d:\NsStudio\Tools\Baymax\PatchUi\res\x86\PYG.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Xentry Advanced KeyGen 1.1/PYG.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Xentry Advanced KeyGen 1.1/PYG.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Xentry Advanced KeyGen 1.1/Xentry Advanced KeyGen.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Xentry Advanced KeyGen 1.1/Xentry Advanced KeyGen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Xentry Advanced KeyGen 1.1/version.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
Xentry Advanced KeyGen 1.1/version.dll
Resource
win10v2004-20240508-en
General
-
Target
Xentry Advanced KeyGen 1.1_Long Key.zip
-
Size
3.8MB
-
MD5
03f5e0a945e2e650410a9b098cabb6c7
-
SHA1
d431778d310a0409f7ca1273d28b7fd0bfc34fd6
-
SHA256
64ea90b06ea39c308abd998ad6a56dd8de21457660ca52c348597945ae294a61
-
SHA512
0398b7ef7a8c92a94333487af6abd2a15e54cb692555548c2ecb96f35d8eb519d5e6d31bbbceca0ff33698e909ca129bcb7480469393be12468bd433ae888767
-
SSDEEP
98304:h3J7him5SupLD75QEhjzqetHw05fmyTZWHeFrTsCZ6:h3J7him3bGEN5tHT+WZWHeFrz6
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Xentry Advanced KeyGen 1.1/PYG.dll unpack001/Xentry Advanced KeyGen 1.1/Xentry Advanced KeyGen.exe unpack001/Xentry Advanced KeyGen 1.1/version.dll
Files
-
Xentry Advanced KeyGen 1.1_Long Key.zip.zip
-
Xentry Advanced KeyGen 1.1/PYG.dll.dll windows:5 windows x86 arch:x86
33f77980ef68d6db22da3aad3f25c256
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowTextW
advapi32
RegDeleteKeyW
shell32
ShellExecuteW
ole32
CoTaskMemFree
oleaut32
VarUI4FromStr
shlwapi
PathFileExistsW
version
VerQueryValueW
gdi32
CreateFontIndirectW
Exports
Exports
ChinaPYG
��h4��~à 5".�gXO�1���0e���An���;.R�H�5Z#,��^��)���8�ʕN�T@�b[�^����� L�1�r��hH���|���� =K9HySM�:w��-��=�eF�#Y>q:k�G:�(���|�t{r�p�<��٥�~�h�N�曙T�c��x��4@�:�V�^�ޜ���p��7�����1����]ĕڭ��߸{"�B�/�[�(��%3��d]�r"�|��U))/��[ ��,�ԆB ����u��(ӵh~������=�_�����ݢ �r��H_(�3�Z�%5��8����t@_Bτ���������i���7Ck�^��j�8����m��1Bb>X�7ڋ�۬d$L&<��3���F�� �ت RTedL�0=(�]��W������� �w�3Pq�H��œk?����3FO�9��"�75���J����$��i'��ǰ6�|�0X��s���uȅ�U���2rUoǞNNi��]�~�6�*����7M�����^f��!�)XJ������0y#�ae�T��P6y��>�$���A�L*����kK��E@����_�HG�,'�S�@�"&=D��;�v��8����D��e�)*�q��(���;Bi��Zz�W����VT����~=V8����9��T���OG�l�4zk�i�p=)`t�KWz�㸿}�v�qxї���^ m�f�����9~�b��d�'#����S��>j1�g��?���{okU�� T�K�V����-t�4� u�]ۦ������]�@�?�8���Z�Զwv��d���-=gq���:�8�G�)��<���y�9˚V����̎�P���!{�醬p�$HР�s�}]s�KK��4�DU-k���;X���4ws�J���߾2��qO'sr�AY�~%���1��OY���d�+L�w�g����oY˦sb^����x����1�E�b<�q�Օ�?���.s� +X���,��8*f���H��:>�K%�`�� ��v�����;���Z�2��sU��+��[M(���P��% ��0��ɨ�����L)�������2x.���I��Ýi54`�[��扶��S�<OO�os���!W��w�;POFfd�b���֕R� ���K���,cp|,��.��ҷ����ƾ�bf��ј���D{$O��q��T��������o6D(�<����D��1r\�ah�2Sl4�e[+8f�Ѣ=��Mi�W�e������Q[�u��`��x�o��JA9��%�?�~�5��i�Z�,ĥ/6-���r�{'U��q3�)��EQ�ܨ����{߇*_~� �C��6��:���_�oC*]K�UPT�����k����S<���p������8I@o�^6 w�O�U;iTEg} `�G�e�6xY��v��09�~j�s�s�H?^��)�M���}T~}�B'����� ����B��;);��.Y��)Z"$B(���!QW��E�n��ޑ6n�n�hV��f�S0�=U�>���R7p�o��n`[����5�%b������$-�w�����F Oi�X�-4 ;yF,No��q�D�j^=������8����%�p��~�@o|�����W�+C�e��ϕ��?Pⱎ�Bu�nf���mAB�9��c����E������?��c|�ɗ�H�"�Ͷ��G��"ƲM��R �0"{�u�q�ߦJ���گc��'���')_�t�ص*�`�XR���28�M��j<Շ���&w'h� _�41�&�5�ы��|�*n��B��U\�9^�נu�t��<]��ӈz���Ǵ��P���l�Ȣ���������:�%�>Jw$�kqضVi���߸�I�\e:��a$�x)��E��(CVq�m�nq:>aP��ȋLQ��aA]�؆(����N��ٕ8�'iѬd>@�Vd90Hp���z2� E|>����j��{��@�{N�=(��Ui��#�١�yO�5;��w���ۊkP>F��`~ D�aR�DF�o�L�e��B)�j 4����,@IR��KσJ��T�;iE�}�^t�#��i`2f��t�O��½��GԾG⧀��ٟwY�/�VY��'�D��0�sG3��@c��fm^�f*N��Yd�</�8�E����tm[�� ���2�$�e��6S�&_��cq�2!.�K�V�0�;�]6�sp�]�� ����z������O���eޜ��ʼ�0���`����H�������a�k�k�x)��vz������s�l�����i���!���6�0q��6���֨2$~%FZ�t�g�$5V'��>��t�Sq�Y��J^�w�MR��5�W�Ã���o[ ����qΟ�1�E��O����Nd^fK�o��k. ���PRC�ơ���a�Q�X%B?ї=�XV����R����-�F���Y���`Vq�W&�}qgҞR��3����Ȋ��`��I�kL�vBc��t������2��-��&�����"�6P���P� ���j���,]��n>z�J�ltSMq3���1�r��zb�L����;B�`�ʘ��F�xHTd]��t\p���=�5��T�[����R\�E��`I<���� '4�j���#�R/AI������"��hC���$|i��1y��W"#8��x��c� ���X��V{��0�&F_�peݸxB���h=gx�Y�Ϝ\��uES�� S��)}�r �(|�5S�g�վ��[f����Td/b<��bౝb�#����@��x�6��L~.N�#���XEz���r��vD����$�3Y�O�hW�-�'��>*��lf �ޱ��s�T������j[��I�`�������k�GBC0�"�"V�4'P`03z_�M��ߏw�}�Lj2Xj��\���b��*�+��c����_î��I�F����eg�������Eќ�쥮 K༳*��zmCv����(M���a49Gb�5<_�dVLZ���ꑲ��V�F���>��Cu��}� |EѸ#Zʥ�����V�#��ӡ߳L����-QNH"d�v��
Sections
.text Size: - Virtual size: 363KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax0 Size: - Virtual size: 464KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 786KB - Virtual size: 786KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Xentry Advanced KeyGen 1.1/Xentry Advanced KeyGen.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
���R5��AH�8lM�-[�{�X��d���;$�(mr�Zߒun�����)�z�q���2_��&������|���;f0�j.R��v�L��Yηŭu>�S��W�!/N��psP�s=��X�iY���>���FLW���\�+���o�\��Yy=8����q�ey3�k��!��!JtE�8E��ܘ�'���;Y�E|�2�dV5p@E��;2��c^�OT��>�C��H�a{����M�gfXgk&��.+bU��+��ix���*��˰U���?������5C�9%ķ�o܆�C�`���[�p��AYS�������R��Pr���C��=�K��z���;�c�N������"+� �j\o��U��kxE�w�A�U��^���Ҧ�T�/������� �4* �Wn�t�Ng���J��d�p��_��>����w ���j��Yv�hD#<9�%�'bM=��؏z��A����f�M_�O�f�u�:8K�c1(L:�RrE���Y����I�L�哽�9:��k��N����}x~�� ����?���^�Tvkc:��4U���m�Q�E'�؝��A��g},��� ������-�����{E둀�z���r���v�m�����商.'����4�^�p<��\g���� ��#N�#��|��� ه|�}\��[K���R� ��8��ȣ��D��� Y��i���+W���R�"����9���Ν�M������U����w�ɀ�%���*�#s�3a�_��+r�e��r�ڂ����Z��r%ɠ�=u�������s�na��П7�����~t��-=��u� &��� �R�mW���ؔ]F9��z�S���eɍ��ղ�d!T��ǜFQ�����#T4W�-|�8X÷{�Lw��k�����R��E��$�����͐\! &��ᘩ1�z�#�2����z�n���S�2�t��u�`H\HO�����4�ď�AŢ�P��v��� ��������X"��{j��N�feK�W�C�Xك����ci!:�o�16X�R�y�܋���Z�;=� �`���q(��GP�܉2|���G����/-ͨQ]P0�Gv�����h���9�&cr� �@_DQ�� x���)��_��w$՛��2�O�6��D��(�Ԫ�K�`�겉�B��*�/sa+�?R�M�w�<��2R���@d\�G�&��_�j�Q��rR.�&R���lP�"���Փ?����T�D�X��g�ڎP�����n���D��QH]��1O8����q���rol���27���B���U��a2.����U4�#����<,q����/�˖l��_��%�X�I\�&:��(�J�z+S���-#n�d�X��FE�7a~�ҟ�O��$H΅��7�:���W�e�4i���nqp��yY��s��p��%�v$Fk*�@��Cf�m{�$.��iE��O����_�v3����+=���YT���������$j <RW����HaǴ��W�{h���g�&^Y�lI7rkK�b�=��.��8���z{#�/?�D�o�_�S!H�$�T�� Z^/O��w��l� W�JY�'����{�1�N/�:3���9�w�C,p|�V��5��ʙ1���Xv�H��l�����J�rr�Zd+G�I���n����W���!���P�=6���D5�35Dlk��o�|@�U�OA��>�g��W�v'L�Q'�=��!�rɣ�잹��j�U�4�CA4��V�[Һ)C�+��*��<���!p�8�� E-eљ!��] .]�d��1�1��R༌uj}��i���) *In ��큋{^Η۔����Qk�I�9#�5%�Vش�?琉��q^L6�2�D���d���ތ_f)�]�Õ�to��%�x��3'��5/n ���m��"��M�"��&m(�v.�뗩q,S7����yv��T�&La=#����ڄ���^� v��y\�:���n���$��80I����i�<b:X~������#�"�;o�K�7&,!)�٫ܶq�����1����Y@�5V����)7\$A��2j���$ZK2�Aqsv_�!�OM�1Ǝ�J����y�G��H��?eI=���u�*~���h�h���GE�6^����#;>4�iԢ��c��4Te�yaI"�p^2uG�C��fCGjKSj��#7첲3�H}��կp����S�4}{{1�����E��'i�xxb�v������(R�B���#��s>,î������&�B���=�� �;���6A�|(��9�/s0��sy�:�6U5A�G�-�Qd����b�����6d}M�_֩*a>4�b��[�2�/�����S��Ā"����s[���y��f�>t:�w7�\50��!�T�yf�� ���Y�u(�=ݾ}5����Ft;<Ӧ'22 ���v�U�3 �ȣ:V�����n�<I��nU�LG�z�=���ƴ<��{c.�.���5{5٧s���-*l0}�TN $������3��:�U!]��S�%��Lo�ଵ��K�ۊ�d�B�pEn��ik��(:�'���!�l�۸M/�&�AM<Eԅ�c���x).��nQ!�#g�a���O�-vQjVf;������x��e�^pԡUO;���I����zUX����..�#�3gV�\� ;U^�a%�����Х�6o·t��ڞ��-�z��Ӻc3�@ ������#5�!�!��t��Lj���� )p�5�@F�!����ì��a�܌��� ����+}��Qn#�Ƶ���E��^�8�.*D��O�iK�pz=/#?�&0P������,Ƌ]�������ꇮMs�T+@���kT4�����iB���֬��3%��uE�>[KD�)5yOU�p&� ��_�S��,g�i�L��r�<=���P!�(�nԲ5��8.2O+�(��#�*;cb�EC�Ʊ��5�)_c`TL�v��!����> ��56����C�O�|��b���Q��{W �X�)�������Yp�Z^v�����!�{��s�Nu�!�x��Xp�Y\��@ %ݾ�� Fup���b,nD����_,�C�Q��ۚM�>�l@oI�q�T&+��Uh�(i˓�5ԛ���cdq�A�Jļ؏�tD�[(�Κ�K��0��d���t���N�^�Kd̊17���B��#��)p��B`2S�py ��O��s`��c��$��0 }�����0W��]����f�1�~� ���9 $^V� �����1�9�#���0�/l j �o|�/������%�,� H�,���[B ֔�L����Z$�o �Ɵ�]�#)�U&L ��I��WXc�ݝ�ܗ�h?.�!h�%7������d(� �,|���C�xϳLT��u�b��ܽ��k9r-p��?� �[��f����L���8^ad�Ӛ��v|��[y��~��Y����l�-�J��;��2x���#�(-�M(�*�mA`ш�� ����z�1I�,���C%��T!�-���Mh�����X�b0���(Go��{����zR3����FE��[�m�D���*�IUK�D����i�����W���/���_���漅����&�"�����Q�嬬��&<�>����.�ٛ�C.#X�#�Y��{VT'P�@*���s�1 ^��L'D�Vt{��ky7�K1������
Sections
Size: 493KB - Virtual size: 1016KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 108KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 34KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 139KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 190KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Xentry Advanced KeyGen 1.1/version.dll.dll windows:5 windows x86 arch:x86
4c2dcdc7d37a5d9142e63baf09976aab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
d:\NsStudio\Tools\Baymax\InjectDllx86\bin\release\version.pdb
Imports
kernel32
DisableThreadLibraryCalls
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
GetCommandLineW
OutputDebugStringW
GetTickCount
Sleep
ExitProcess
CreateThread
GetModuleFileNameW
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapSize
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
VirtualAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
shlwapi
SHGetValueW
PathRemoveFileSpecW
user32
FindWindowW
RegisterWindowMessageW
SendMessageW
shell32
CommandLineToArgvW
Exports
Exports
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueIndexA
VerQueryValueIndexW
VerQueryValueW
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ