yiff-patcher[.]exe

Target
yiff-patcher.exe
Size 472KB
Sample240617-wmbvjaybqa
SHA256 e00388356146e2346a4b5f699cd222732d02242c65764650d77cae5ebf4d1089
MD5 7ad46837428260d0882bfecaeb855546
SHA1 391ed1de614e439cc6fb3d8abd0210633edee949
SHA512 005b5349a5b826aebd516c7b808014cb0cd92ff01bc4f4bb45041adf22a38a30d5634889cf85c87361233ab8c243222abc049f05d4391d92b2261abe0690550a
SSDEEP 6144:7lhpExVAjyoj5PIN9tIyMAAMUGjP9kRIkyUtP0QfGz4cmNc6koXcJvhFlUZ:7lhpXeTtyAzdjFaIkyUtPaUTC6yhYZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
yiff-patcher.exe

File Explorer

yiff-patcher.exe

.exe 472KB

yiff-patcher.exe

IMPHASH 63311f3da5b4aa556ab7bf632aa58f77
SHA256 e00388356146e2346a4b5f699cd222732d02242c65764650d77cae5ebf4d1089
MD5 7ad46837428260d0882bfecaeb855546
SHA1 391ed1de614e439cc6fb3d8abd0210633edee949
SHA512 005b5349a5b826aebd516c7b808014cb0cd92ff01bc4f4bb45041adf22a38a30d5634889cf85c87361233ab8c243222abc049f05d4391d92b2261abe0690550a
SSDEEP 6144:7lhpExVAjyoj5PIN9tIyMAAMUGjP9kRIkyUtP0QfGz4cmNc6koXcJvhFlUZ:7lhpXeTtyAzdjFaIkyUtPaUTC6yhYZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

351440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CreateFileW CreateMutexA ExitProcess FormatMessageW GetCommandLineW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryA MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleMode SetConsoleTextAttribute SetFileInformationByHandle SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter TryAcquireSRWLockExclusive UnhandledExceptionFilter WaitForSingleObject WaitForSingleObjectEx WriteConsoleW

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Name

.text

Size

347KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

852B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

67B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

yiff-patcher.exe

kernel32

ntdll

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic