Static task
static1
Behavioral task
behavioral1
Sample
Yama.exe
Resource
win10v2004-20231215-es
General
-
Target
Yama.exe
-
Size
404KB
-
MD5
90d84900ec36e3cc6e2f4a7d468ebda1
-
SHA1
113a6fe427cba85a876e4e87b24b068fdcd3cb02
-
SHA256
fd06776453a7c91fddfb725402fe99b029fc01d6e3bdf8dd904435693aab9c7d
-
SHA512
bfe26d9aeeb6521dca4fafcf92f2979937271721ef2bec1a2e8bf878a013cca4b9ffb9d6bcbada14c2345c67668d2a1f96094b5a668a69a5a7057dbee1d3301d
-
SSDEEP
6144:nJEJCDqunTQNY6wx/h6SIv9eajliD5UjuA9lqL8WLX4WCvO:nKJ2qunMY3YZUaj8qjuA9cYW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Yama.exe
Files
-
Yama.exe.exe windows:6 windows x64 arch:x64
63df9fd457e6457b89ce20b5d7e53285
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mfc140u
ord878
ord1369
ord10727
ord11855
ord12240
ord13309
ord4335
ord13767
ord1670
ord13157
ord5008
ord13016
ord528
ord3090
ord4724
ord1149
ord7551
ord8468
ord6287
ord8901
ord3713
ord8926
ord2697
ord13397
ord6000
ord3071
ord4725
ord10163
ord3307
ord3308
ord11085
ord14128
ord5240
ord3678
ord6002
ord7387
ord10704
ord8731
ord3599
ord3697
ord11813
ord2212
ord7168
ord2187
ord2006
ord973
ord6585
ord5899
ord3162
ord6251
ord5916
ord8817
ord3056
ord4078
ord6343
ord5771
ord8823
ord4084
ord8161
ord286
ord7235
ord450
ord4946
ord1503
ord8167
ord8084
ord12544
ord8023
ord5183
ord2439
ord12222
ord12223
ord14210
ord7650
ord14216
ord9089
ord4011
ord3949
ord12625
ord7668
ord2011
ord11664
ord11665
ord14088
ord12212
ord7719
ord14288
ord6121
ord14290
ord6123
ord14289
ord6122
ord3731
ord5706
ord11921
ord11929
ord4445
ord7920
ord10124
ord11933
ord11901
ord12606
ord5555
ord9941
ord6614
ord1091
ord6250
ord6320
ord3756
ord4656
ord2270
ord1089
ord1440
ord1421
ord1053
ord1158
ord3951
ord13545
ord7054
ord13109
ord940
ord2178
ord7716
ord1450
ord983
ord7393
ord10070
ord1033
ord296
ord265
ord266
ord1489
ord8050
ord4726
ord7637
ord13301
ord7785
ord5607
ord13999
ord2479
ord3803
ord6361
ord4086
ord8441
ord1442
ord990
ord8900
ord9946
ord7922
ord5227
ord7450
ord7461
ord7460
ord13401
ord3212
ord3209
ord7913
ord2370
ord2698
ord14360
ord9976
ord9978
ord5062
ord5229
ord5083
ord5582
ord5339
ord9041
ord5552
ord5363
ord5080
ord11850
ord3172
ord3278
ord3279
ord3812
ord11806
ord2629
ord5723
ord13354
ord11406
ord6631
ord14217
ord7651
ord14211
ord2967
ord4352
ord9384
ord4360
ord4828
ord4767
ord4752
ord4814
ord4859
ord4782
ord4837
ord4853
ord4794
ord4800
ord4806
ord4788
ord4843
ord4776
ord1755
ord1734
ord1748
ord1722
ord1700
ord11940
ord11944
ord13513
ord3173
ord8947
ord10691
ord6729
ord11902
ord8656
ord14209
ord11625
ord3718
ord11771
ord8830
ord11415
ord11414
ord5451
ord9979
ord9975
ord9977
ord1491
kernel32
DeleteCriticalSection
GetLastError
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
lstrlenW
ResumeThread
ExitProcess
GetLongPathNameW
GetCurrentThread
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
FindFirstFileW
FindClose
GetCurrentDirectoryW
FreeLibrary
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
LoadLibraryW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
LocalFree
FormatMessageA
SuspendThread
OutputDebugStringW
WideCharToMultiByte
WriteProcessMemory
GetProcessId
OpenProcess
CreateProcessW
ReadProcessMemory
user32
GetCursorPos
CreatePopupMenu
GetMessagePos
ScreenToClient
AppendMenuW
SendMessageW
RedrawWindow
DrawIcon
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
MessageBoxW
GetClientRect
GetSystemMetrics
IsIconic
ChangeWindowMessageFilter
GetSystemMenu
LoadIconW
EnableWindow
WaitForInputIdle
advapi32
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
OpenThreadToken
FreeSid
ImpersonateSelf
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyW
shell32
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
DragFinish
DragQueryFileW
DragAcceptFiles
CommandLineToArgvW
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionW
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
ntdll
NtQueryInformationProcess
dbghelp
ImageNtHeader
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
__std_exception_copy
__std_exception_destroy
memchr
_CxxThrowException
memset
memcmp
memcpy
__C_specific_handler
__current_exception
memmove
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_exit
exit
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_invalid_parameter_noinfo_noreturn
_errno
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
api-ms-win-crt-convert-l1-1-0
strtol
atoi
wcstol
strtod
strtoull
_itow_s
strtoul
strtoll
api-ms-win-crt-stdio-l1-1-0
ftell
fseek
_wfopen_s
_set_fmode
__stdio_common_vsprintf
__stdio_common_vswprintf
fclose
fgetc
fputc
ungetc
__stdio_common_vswscanf
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fwrite
fread
_get_stream_buffer_pointers
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-string-l1-1-0
isdigit
isxdigit
iswalnum
toupper
tolower
wcscpy_s
api-ms-win-crt-math-l1-1-0
ceilf
_dclass
__setusermatherr
_dsign
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
comdlg32
GetOpenFileNameW
GetSaveFileNameW
ole32
OleUninitialize
CoUninitialize
CoInitialize
OleInitialize
CoCreateInstance
Sections
.text Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ