d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x86\PYGd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0ef6746eba02483f9a06c00fafb564485e8ad23e0eaf3c3892fb91c32e5151f4.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ef6746eba02483f9a06c00fafb564485e8ad23e0eaf3c3892fb91c32e5151f4.dll
Resource
win10v2004-20240226-en
General
-
Target
0ef6746eba02483f9a06c00fafb564485e8ad23e0eaf3c3892fb91c32e5151f4
-
Size
1.1MB
-
MD5
ed7c09d42e72a717d124168a753a1916
-
SHA1
63a15f1e6e2e988e26ac15b3775fd01697170f55
-
SHA256
0ef6746eba02483f9a06c00fafb564485e8ad23e0eaf3c3892fb91c32e5151f4
-
SHA512
378a30f6337b6cf537a46fa73c41b7ad1e6cde6a9d672dd62024ee7de6fc23daa1f7e9ad40bdcddab8123ec20564f41df94c8419d1fc159deca8cfdab91d5994
-
SSDEEP
24576:zkkQ6ROyDN7NCW+Td/QGlpbhKzgzfVtxJrRYqp8Wn4elD/7ac9eZz5X9S:gL6MyNRCW+TlQOpbggzff8reVD4Zz5XU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ef6746eba02483f9a06c00fafb564485e8ad23e0eaf3c3892fb91c32e5151f4
Files
-
0ef6746eba02483f9a06c00fafb564485e8ad23e0eaf3c3892fb91c32e5151f4.dll windows:5 windows x86 arch:x86
7406901a0fa9cba71fbcca36202b4226
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
TlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperW
shell32
ShellExecuteW
ole32
CoUninitialize
shlwapi
PathFileExistsW
version
GetFileVersionInfoW
gdi32
GetDIBits
Exports
Exports
ChinaPYG
z��@���9��V��r�z�G�#͊iI5v ���ms�?�ث�duo�%���R�E�3��͔�u�b��խ= �?F]x#��k`����=�5U�M� ��O���qhz�tj��� ���`�|Z�<�|�G|���E]è����w�*�{;&$ږCiRmz5��V��`N=BI�A�1R�^6$�d��ď�9�+��-22cPِP[�aZv�4�-D��,�YBi��i/-�z[��w���܈t��p�m/� &�4 ��@T���_�����d����,�|�����b�m�;�{��H�!��ٙ�@�`p=ҭ.��'-E��������M�g��=fI~�nt�xf��<��Z,��C���X��������#F[�$�*���r���.�'t��q�{��n��W��c:�ԙ�pD���i�}pW-IN��g�jx�gCz��-��$������������u�K�r��K��㷸䋖�D�T�p&�"�i�/��#URk�۽��$�7�ҹ�C}W Z�G!t,�+m N�e����`�� �%�C��8���1�n��[~E���,���A-g��K�wiZ�ybZ��dYi��#�RxX-�ȧ'��Q� ��HlJ c�m�M)�,�%�}j��������_B���R�?5�P�/I�9����2�����:M=��9����B��������¬�%;���H� �)��N�"��jsB/z�X̞ �R]�;4�����[�i�ؽ��� <���-�I�t'��d����,`m/3Џ����ym{���^�8�����>k��cSmV���՟3��*��Ο�S�����"�?�`9z��-�=���a�8m�,�m&l����N�C���ۉ��N�X�F��!����5���B������>�reS�A^6l�͑l�$��v`y�N3&r��uۦ�t?��o��nm++�7��ejq�!:V>��̋Ypg�~��eh.A�n/@�����ʤ����5p)��CwxvQ��cH�R�I���q8Ƕp���8�lw�qR�����}p�ą�}�p ӫ�����;ӰJ�$}=���Q�#�b Zʅ/��Fh�mH��0�C@�>KJ��Ō||2#H�,�w��5�I�!��������5r�g�EҜ|f%BEáL >�Z�QN���߀�=�}Ogs3y�<7am���?�3{̹zW$�<�a'F�y�j�Ԁ#Mf�v��2ʂ��[���GϿ�ΊR[F�ʣ>%�[Ņ%��3������%���� X�R��Aݾ�7H+�#��ë�����f?��ܧ'>n���&��K�������qd�·Y���Ԧ5���h�9��l�Z��Sk2�}����� �W��D� W}�Dig$-h 30u���~RȆ�-"�a!�GS��������5�����G���M��K+:�W ��cڔ���HP�C�g+��_��k�D��/��-l���6�K(� α�����C���>ؐɘ���A�ە�%O�礣����,g'U�lWl��k��}���MZ� ��u��d�#�����g���j�f�\�9��M�u&�i����d��F��q���hdd�o��lȷGo]����I%t cg�m��&�^��}l2�l^����"��(���>_.nW���I[H�L�E)��}�&j���D#��V�轡ϡF�Cv%@�7���X�/��i��Тs�i@��(_(�l�/f�a��4�C�3����J�ҭ/rsW��:���%�R~�3[���K��6o�d�p֘�S:Q �P74PT�3BB)��[t"��3Z3ϒ䇚�@D.n@� Gl�~�=���q�qt^3VZ}���1��c-�Iy������KM�-�}��Lx�C��"��x�p���C Wo��/DA1�nkf!�D��2�%bUG�S*�O�� H������3&$���7�B>�_�����m�7��J�3�`u����؉������BK~�z�<Ѫ��W,{��b�W��Hbo�..�8��/ SP�lZ��7p6��j��m�������!`ُ�-ξ�!�2���4':K`t��6G�V���!n���{�6k���^��Vz8�F^��3q.��#��KրT~<��ɦ��/1���}���0y���oѴ�-�9�15�d6z�k��1�BԦ�uN��WLj�p��F3��BÓR�%���Z��[��q{3F��y�=�v� �*E�F8;����:Td�;Y�7рG�x�6dG�º"��R8��-���[�f��F�ֈb�����_�n)��EɌ���$���E[��9CФ�Й$}�j^� �K� ��C#�dձS��-d�y�埨�E ���3q!��}����"�K��0r��EM�����CfiR��~��S�f6��=K����_�kD�>D�$VI�a�2�2���ըNX:b�]BP}�MM�pƚX��l��#ړX��^c'|�ڭ��|>F���z��׳$�j©e�3c���EjL��"?f�д��\qB�(���a���>%ԩ�aq���vZ~�+�I�4�Q�������W � ��]J;����gz����]��đ{��gьr��VM�i���0(��ym?/������41N�+,�Y���5�:L�2����H-���l�)S�~� Zy*nYЊ|�t��[�}h�u�-���O������>�X�A��]�wl�Ц�K�,ݪE���JjĔ�1���M[#m�c7��'��[��n��i�����H��㰁�_���cN1���e��D�g�Y�S�D6�w���!��>ѣ'����\�V`��&R-��-@�WW/��ф��B�$z����2,2�5�C�Y��($�bOXʧ�@/7��uh��Dz���;�S��$�!��P`�+?�F��ү�����F(ȭ�m~�-���&бm/nt��1��J6���|��jZ.[���!p� L0���O3����ah�ce2eq�xw��0��^��lNK�<yq'���T�DJ-|\� �ʬ_����D�r���?J!�&�3�ww�ݒ}�N�r&!�h����ÆD���hE>� <c�}���Rg+��]�{U��
Sections
.text Size: - Virtual size: 435KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax0 Size: - Virtual size: 546KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ