C:\Users\jack\Desktop\Yui\YuiNT\x64\Release\Yui.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Yui.sys
Resource
win10v2004-20240508-en
General
-
Target
Yui.sys
-
Size
16KB
-
MD5
fe6e9f0d7bc330091a81f87d23501e59
-
SHA1
b8459a3ba32ba0b8bd6e5cee01a617c0470dbd95
-
SHA256
e7d0e47b9d1f90fb0a444df4813d4b100dfbcb5156da2f9c9c17cc2b35684ed5
-
SHA512
0126b829966deb7e954ed9956541529dcc831ee7db5b98d6e2465b17eddbda058ac239cc853288c09f6f7f40b0468aa44f418ace3e88019d39fefd2c522f2faf
-
SSDEEP
192:r1zdH3333333333333333333333333333333333333333333333333333333333Q:r1zdVf75RdsOyaC5bgCyp54bziet
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Yui.sys
Files
-
Yui.sys.sys windows:10 windows x64 arch:x64
4fea08672b1216d59c3380d92c39ba59
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
KeInsertQueueDpc
KeInitializeDpc
KeBugCheck
KeLowerIrql
KeSetTargetProcessorDpc
KfRaiseIrql
ZwQuerySystemInformation
RtlPcToFileHeader
MmMapIoSpace
PsInitialSystemProcess
MmUnmapIoSpace
MmMapIoSpaceEx
ExAllocatePool2
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
KeDelayExecutionThread
KeAddProcessorAffinityEx
KeInitializeAffinityEx
KeRegisterNmiCallback
KeQueryActiveProcessorCountEx
KeDeregisterNmiCallback
MmProbeAndLockPages
IoAllocateMdl
MmGetSystemRoutineAddress
KeBugCheckEx
strcmp
hal
HalSendNMI
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE