskshb5v
SHA256 3e773f83fb48a9dfc7a98a43064428e85294f7e5766c7c2b6697d53afcceecb1
MD5 8aa02c96f185309c145121b445c205d6
SHA1 74d8022bc65cbc2a9374f0bf65ed11801f7c9d68
SHA512 b5f3ceda3e7d75ca562aa21c814d20b9af611e5cf5a51e39b092d652bc49aaaaec918eafb6ef7a61ccb539c89ef4b2659be2d7f0fdd21875f03efcfcc55ce73b
SSDEEP 768:mfQAfpeBfCWg1se7MdL2FnMVXTyPaYJcPxSmOg+Q:qVfpeBfCWgRMdL2F86nJuOq
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

YoMan.exe

.exe 29KB

YoMan.exe

IMPHASH 2991d48c2893a40c371ed5cff9e815f7
SHA256 3e773f83fb48a9dfc7a98a43064428e85294f7e5766c7c2b6697d53afcceecb1
MD5 8aa02c96f185309c145121b445c205d6
SHA1 74d8022bc65cbc2a9374f0bf65ed11801f7c9d68
SHA512 b5f3ceda3e7d75ca562aa21c814d20b9af611e5cf5a51e39b092d652bc49aaaaec918eafb6ef7a61ccb539c89ef4b2659be2d7f0fdd21875f03efcfcc55ce73b
SSDEEP 768:mfQAfpeBfCWg1se7MdL2FnMVXTyPaYJcPxSmOg+Q:qVfpeBfCWgRMdL2F86nJuOq
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

17030

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle ExitProcess GetFullPathNameA Process32First OpenProcess Sleep GetProcAddress VirtualAllocEx Process32Next GetModuleHandleA CreateToolhelp32Snapshot WriteProcessMemory WaitForSingleObject ReadProcessMemory TerminateProcess SetConsoleTitleA VirtualProtectEx GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent GetLastError GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter EncodePointer DecodePointer InterlockedExchange InterlockedCompareExchange HeapSetInformation

user32

FindWindowA

msvcp100

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?_BADOFF@std@@3_JB ?_Xout_of_range@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Xlength_error@std@@YAXPBD@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?id@?$codecvt@DDH@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ??Bid@locale@std@@QAEIXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

msvcr100

system fputc rename ??1bad_cast@std@@UAE@XZ ??0bad_cast@std@@QAE@PBD@Z ??0bad_cast@std@@QAE@ABV01@@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@ABV01@@Z memmove _unlock_file ungetc fgetpos _fseeki64 memchr fflush fgetc fsetpos setvbuf _lock_file rand srand ??3@YAXPAX@Z memcpy_s fwrite fclose _time64 exit ??2@YAPAXI@Z __CxxFrameHandler3 _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook _except_handler4_common ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s memcpy memset _CxxThrowException

Sharing