YUVProcess[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

YUVProcess.dll
Size

879KB
MD5

0c482252b4b0a3645a9762be2a2f3dba
SHA1

7bc0393397e3e10698570833e1f76ad5840e6f09
SHA256

afdc5a941dc6d5e8f8354843b0152bd908ed242500c44cecfd9de9c913099684
SHA512

9b91d367a33309b78a1dd37cf869ca632d1e3c48dfdee509a70b183a5e397996a6948422a1913d20c0942c8cc54a7e15bbef3e822089485422f822bffa7b2188
SSDEEP

24576:97jfhEXYMvSVYFWyGPNWbaX4/KLADMl+xbcjeLMBS:97986JyrMBS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YUVProcess.dll

Files

YUVProcess.dll
.dll windows:5 windows x64 arch:x64

d4b661427f7244ab389214d6864d6b89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\svn\YUVProcess\pjt\win64\x64\Release\PDB\YUVProcess.pdb

Imports

kernel32

MultiByteToWideChar
OutputDebugStringA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RtlUnwindEx
HeapAlloc
GetLastError
HeapReAlloc
HeapFree
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
RaiseException
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
LoadLibraryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
CloseHandle
ReadFile
WriteFile
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetProcessHeap
GetModuleFileNameW
VirtualQuery
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreateFileA
HeapSize
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile

Exports

Exports

YUVProcess_DrawLine
YUVProcess_DrawRect
YUVProcess_DrawRegion
YUVProcess_DrawRegionEx
YUVProcess_DrawText

Sections

.text
Size: 657KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4b661427f7244ab389214d6864d6b89

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 657KB - Virtual size: 656KB

.rdata Size: 158KB - Virtual size: 158KB

.data Size: 37KB - Virtual size: 61KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 657KB - Virtual size: 656KB

.rdata
Size: 158KB - Virtual size: 158KB

.data
Size: 37KB - Virtual size: 61KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB