��V��r�H'{^;g]a�*ٿG�N���Ow��c[ӿ�(H�?�ǻ�d���\�剛R��"o ��f�]]�t&�8J�M�r&3���K��؊$ ?��NJ�p��U��kG��3J������A���P3��P��ڠg�&<�[�8=A�7 3x��e�;����召H��_L�2a�;����֤k|�CR�Fj�<3S]��B�� �����K�z�#���\֣�Ɔ�D��A-��'GN�oE���A�>1Eؤ�D���+M�Q���&���RO�6i�C��dw�J-=C2�aO��c���*��L�����)O�z�ޘPU�f�:z�`����HYA���r�CV�|Z�� ����<�)��b�?�Q�F=��GD�x5O����ZS��R�������#9"��!����s�sq9�2{�Yd�OҦ��b�;������Tr�`=�4�\d/M[x��*J�9{��X��7�[���n��Z׀��G3��-��7��xŖ!�{��k�`UiH�a��1C����V�U��{mTmr�@��,�I��~ DS��d^N��� =�O���qj}~s��#�Lqy�Hݜ���aȠ~��������k�X�}�/I�;�.��8�wc�c'w�-A&B.j���������$x=ĕ�QI�C�T�KC1���vM`�=&�LA�CV�e�Jć] �uK����/�����6�)�.��P�1�N}@���5�چ���;ɰ/�*�F�Ǟ�킆����a����r�Z��]� �h?�}���"7�5(�vfs3���nQ�z00��5�qBY2҈�ug��p��)�oP����Q�� 틴)��q�-���d0D��x`�1�W@K��0���u��;i�<+K��Z;�\ޔ�TB���ܲ��E�.d�|���g�,��k�^�3� ��L��M ���pFSU�hx�䒙{����`)/����v�CFO������ωOPs���Y�}�=0!TRU�t�VN�X_|x`T���ˤRG˶[�B�x��H�Y�cc�f@�[�#���X�D��Eu�URX�1;�J��<t8,EC1�^<l�]�D-_l`��/L����ri��}�7(�v{�>w"#ƴ8�=Y`��`h�m�{o؎��c|��Ս�`}�1���V ���O�a�v�����rr�:l_�k>�� ����!ɔ1�{�c��N/:J�� XeHɧ�Sj:�����/���x$�E����dq�h{���X]�����>;��^�GnGf��lrk:A���W��f�K����XS�ϝ�D1�.����5�t0�*��9�?��vD���C��C�:b0�S����c@_�^Ĝ��x�?C�&@���!C��L���.$���Bw 2��s���"�{ 2D��(Twq�/���� �^��m�k{c6g2연Mmc�l�[��C�_�k��#��ȫ��3'Fnj��ꀬ̒9���vl����*d^ fz9VNkprb`�k�����?�.�;�cσ����> B�`�B�����MX�M-��s'�VHy�3N>g�5J$g���~�(��%�#s.ѣ�:��%��w7�y�l0��x5c-��B� j"~����r�mr�^i�{�<�W����mxb]j����]o���3�Un��/�O�w%�F����4dUb��� _��B}�w惃�j��h����X��ѯ����K�i���wF\G�Tu(��j̳ۄG��x5oA M7~[5v(�v�4ݠ����4�\�B����B�9?���{�;7\鯭*�W%�-�������TnCZ&�#'�����Z-���`_E���HV��u^�I��j�����cJ�ۗe�^V��u�@s��×f�ذ_�uZ)��Xm�$�L&�,�u~;o&~gjj�]m�ft�B~v�`�mjnh��]m��s�t�CC4��T��t����?�p��Z�Lɛ���;��)�����*�X�{�ɰY�m� �.A�ʵ,bm�8�?7�1m9��۹r��'ɏ>l�O|���a[������:ķe�pYV%�1�8)/�N5k��We�ꖯo������<���z����@T��w���_�߀���M�hv�چ�� 2t60MDj6���$V^�?�T����Nli���啌�/&���P��� `aA�������jr� ��d�np�����^����4�7�r��6U�M�@{{��7�2Ui~���̵ݿC�){$�T�X��4f�4�eg�'������>�dt����>��g6c�A�C��S6zZ�u�(�ɽ�a�����e�tw�����i�3�������������i h�-���}��~0�[�k��7S[A~܄r. �I�~�Q���՛"Y()>G�9^�F��¤�Fwt��-db�T� ,��I�I�S0؋��� J�"��0�S�h� ��0k#rG7 �cR~��Ǒ�摽c�X%Z��˝���Q�D�x,!�?l�.=��$�+r��I '�H��,��}��BT}>������q2�0�x����b���7)����g�c&�9��zlꮸ����oU�a��V/��B�L*���V<�Yؒ��j��,P�����ET�G&��7���Bެ����J�Ke��Q�:�ӡ<7��pM<,A>��\��b9�����@Z�-s��=hQp��~����0>薲��gi�w�W�Is:�3��H1�1�b���ʀ�V����� �aAQ2O�A=N}M�߭����s ���l�7�t�A$�~���j5�8F;�ۡgb�/+����?D>!QI��H�2� aב�\$���;9?+� v*�ͫ%6'īL�u{.u��9��u��6�@1yUD:�{��B4���a)d��3�̤��.4��!����,,�4�<_�G�5�� ��o��$���D�����q�{{Ea ������ϓ8����\�:�3�P�Hb����K�|�`7zF��Ӗ�H2�!lY�)M��j���i"����N肔� �U�y;n��I�5�m���;ڹ&8t0��t�M�v� K-��� ���2��ʂ�c��x�R<ќQ�V�j�i�ڔ
Static task
static1
Behavioral task
behavioral1
Sample
Yams_Services_Free_External.exe
Resource
win10v2004-20230915-en
General
-
Target
Yams_Services_Free_External.exe
-
Size
5.6MB
-
MD5
99e0d35dbb05614178e96011f19739cd
-
SHA1
706107b1d0982b39f7d6eab960cd5dda2e1a9c3f
-
SHA256
79ddd4f23d2015543b74fe4dc9d683d8c116aab3037dbb5636b3cbcad1d5bd13
-
SHA512
fb758c5d1726fcc06d3961a80e73645c0a392709aa1a3636c779044a316b36e571cbf8304e4473c61f411d6572d08ed0b5f71c1182ba5c8d01d384e821ea9d16
-
SSDEEP
98304:RhtzmUhbrEUy3LwBhOez70DwxEuOYfJk2IzxYvOpDKJS6bNWrcEh8gK/qgYsHRQm:Rzrr839A3Jk2ciJJSrr8gK/qHsHRG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Yams_Services_Free_External.exe
Files
-
Yams_Services_Free_External.exe.exe windows x64
247d36eaa202dd3460908fc5160b0db0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
VerifyVersionInfoA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
imm32
ImmReleaseContext
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
d3d9
Direct3DCreate9Ex
wininet
InternetCloseHandle
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-math-l1-1-0
tanf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
/1BUEkg! Size: - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
5"JYM\^m Size: - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Zs,&$hn% Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
]byrY\?B Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
?*`#p`mX Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
=xmjHQ/T Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
oR`SsiR_ Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
zzA@0a@9 Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ