d:\Work\Assistant\Assistant\release\YiqilaiLyrics.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cd901f47a3aa59118673317d53426290.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cd901f47a3aa59118673317d53426290.dll
Resource
win10v2004-20240226-en
General
-
Target
cd901f47a3aa59118673317d53426290
-
Size
144KB
-
MD5
cd901f47a3aa59118673317d53426290
-
SHA1
a320d2fd67801ec80c96d1bd5a8c9626b6d30373
-
SHA256
289feafc9eb420045e7d89d52c7b0386d1fc7307f0e4b6aa11f35d92be5ab98e
-
SHA512
cb1e88e2565de510758b2f991077241b26de70a4f3cad9cdae75842be53496f66709d94b2866c5b84d07c4a1e5fa17a209f2964c6fb35fc9ceb69d5e8bc31a4e
-
SSDEEP
1536:4vSvGmOa8qvO/2VoFpmGdfb3i8ke61TlUs9wBKPoTk1iatQ2TG1JZqnj5uYTtVsh:S4O/8oFndj41BNuw1iatGJZqj08tVsh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd901f47a3aa59118673317d53426290
Files
-
cd901f47a3aa59118673317d53426290.dll regsvr32 windows:4 windows x86 arch:x86
a3dac82fa98a7d5cb5e979d7e230bb30
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetOpenUrlA
InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetCloseHandle
yql_lyrics_common
SetPlayState
SetTimedLevel
ShowMiniMode
ShowLyrics
ShowListener
SetMediaInfo
SetLrcInfo
SetMatched
ReleaseLyrics
kernel32
CreateFileA
SetFilePointer
WriteFile
CloseHandle
InterlockedDecrement
lstrlenW
WideCharToMultiByte
InterlockedIncrement
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
ReadFile
SizeofResource
LockResource
LoadResource
FindResourceA
Sleep
CreateThread
IsDBCSLeadByte
GetModuleHandleA
LoadLibraryExA
lstrlenA
InitializeCriticalSection
RaiseException
lstrcmpiA
DisableThreadLibraryCalls
GetModuleFileNameA
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
WriteConsoleA
FlushFileBuffers
SetStdHandle
IsValidCodePage
GetOEMCP
GetCPInfo
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
TlsAlloc
TlsSetValue
TlsFree
TlsGetValue
SetLastError
GetLastError
SetHandleCount
GetStdHandle
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
RtlUnwind
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapAlloc
HeapReAlloc
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetSystemTimeAsFileTime
HeapSize
user32
CharNextA
GetClientRect
GetActiveWindow
GetWindowTextA
CharLowerA
KillTimer
UnregisterClassA
RegisterWindowMessageA
PostMessageA
InvalidateRect
EndPaint
BeginPaint
IsWindowVisible
ReleaseDC
GetDC
FindWindowA
GetParent
SetTimer
LoadStringA
gdi32
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
ExtTextOutA
SetBkColor
DeleteDC
BitBlt
advapi32
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
ole32
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
VarUI4FromStr
LoadRegTypeLi
SysStringLen
LoadTypeLi
SysAllocString
SysFreeString
SysAllocStringLen
VariantClear
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ