d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PYG64.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PYG64.dll
Resource
win10v2004-20240226-en
General
-
Target
PYG64.dll
-
Size
1.2MB
-
MD5
fc970cc17ff15c6b3fe5849f349c8d54
-
SHA1
f97c34eb15c20e0bc08614ffed2abe18719a9784
-
SHA256
8996b2c1b041d308ffaf5ad307659083d39dc5e1b0e1a3247d733e4e213af7f1
-
SHA512
ef3abcece12bf4571163b5cf2a876f41ac769ebd3e42455136483c6d80b836eeedecff6d4ea9bea058c638ced729d1beff6f7915f68f940a7e21b69ac27b8262
-
SSDEEP
24576:IrJoojYs1ZVWcBaXw1/oCUt6vhFiimB6vTXhCC1yZP4oiRJYnsSNt:IuoXZVx0IQCUUvhFm6bR7yZQoiRKnsST
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PYG64.dll
Files
-
PYG64.dll.dll windows:5 windows x64 arch:x64
e0a9dac2c63dd793d872e4baacea0c8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCommandLineA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MonitorFromWindow
shell32
ShellExecuteW
ole32
CoUninitialize
shlwapi
PathFindFileNameW
version
VerQueryValueW
gdi32
DeleteDC
Exports
Exports
0Ϗ������d��Ҷ�#�,����}�B�Gu����1z?�r��%ؙ����}�Z���l��:������=c�39o��٪��/�B��5%��&�E�cKn���h��?U7R�<Qv��5;W�Uu1h�ia�*P �|P��-��9; A-�ϵ]ϯ>��E腺X�W�*x�f8�ź��NRB���iev�,~��ЫN��cA���� ��mz ��Z )��!K�� ���CX�����Θka�DM�J����dT�tM��$�lDT�s9�i�g.C��ixb�IV|!�_���?��P�8g. ~#�?O�}- b�^gޅ�Z2�-����c��4u�$���V������ꛢ�g3 �n+`o^:��R�'�d��:��h۲CwOTKȎc,�,��������z��{��!G�bP�$ @��7o��̤5�¶�2�>|��2)�X��ͷ�X�tW���#��l���ߘ�^���+��m��Y�F��W�9�����^L҇��D�+�P�g�؟F������'���!�����������<Q8s�� B1)��W �7�m��S�Td��Pd���K�,<���sOzk��3e������S�v-�/A�,<�<��Ә���j&i�t6������]s�τ�x�W+��v���E�?�6"���I�([��К�8�m ��&��3�f���%$�%rJpI�V� "H،��&���]y\dG���k쒏�5��[6"I�X�A;�υ��oĂ�Ӽ.Mpk�7� �h��1`X�*Q:qg��4�ܯ������=c<-��&��Mb4��e��H���Y�/i��dPk�(M(�"�x@is�v�t�����즟�,�������V����P���������"��V�UƦ6e��^����A �l�C�|uE�w���8Ve[=g_Ԭ/����h�l��f�6-�&ʿ�՞S3rc30t�� �c�w�!\`h:��6Ӕi9�;�z$��b]'G����N[[W���N�"Ȋ��^��ȹQTo������I҉C�9p��W&˅�*X���R��#�S�E-��� \��1%�/��y�aP��t-���\`+@BwD�XS%8ޑ��2��E��yO|���(R��)��%B�!�ESk�����*��4߽�zhm�v���n!�<Y8u�m+���o���{~L�G��LJ�+Vr��ܿse�;�����W���גZm�G�=_�gD@5E�$yJr x�^K /��C�xPD2o�|f�#I&X)Ѯؐ�*��+�mk0�g��(*� O�������H�0ȟ�nQ�|Lk��㔰ƥ��ͬ���(JH��Ju.�Y�h5�V�o��Ehwn���C���.�k��N����ڰ����Ŕn�LH@�U=;2_D�ު�R���V��T,����;�н�I/J�4T#9����E��s�G~GU��(��c�r��Ow۷0A0������g����5�N���N1·� 4w�se9��'`��N����ٹGcZ���J��:*��&�5+ؚ̌Ϟ�M\ .�w�������Ւ!�N(�L��А��x.lN^�p~Xrk��ϣ���F��so�>����DCHnT��^vk�2:'��+��="l� �~�cs��x\�ݪ�)�{��OJx�5B��0���Ƥ�����@�Qr�<M�Ԍ+MY;��жjR��Ab���⁐��o>'>�Z�;ؤ�/b�j�8]�r�73��K�!�mEˏZ�Y���h�gC���q����`_C�H�m�ΆI�c�]<g�z:�S�Q"^!6�3噍��I�������Uw� E_�~�oA�g��h(�8-@���"V-��T���*�p@���O�([�h{m%�a�3Sz{r0�#^3�s��K�S9ȅ�=���㎪o�#�B�ސ�{~c�Y�6��K�s-V0��L`�=�i ;e~ �5�D�l��4�$�b��<A�7�j�ӫG�G�y���ý��ѯH �HY���K�6��Aip�d8ʗP�1��C��%Ϻ��ۙ+�������@����v�l �w�'b�����t�+[ �l4<TB�.��uσ�^Kz��a�' 0��o2�L]����Q�v�K�4��03���A�3������������ݧ� �\��n�Jɠ �����H���x* �dݣi�p��"���n 's���IDH���^U��T�ߩg"X��Eo��Z<��P_�f^cU�-N�e���t�}�ȭ��6� �Nrƥ߷��2� �g�;|����Ұi[M;<NP� LrӅ����d��7�S�h���;�yR�ܽ!. �%:j�-�������e������GQ֚��bzٓs�yVd��;-�i&'6.J=�a{����ڰvu?����ݙi[���۱x"�p@��PD��p�c�i�����o�J��hfLu���~q-�3k��j� UQl+��vn�<�{Hn��˜����N�n��Io4.#�`T��X�0{L.������y� k6�(������y6¨8��v"�߽�s��� 9n�,e ب�U �Z vw�曅(���=k�*tF��ZͼUz�$Ëo{��������(��H�6��<�V��"v}o�9ڂ�Ȑg���kL��ֳ��e�I�gl�����<��f��з��"$^�y�� b�B������ќ�.7�6� �����T������ ܲ�#۷ �x4�ۊG������x��+�f�)4{ɐ?$�1�� 2R��Yܳ����~�)w���Ag$��H�4�K�2�V͔_ybKH���{��˔�w���hn�L�;��f }���g�j�E��������6j�Лx���d�ϐ>�����|F�!�i�귚cU���ssEUc�+��$`Y�I�Q�]���Y�;S��Ư���Pؤ�=�(�����a0-7܁��{a�I9�>ܐ�o�K�{��; Cֆ��^��_;�a<�T���9~�"���<t���gN�x�U�+!z����6?c���)Gfk^dw�� �%��+�~՛S��Ό�+�p�����]X�.>R�6��y��O��aguY��W�(�
ChinaPYG
Sections
.text Size: - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ