d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x86\PYG.pdb
Static task
static1
Behavioral task
behavioral1
Sample
063f8d8b00834a48f2fa23bac3f20f712e067b66ea96606c55d7f4aac0b20a23.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
063f8d8b00834a48f2fa23bac3f20f712e067b66ea96606c55d7f4aac0b20a23.dll
Resource
win10v2004-20240508-en
General
-
Target
063f8d8b00834a48f2fa23bac3f20f712e067b66ea96606c55d7f4aac0b20a23
-
Size
1.1MB
-
MD5
9d18a8b7ede5bdfbd40e3690340e557d
-
SHA1
fa9d072b21d4e6f1e6720e227ccd30c7fa0bda01
-
SHA256
063f8d8b00834a48f2fa23bac3f20f712e067b66ea96606c55d7f4aac0b20a23
-
SHA512
bdd1ad78b51ef99a5fe8adbf5beefe83b8c9681b04410462d2116102c2fe8b9fc3c9065b44f603314192abd4402ce9fedcdf69a62e1e7bddfd88d1781209a4c0
-
SSDEEP
24576:HoaYCpTtkIWm0f19c/a9P+BtAWSaUFkHlWiSl7h2cUqNT77S:HoaYCV2Vf197hGxUWH+vT7e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 063f8d8b00834a48f2fa23bac3f20f712e067b66ea96606c55d7f4aac0b20a23
Files
-
063f8d8b00834a48f2fa23bac3f20f712e067b66ea96606c55d7f4aac0b20a23.dll windows:5 windows x86 arch:x86
0c706136af5846e16a98dd5b85a43c4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnumChildWindows
ole32
CoInitialize
version
GetFileVersionInfoSizeW
gdi32
DeleteObject
Exports
Exports
ChinaPYG
`|�`K ��^~�{j �����s[�v8��H�������~$㠾����BĴk eJ�?���j_��v�61'�WB��/X縯�D��Ǹ<�,b�y�Ƣ-��%�4����!t���~��3G?���eے���d��u>j��2�(NA������������eZ_����RS��Or�9A咉$I�?a�J��f�Bn������$RJ �zrN^�)�m��`R�̝b��P�p�G>���q �ۖ͠��?,��;И�^�9WF��sw5͛!��nǐODS��N'8._���s�����(c:h�=��^���.���0_JW��;r"��I��P<�툤tB^gk���==�K�8�U�7@�K�8fW�p����0-`�r�_���&���_�(��-5�l%��J7@��&m��̕�PfM�i�M���R���w���|�<v�\���B^���=�T�\g �_��:a�������e�9�;��_ X�4����ɜzElנ,N".�8���6�3�_���}����fy�m5�f��תB]�Ü/~��;Ӫ08I���x5��KN�+����tT�.:~���'J/!~{RK�����Q��/��&�2cOPNyz(J멄��u�`�6�Y(��.&��ϰD�9p���Ÿ��ȶ�j����v���T�ˎ,�69c+J�] �N(�:��mƅ2\oz` S�9| �ua���� �GU���l�hf[!R�z��VB�=&��J�E�$��E�co���U�7�k?p}����� O8�*�2 ��j��j�4!���M�%� �i>������1π����De@'� �l��ޣx*����o��p�®j�t��)�y%�S�'�EE�0��;B��>4��a���{1�y�^�[ʤ:~��t`���y�m�36�a���䎟4��Ӕx�P��DF���H��5:�sg�;G*n�{J�-_Tj��&��~s�S�(U`���f�����x�|D�x� �ҸUН�ǜm,�ho��j��c>\zU�L��_g���PH�O�8�I+'����&��cZ%��ʭ4^��6C ��0����,u�?R���Fnn�?�Č���V$��uف�*�T��_R`G�*ȤF�; C��$C�����W\�h�����7?��s~N��=��ZFඳ�HAV�G��W���D�����yI+���#�����h���@��*�}Ě�g�6�k莀@�Cd�?�I�g��ÙqcG9�Y>��>��LSy��2ǯ��[v�>Ђ�����Cv0k�Yլ�̈��FM�w�b�O%ܖ�*>+Wj%P�bD�`��x.��}��c������E�]�\q���4L�{2&�)²��{��)z*t6x�X�\!m��=��g��/-M���kʾW 3U�)�_�������!�����$��9�P�K_��0�/9�l�M1� �wJ�j:���a)��D�w��;�}z��i�������]�̘�Zf%���q������,d������c�;"e!���������q=Ґ��.��#��W��H[)l���&�B��CÝl��9g��/)��Nfi2_]�+�U��k=�@bn�K�����3�c�vw,������F+�u��]�� �MDښ���G���k;q����n*uE�4��_��1�LB��/��s�@+m��q��P��U�u.�u�d�')�/�ne�s9JSh����LF��6��쒎W,Z;}��T���X��0zNm�H�%7�C�` ��ckw����#�6�T1��S��ŕ��y���A��C��*�o����`����K^zT��� q=,�N&9�uīvyQ|��lZ�|�:J�J�����V�_ H K�B@ b�� (���sUǭ.{�-��k�w国x;.��aF k�e�M�\��ξ�z����%�6L�A.�۪�������/Jt�2H�&����&D�����F�Ǘ,B���� � 1�ϕ�朾�94�g��/�-�瞨 8��H ��k�����D^�g��@x���)��$��7B�C�hh�v�U#Ɵk��K��g�U�76ҍ:KF�x���Ge�M��(+Cƕo�O���R�������.���L�j���6��)� w�mE����b"���0۸0���U���m�;�����ƲsЗ���8V*�?�����P�U���ǫ���V$��{��o�A��8º��bJ_�Bh�O�}+�"��d$^��Fi�@�ӣd����i�M���b(�[l���v�sCQ��T[�<�>{�n����+S��Pĉm���z2Gu���7�w��y�G���Gp�qCg��N�(��}=xH\�M�}g`�jQZB�8�ώF_ѧ��dg�d5�t�����F���I�{ƀF7�R��Q���������d����AY�r9����&��y��4f����Kjh�Ԧ�ۢ't��O�;��� ��袬!u*e^�粖h�V���f�>�!_��;w���J�ɶ;g�� ^%��l �����v�B)[��SB��B�t�=��*v��V����}��*6&�z��X�5A��z�D��.�exww���d��2rT����?aK(mP���4 u_)�6��v!�d�D����6�-I%L����;��Ù�����ŌQ���Gu�W�k�7���`ef|Hi���C@U�s���S|o�?U���7�}�>z�Ņ.� �k�&�o�� �#�p�#���N�89��w��q���v����n��3�7�+����L�s�T��AAV��Ɗ�Ӭ0-Y-�^�4����<�Cf�.Vz�v�|���K��`�~��Y�gz��;-�4:����}��u����J���0�AXA#�w�OS:�u��(�Y�~D����7���Ϳ�KGf�D��M=�CI��C��)A��ь2���S"4�������k�1�ظt/GsB������b�S?��F�� ����F����DmJ �d���QU��^��y��kK��ʓ���J5�nHW�5�p��N���q@nA�X�2��T,�u��m�-Ąr��Ϳ'�FT���MԵ~��-�* ���F�%zIi�o�S���j5����"iW�spO�6
Sections
.text Size: - Virtual size: 464KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax0 Size: - Virtual size: 602KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ