C:\Users\DinRise\Desktop\log\YeahNOT Loader\Release\YeahNOT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c255c90c84127c99a8027f9aed3cc2b1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c255c90c84127c99a8027f9aed3cc2b1.exe
Resource
win10v2004-20231215-en
General
-
Target
c255c90c84127c99a8027f9aed3cc2b1
-
Size
1.1MB
-
MD5
c255c90c84127c99a8027f9aed3cc2b1
-
SHA1
c089e8ecc69a34997db5120e6654d658fae15673
-
SHA256
420914f953f162402141ec4330a801e1ddd5eb4877023d59cab50dccbbc3d0e8
-
SHA512
452b50b22d65ac43d446955802ca3edca5ffc5b3ed700bb73f4c27f10d253ba491bc41f09182fd36a967331e68a1925963996b942e8bb47c94d32d30c5db75b5
-
SSDEEP
24576:qkx47HrkDP05ki3CKLo9pYJ5EHjckyMyK32Babt6M3UdYLkkJ89:a7L4QK9y/EHjiMH33jLkkJ89
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c255c90c84127c99a8027f9aed3cc2b1
Files
-
c255c90c84127c99a8027f9aed3cc2b1.exe windows:6 windows x86 arch:x86
81ac0aa83dfc4d6ecf0a739df0209233
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetProcAddress
GetCurrentProcessId
CreateMutexA
GetCurrentThread
GetThreadContext
IsDebuggerPresent
Module32Next
GetComputerNameA
GetVolumeInformationA
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GlobalAlloc
GetACP
IsValidCodePage
Module32First
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitProcess
DeleteCriticalSection
DecodePointer
RaiseException
CloseHandle
Process32Next
GetLastError
CreateToolhelp32Snapshot
WaitForSingleObject
InitializeCriticalSectionEx
CreateDirectoryA
GetFileAttributesA
HeapAlloc
HeapFree
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetFileSizeEx
GetStdHandle
GetModuleHandleExW
RtlUnwind
LoadLibraryExW
FindClose
GetOEMCP
OutputDebugStringW
OpenThread
FormatMessageA
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
WideCharToMultiByte
LocalFree
GetCurrentDirectoryW
CreateFileW
DeleteFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
SetEndOfFile
SetFilePointerEx
GetTempPathW
AreFileApisANSI
SetLastError
DeviceIoControl
GetModuleHandleW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
InitializeCriticalSection
ResumeThread
Process32NextW
Process32FirstW
GetModuleFileNameW
CreateActCtxW
WriteFile
UnmapViewOfFile
GetTempFileNameW
CreateFileMappingW
ReleaseActCtx
MapViewOfFile
ActivateActCtx
GetEnvironmentVariableW
GetSystemDirectoryW
DeactivateActCtx
GetSystemWow64DirectoryW
Module32FirstW
GetWindowsDirectoryW
DuplicateHandle
Thread32Next
Thread32First
ReadFile
CreateNamedPipeW
TerminateThread
OpenProcess
IsWow64Process
GetSystemInfo
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
CreateRemoteThread
SetThreadContext
VirtualQueryEx
LoadLibraryW
FreeLibrary
SuspendThread
GetThreadTimes
user32
PostQuitMessage
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
ShowWindow
GetCursorPos
SetCursorPos
ReleaseCapture
wsprintfW
GetClientRect
SetCursor
MessageBoxA
GetForegroundWindow
IsChild
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetKeyState
UpdateWindow
RegisterClassExA
GetDesktopWindow
PeekMessageA
TranslateMessage
SetLayeredWindowAttributes
CreateWindowExA
UnregisterClassA
SetCapture
DefWindowProcA
GetWindowRect
DispatchMessageA
advapi32
CryptReleaseContext
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyExW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
CryptAcquireContextA
GetCurrentHwProfileA
GetUserNameA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
LookupPrivilegeValueW
OpenThreadToken
RegEnumValueW
RegOpenKeyW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyW
RegSetValueExW
RegQueryValueExW
shell32
ShellExecuteA
SHGetKnownFolderPath
ole32
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
wininet
InternetReadFile
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
DeleteUrlCacheEntry
ws2_32
recv
connect
socket
send
closesocket
htons
WSACleanup
WSAStartup
gethostbyname
urlmon
URLOpenBlockingStreamA
shlwapi
SHDeleteKeyW
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
xinput1_3
ord2
ord4
Exports
Exports
??0Assembler@asmjit@@QAE@PAURuntime@1@@Z
??0CodeGen@asmjit@@QAE@PAURuntime@1@@Z
??0HostRuntime@asmjit@@QAE@XZ
??0JitRuntime@asmjit@@QAE@XZ
??0Runtime@asmjit@@QAE@XZ
??0StaticRuntime@asmjit@@QAE@PAXI@Z
??0VMemMgr@asmjit@@QAE@PAX@Z
??0X86Assembler@asmjit@@QAE@PAURuntime@1@I@Z
??0Zone@asmjit@@QAE@I@Z
??1Assembler@asmjit@@UAE@XZ
??1CodeGen@asmjit@@UAE@XZ
??1HostRuntime@asmjit@@UAE@XZ
??1JitRuntime@asmjit@@UAE@XZ
??1Runtime@asmjit@@UAE@XZ
??1StaticRuntime@asmjit@@UAE@XZ
??1VMemMgr@asmjit@@QAE@XZ
??1X86Assembler@asmjit@@UAE@XZ
??1Zone@asmjit@@QAE@XZ
??_FVMemMgr@asmjit@@QAEXXZ
?_alloc@Zone@asmjit@@QAEPAXI@Z
?_emit@X86Assembler@asmjit@@UAEIIABUOperand@2@000@Z
?_grow@Assembler@asmjit@@QAEII@Z
?_grow@PodVectorBase@asmjit@@IAEIII@Z
?_newLabel@Assembler@asmjit@@QAEIPAULabel@2@@Z
?_newLabelLink@Assembler@asmjit@@QAEPAULabelLink@2@XZ
?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B
?_registerIndexedLabels@Assembler@asmjit@@QAEII@Z
?_relocCode@X86Assembler@asmjit@@UBEIPAX_K@Z
?_reserve@Assembler@asmjit@@QAEII@Z
?_reserve@PodVectorBase@asmjit@@IAEIII@Z
?_x86CondToCmovcc@asmjit@@3QBIB
?_x86CondToJcc@asmjit@@3QBIB
?_x86CondToSetcc@asmjit@@3QBIB
?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B
?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B
?_x86ReverseCond@asmjit@@3QBIB
?add@JitRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z
?add@StaticRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z
?align@X86Assembler@asmjit@@UAEIII@Z
?alloc@VMemMgr@asmjit@@QAEPAXII@Z
?alloc@VMemUtil@asmjit@@SAPAXIPAII@Z
?allocProcessMemory@VMemUtil@asmjit@@SAPAXPAXIPAII@Z
?allocZeroed@Zone@asmjit@@QAEPAXI@Z
?bind@Assembler@asmjit@@UAEIABULabel@2@@Z
?callCpuId@X86CpuUtil@asmjit@@SAXIIPATX86CpuId@2@@Z
?detect@X86CpuUtil@asmjit@@SAXPAUX86CpuInfo@2@@Z
?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ
?dup@Zone@asmjit@@QAEPAXPBXI@Z
?embed@Assembler@asmjit@@UAEIPBXI@Z
?embedLabel@X86Assembler@asmjit@@QAEIABULabel@2@@Z
?emit@Assembler@asmjit@@QAEII@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00_K@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0_K@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@_K@Z
?emit@Assembler@asmjit@@QAEIIH@Z
?emit@Assembler@asmjit@@QAEII_K@Z
?flush@HostRuntime@asmjit@@UAEXPAXI@Z
?getCpuInfo@HostRuntime@asmjit@@UAEPBUCpuInfo@2@XZ
?getHost@CpuInfo@asmjit@@SAPBU12@XZ
?getPageGranularity@VMemUtil@asmjit@@SAIXZ
?getPageSize@VMemUtil@asmjit@@SAIXZ
?getStackAlignment@HostRuntime@asmjit@@UAEIXZ
?make@Assembler@asmjit@@UAEPAXXZ
?noOperand@asmjit@@3UOperand@1@B
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KABUX86Reg@2@IHI@Z
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z
?release@JitRuntime@asmjit@@UAEIPAX@Z
?release@StaticRuntime@asmjit@@UAEIPAX@Z
?release@VMemMgr@asmjit@@QAEIPAX@Z
?release@VMemUtil@asmjit@@SAIPAXI@Z
?releaseProcessMemory@VMemUtil@asmjit@@SAIPAX0I@Z
?relocCode@Assembler@asmjit@@QBEIPAX_K@Z
?reset@Assembler@asmjit@@QAEX_N@Z
?reset@PodVectorBase@asmjit@@QAEX_N@Z
?reset@VMemMgr@asmjit@@QAEXXZ
?reset@Zone@asmjit@@QAEX_N@Z
?sdup@Zone@asmjit@@QAEPADPBD@Z
?setArch@X86Assembler@asmjit@@QAEII@Z
?setError@CodeGen@asmjit@@QAEIIPBD@Z
?setErrorHandler@CodeGen@asmjit@@QAEIPAUErrorHandler@2@@Z
?sformat@Zone@asmjit@@QAAPADPBDZZ
?shrink@VMemMgr@asmjit@@QAEIPAXI@Z
?x86RegData@asmjit@@3UX86RegData@1@B
Sections
.text Size: 705KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 292KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ