d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ce5755a5cd79865ba8b79e87777e1ceafe8eed3e53e5646b679dfc1017b99b95.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ce5755a5cd79865ba8b79e87777e1ceafe8eed3e53e5646b679dfc1017b99b95.dll
Resource
win10v2004-20240412-en
General
-
Target
ce5755a5cd79865ba8b79e87777e1ceafe8eed3e53e5646b679dfc1017b99b95
-
Size
1.1MB
-
MD5
b20341be9e47dd54ec824b1138e6a88a
-
SHA1
36f1a4878188f8952e41dcd291bcc274da1ff9f8
-
SHA256
ce5755a5cd79865ba8b79e87777e1ceafe8eed3e53e5646b679dfc1017b99b95
-
SHA512
89f35d6868d04648cb501b9d918b3bc9f3c6cd1a7d152fb94e8f38cd3aca830bbbc07b81a275b15b0d7f0ba751ffa1ae59e69a30bfcea177f14c16f7bb408447
-
SSDEEP
24576:MEgEXNcYzxtfwXT9Kx4RXU+4/w/qyyAsIHat96ViHocYjI2I:MEnXeY7wj9xXB4/nqsIKAViwXI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce5755a5cd79865ba8b79e87777e1ceafe8eed3e53e5646b679dfc1017b99b95
Files
-
ce5755a5cd79865ba8b79e87777e1ceafe8eed3e53e5646b679dfc1017b99b95.dll windows:5 windows x64 arch:x64
671a3bfc6e40385e6cf6e6d0c090ed3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawTextW
shell32
ShellExecuteW
ole32
CoUninitialize
shlwapi
StrCmpIW
version
VerQueryValueW
gdi32
GetObjectW
Exports
Exports
ChinaPYG
�Z�b��*�M�xa�� �^�O���CN��@�a!��ĩ���������O��/'"�n��s��������VOi�Y�$jC�{K�U=ֵgd�����I=�ZO'����P����.�[�0uE��X�q�ՠ/Eշ�"!z+�.>��CkLY�l� �u�̆R[ݱIt��vpN���w��n�2W�P2m�M�:�2��Ӆ� ��Ղ9��il����;sI�{�B;����o'm�2�(�7KBV6λ���ʿ���n"�#�E�c�e��V�Ȣ1�y�g�E^r�uiM���>�/����_G#�^�ș2c�}�s03E�}�"��ȩ��{��@7����0[���t�RUʝ�QxI�0�~����LXI-Gi}I�δD���s( ��P��Ȗ�'����;��穎7%�����<�j�E/A��h�����e%��Q�I��m���v�Q++1�z(��I�;i��0�d%���´ƍ��1B(�f�-�RY?�9(�E�c���*$sI��?�8�ƭV��X�Xcc �����|���B�(*캆W�v>ͷ5'��"]M�</ F5�[m��0kde��?$�̏�j�*ם�����?/� �E[bc�v�F��BPn�%k���/y/���$��-�)�������|�^?l�3����Y�$���n���e�&�vazpZs��C�5=��_�R��X����1� ��|,Ł�Ъ�3����N=�x_�(� �fw� �����-�K��Fߛ�>�6������i�o _t������rP���R܌���g�1��/� s�H��{�CcI��9hˋ�M� ��(;U�P�k���Ђg�y�1�ɾ9�щF�IP��f �͠��'M�T���$�c͈@�Q�糌O�Ή;I��^`!�U-��̡������Xn�J �4�+�<�Ʊs��؏��{E��JM6�m`}���˾*H�1&}߽�� ��F�1�<;8 �E��W6���#fSΘ9�3OŤ4����6�z�䰳qؑ@&��t�}+�v��V1,'�a��r�R���*M���9�K;֡��V6�벆K��Kf�9j)�� �6;�����hHv��ꏘ��J���?�r/ϗ��=���r����'�֢��� ���W�Aw.e !�������>����%݅�X &�Ef^0�DZ0�I5��O39�n���WHz��$�9��{Cg9�9n���̓d��Z����*�/����}s2W�U���5)}��=���#�����a�a�Gjsչ<�Ē��>n��Upb��OY7�G��3�<���:ϼS~L��R�����حR|1��눘��b�DZ�Q�FƏȱ�=��D�gPC�yu�B��!����w�js��>�lMV��+�m��}���r���߷4��� X2���@/<��\�r��V�IkFe�����Hv#�$�WۛumM<&n������u���%-��b�Y�j�џejB�D5���@SVp9^���B���)�ca#i9iM/b����M��pG�K�x��/>�������x~D9�S��iګ�y��sd��C,�����T0`���|eOy��fܣ�����/����z��x�4��5Q��\r������;�3���u�yE��D�!�Y�ܾi7�R�բ�M��ū+���/�����ui��e�Z�6���N�7��Q/#J+m�k�"F<���|?,̀յ}ig2Z�n�,�%e�o��M���ϛ�Yy�V����j7;mj���J��7.���h��MF ~]�� %q&D@Ap*�V5A��~S���d8��D�캒X����Z��;"?�6���v��oX�}ප��3Z�m�l��T4خmƫY��{4��Es�z<[��Xt�ᅳ6blpj���>��q����Ń(5x.��G�%�h������e�����rؼjڿ�l9`��������2]�8���5f/R��r/I�� �N9q�������qXƞf�����"��f��3c1�x�U~�Уke�RH{��_D���gڒI�n��).[���؍S�ͯ��ys���'2�_m�����7��?��6���&oD؟E@�q�TZ�3�E�)1�=}�¾����g�s=$��Lb��NT����g�e�E]p���8-a���K�fH|�.���a���&��Um��&�<Zճ����R�C��?|�9���S�C_�ͯ���� W�����9�1ueҢa&�b�m6x 'p�A��]._�|�o$6�k�/� ehz{��)J�����c�H��P�&ϐ���j�q*P����v*���]�O���}�{Z�?t@'}xKGg ��a�45=(>x��{�NMb|YSS��N~�˰^ё.҄�����SR�j.���#�}D�����p��waB5f����_�9��(��vM�w F����i���|�2��A���F�z�;V�i�nN3D�>��b��m�]A�Z̘��{^������.����ⴂ� �.�?�O�)po:�;w ��`�B�E�'�X�(bG�Jd��d�4]9�L(��_�h}����ճ�h+����D%��R"4D�4*��V0|_.oM�)y<5I�<ۚ�I#N����C�s�Ƿ�&�+v6�q��A�R,�� +ܛ��mI�sLFQ `~��.*;c�����d�e�j+�Wۯ`�#s���;QS�V1�?j�Δ@��Ҳϰӄ,X�y��)�\���_��6��읦$B&�͛����Q��5� ��M鲂�T ;��m��F�hDHe)Z�秠IeY(�m�@��n�^ 9���^�)>����I���O��~�¼�$�l��zN��˝k @�7#��`%f�.P ������ �2�x�?��� y��9������r�d�,�.O�))����8�-j3��)��Q?�d��X6��eY~��m��dO�)�^�1��(�=ؽt�l��+I�;ѯ*2@��]��8&��j�T/��{e�>��}$s�c�_���iz��x����ɗ+L��~P�Ê�O�RT3����� Û;@���C#b3Y�%��Y^��#v�n
Sections
.text Size: - Virtual size: 543KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ