YT Saver 8[.]0[.]0 - HaxPC[.]net[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

YT Saver 8.0.0 - HaxPC.net.rar
Size

128.7MB
MD5

99913157faffc9bf7a89d0733d759c80
SHA1

b0716709a9ca8b94171837a1a66919996eea9e01
SHA256

20b8bed3b85f278579ae5eecb833667ca84f8b5fe8a457d29b2e9f288ac5ea4e
SHA512

a4882c85541dee1444de718b0d4a9df7acffed69bc864e9172a03a28ada26e71d733ffe8a0afa6d38bdb65d848f75f0ac4c291517b90fecb6454699649be409d
SSDEEP

3145728:8qQiBxgw+mTCO+JE6R/Vt9b9bYdI3vXFajIdBumkNA:8qfx3TcJEOLUI/Xoj6QA

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/PYG64.dll
unpack002/winmm.dll
unpack002/ytsaverw Hijack Patch64.exe

Files

YT Saver 8.0.0 - HaxPC.net.rar
.rar
Setup.exe
.exe windows:6 windows x86 arch:x86

eb5bc6ff6263b364dfbfb78bdb48ed59

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13-01-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:31:07:74:ae:30:76:21:91:6c:51:2b:01:26:50:ac
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05-01-2023 00:00

Not After

04-01-2026 23:59

Subject

SERIALNUMBER=91440300MA5HAMWY88,CN=Shenzhen HappyDog Technology Co.\, Ltd.,O=Shenzhen HappyDog Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13-01-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:31:07:74:ae:30:76:21:91:6c:51:2b:01:26:50:ac
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05-01-2023 00:00

Not After

04-01-2026 23:59

Subject

SERIALNUMBER=91440300MA5HAMWY88,CN=Shenzhen HappyDog Technology Co.\, Ltd.,O=Shenzhen HappyDog Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:80:30:81:b9:63:d0:92:52:1a:6a:90:ef:7b:c2:d6:cd:e0:56:e4:72:5a:97:87:66:7f:42:64:3d:7f:99:2d
Signer

Actual PE Digest

be:80:30:81:b9:63:d0:92:52:1a:6a:90:ef:7b:c2:d6:cd:e0:56:e4:72:5a:97:87:66:7f:42:64:3d:7f:99:2d

Digest Algorithm

sha256

PE Digest Matches

true

8a:cd:dd:02:cc:68:e0:6d:df:e9:95:51:e9:21:0f:57:51:03:1b:11
Signer

Actual PE Digest

8a:cd:dd:02:cc:68:e0:6d:df:e9:95:51:e9:21:0f:57:51:03:1b:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW

oleaut32

SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 660KB - Virtual size: 660KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
YT Saver .dll Yama.rar
.rar
Hijack Patch Picture.rar
.rar
YAMA 1.jpg
.jpg
YAMA 2.jpg
.jpg
YAMA 3.jpg
.jpg
YAMA 4.jpg
.jpg
PYG64.dll
.dll windows:5 windows x64 arch:x64

6c66827ef435d573f209060a5c13f54d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb

Imports

kernel32

FlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

LoadStringW

ole32

CoInitialize

version

GetFileVersionInfoSizeW

gdi32

SetTextColor

Exports

Exports

ChinaPYG
�텂f;e>y��@�ɶ��ث�-��La͵�u;�1�� RDn{{yń&��e�={3��8J7Lb3��a<��Ck��|�*�(J��F�[D`�X��FȀ��M�b<§tUe�}�C��'��&��_�1�\j|q#/��Xm��N��/G��g�ŴS��@E ?',��M��=��"�)��khu4ߊE��U��]8��!� +�+�R2"O��[0��K��U��de��̤I^�}?��'/3�9~x4�1i��;��;�;�m��.��b�W<�HF��1��M�� 6Nn+�^.d��<�k��nz�7�U}��'��;8�V��o�)kPB[�-��eQkr�^^�+ȇ;��&�t��o��y~s�|�;��Ͽ(*f7��Z� �Nz��@�SR�&�0(6�I��f��Z��k��@.��-M�*YU�V��g��l�!^�h/��$�J2�i��\0r:R��Q}޼^��G�a�̀��$ټ�]S��Kg�?��<檓�"�ܛ�=a�2;Lty��5�(�2��=P��*�_g��0�u��JB[�h#��.�+@D��8�Rx[��3>GA>��5��4�M��!�� R_4͖�ax��@��Ę#�g�l�]�m��wuvp�"�k=��ꐃ</>k��b�d0C^��a�ӐX��/PR�!�/�F�x*��&RѤ��l��ں�]��M��7l�G ~�jO��g4N$��yA�)j5�:v톺= zNx�xT��23��,6=�Vs��lv�ٿ�ȁ~��q��N;��$��v[��A��Ҝ�ޙ�M�6�dӌ��N`��x��o7E<��G Ϲ�7��zC.��}B��h��z2'<A� ��(��"�D�&�%��H�s�;�E]�c��Ll�9�D׌�W��En)��4�\��{�, �l�q�W!8�m?��u+�eRt1<J�P��l�.,��G��>��n{�tS��ܗ�u+�:��b�[�L� ��W�/��Y2��y��U��D��q��keN�V�E��jE��i)��s^��|��L�P#8��6A�``�=�7ӱ�ZQ��*�8��*��DY��i/��c�>£�a?��x�QQ�g��u�T��>��6 VΤ�k�t��j��<�� u��,��姺rM*��ݑ��}�o��L̆��xk�Yǌ��_�[+E͜v �CE��+<#�~��U`�z.��O~��ã��w��;�;�D'�Z��r�*F��iǐ�6�o@p#��sxFR�a��$R�8�*O��"��z;3 M��g��9K��LO_p�R�z��/�ϝ!�C��9�*�{`�-�E�_,Y 5_��3�;9,h��I'��㎒_}�9��5fF��EϢ_��G� ��.3u��6)�$��~��p��u5~�"��J�a0/=+J��"��_|(~5=�ZZ��W�F2 �~t<��l�sxO�2�-L'��oGm�g�k;��US�Z��$oޔ�̄呷q�:; IV��J��v�n��d{�8�~�_��X�~N�]pJ��8�=�Y[�)�QQ�/��Ez��4�g��(µ�'.�ʒ��ҷ�� [c%��bo�BP!�!I��}��L0�h=հ�7K�� F>�t�`�$��S��þ^"�ځi��x/�0��+�K�+�� w��n$>-�Ϋ=� &��̓��y��ɑؘ<]=/²�e�>�v��EE�S��$4<��0��b�6Y�6�KMo�ݣ�,��BXx)�"��ʍ�Z�-7M�� &��=�ۺZ�YYX#�h�wEzn�$F�*Yxy qab;�ঋ��\?_6�� +=�K�@�J��<Eo��mE>�M6�q�C��qv:F?K�&A�}��le�#�PC��l��.��v`a@g3��i��;��2�ܿ�om�5��K�"�K�0 \Q�X�w�I��`רJLA�fĖ�#T�m! �%٢D�Z[�^ޘ��:7Z��X��2ˁ��h3�eF�k)h��@ d�1T\�P�W�r��PcS�p`C!��'�4��1�#�3ikP��#�_{N]^�O�G��A�!��sA�a�<F��w�R#f��L�=鈌�OĄ ]*�]�ע�+� [�KGB/�z4Z��b��u8�uM{f�� ;Zy�y%�C�| ��d��B p�U:�/@�� ߷��b�w��SHg��!�֘"��\�L��G�>Vړ*�^ɐ�O�&i��_}L͟u�NQ��͕Λ��ю��GA��'�K�hn�~��k��d�Y�v��U��{��L@��`�eu-]�>u��Ԩ�>j�� qM� []i�E��x�^��w_ ��yẊ`Ph{��Cԑ@ �8��}&�� THB@Ty=z_k�<c��Y�&�ܻ�w�M��g�j ��tV�!�r��?��F֊.4fDM�!�é1�� 6,{��%�;�Ȉ3��G.^��&��\�zO��!��$MXE-��ů��񎊭r��6�o�a��px��pu '�^jF��9��_�)Uo�?�֭x�li��,�b)Y~TAyG�n��u�Dr�S�re/]��e�G�B�x/M�O�w�l.`I��ܲn�T��ԯ��ts��CS:��)�zXB�hԙz �Rɻ�Nޭoa��Qy޵��CA�2^�]4��(��d��|�<��LBd�Py��ODv�阙4Io�N��K5��3��5��N��\8�.QѤ#��0��Jn�hC/4#KO�h��q}l��5��=yz�pP#�� "��I��^��lvQ]��9f�8�1h]��*vo��$��EO,��W0��53 ��R�''�� SE

Sections

.text
Size: - Virtual size: 581KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Baymax0
Size: - Virtual size: 840KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Baymax1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.BaymaxN
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
YAMA INFO.txt
winmm.dll
.dll windows:5 windows x64 arch:x64

8b990a02d9eff7bd4479034e75c91c23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\NsStudio\Tools\Baymax64\InjectDllx64\bin\winmm.pdb

Imports

kernel32

DisableThreadLibraryCalls
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
GetCommandLineW
GetTickCount
Sleep
ExitProcess
CreateThread
GetModuleFileNameW
LoadLibraryW
OutputDebugStringW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapSize
GetModuleHandleW
RtlUnwindEx
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers

shlwapi

SHGetValueW
PathRemoveFileSpecW

user32

FindWindowW
RegisterWindowMessageW
SendMessageW

shell32

CommandLineToArgvW

Exports

Exports

CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
OpenDriver
PlaySound
PlaySoundA
PlaySoundW
SendDriverMessage
WOWAppExit
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
sndPlaySoundA
sndPlaySoundW
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ytsaverw Hijack Patch64.exe
.exe windows:5 windows x64 arch:x64

b8310707ef91d33125f153ffadec77d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

MulDiv
GetSystemDefaultLangID
ReadProcessMemory
GetCurrentProcessId
VirtualProtectEx
GetProcAddress
GetSystemDirectoryW
GetVersionExW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
WritePrivateProfileStringW
IsBadReadPtr
WideCharToMultiByte
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetExitCodeProcess
WaitForSingleObject
Sleep
DeleteFileW
CreateThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
DeleteCriticalSection
RaiseException
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrcmpiW
CompareStringW
FreeLibrary
LoadLibraryExW
WriteConsoleA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
FindResourceW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
HeapReAlloc
HeapCreate
HeapSetInformation
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
GetStartupInfoW
HeapAlloc
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
WriteConsoleW
GetConsoleOutputCP
SetEndOfFile
GetProcessHeap
SizeofResource
LoadResource
LockResource
CreateFileA
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
CreateProcessW
GetLastError
VirtualAllocEx
WriteProcessMemory
LoadLibraryW
QueueUserAPC
ResumeThread
TerminateProcess
CloseHandle
LockFile
GetFileSize
ReadFile
UnlockFile
lstrlenA
OutputDebugStringW
DebugBreak
CreateFileW
MoveFileExW
WriteFile
SetFilePointer
GetModuleHandleW
lstrlenW
GetCommandLineW
GetStringTypeW
LocalFree

user32

CreateWindowExW
GetDlgCtrlID
SetWindowLongW
GetWindowTextLengthW
SystemParametersInfoW
GetClassNameW
GetFocus
GetSysColor
IsWindowEnabled
FillRect
DrawFocusRect
SetWindowLongPtrW
GetWindowLongPtrW
CallWindowProcW
OffsetRect
LoadCursorW
ScreenToClient
GetCursorPos
GetCapture
ReleaseCapture
SetCapture
PtInRect
SetCursor
InvalidateRect
CreateDialogParamW
EndDialog
DialogBoxParamW
IsWindow
SetRectEmpty
DestroyWindow
DefWindowProcW
MessageBoxW
PostQuitMessage
CheckDlgButton
ClientToScreen
TrackPopupMenu
IsDlgButtonChecked
GetActiveWindow
UpdateWindow
GetParent
GetWindow
GetWindowRect
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
LoadMenuW
GetSubMenu
GetSystemMetrics
LoadImageW
RegisterWindowMessageW
IsDialogMessageW
GetClassInfoW
RegisterClassW
ShowWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharLowerW
PostMessageW
wsprintfW
AppendMenuW
CheckMenuItem
GetDlgItem
ModifyMenuW
SetWindowTextW
SetDlgItemTextW
BeginPaint
SetRect
DrawTextW
EndPaint
GetWindowTextW
EnumChildWindows
ReleaseDC
GetDC
SendMessageW
CharNextW
CharUpperW
LoadStringW
SetFocus
UnregisterClassA

gdi32

GetObjectW
GetStockObject
CreateFontIndirectW
DeleteDC
SelectObject
SetTextColor
CreateFontW
DeleteObject
EnumFontFamiliesExW
GetDeviceCaps
SetBkMode

comdlg32

ChooseFontW
GetOpenFileNameW

advapi32

RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW

shell32

CommandLineToArgvW
ShellExecuteW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

SysAllocString
SysFreeString
VarUI4FromStr

shlwapi

SHGetValueW
SHSetValueW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW

comctl32

_TrackMouseEvent
InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb5bc6ff6263b364dfbfb78bdb48ed59

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:31:07:74:ae:30:76:21:91:6c:51:2b:01:26:50:acCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:31:07:74:ae:30:76:21:91:6c:51:2b:01:26:50:acCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

be:80:30:81:b9:63:d0:92:52:1a:6a:90:ef:7b:c2:d6:cd:e0:56:e4:72:5a:97:87:66:7f:42:64:3d:7f:99:2dSigner

8a:cd:dd:02:cc:68:e0:6d:df:e9:95:51:e9:21:0f:57:51:03:1b:11Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

version

user32

oleaut32

netapi32

advapi32

Exports

Exports

Sections

.text Size: 660KB - Virtual size: 660KB

.itext Size: 6KB - Virtual size: 5KB

.data Size: 14KB - Virtual size: 13KB

.bss Size: - Virtual size: 25KB

.idata Size: 4KB - Virtual size: 3KB

.didata Size: 512B - Virtual size: 420B

.edata Size: 512B - Virtual size: 154B

.tls Size: - Virtual size: 24B

.rdata Size: 512B - Virtual size: 93B

.rsrc Size: 79KB - Virtual size: 78KB

6c66827ef435d573f209060a5c13f54d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:31:07:74:ae:30:76:21:91:6c:51:2b:01:26:50:ac
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:31:07:74:ae:30:76:21:91:6c:51:2b:01:26:50:ac
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

be:80:30:81:b9:63:d0:92:52:1a:6a:90:ef:7b:c2:d6:cd:e0:56:e4:72:5a:97:87:66:7f:42:64:3d:7f:99:2d
Signer

8a:cd:dd:02:cc:68:e0:6d:df:e9:95:51:e9:21:0f:57:51:03:1b:11
Signer

.text
Size: 660KB - Virtual size: 660KB

.itext
Size: 6KB - Virtual size: 5KB

.data
Size: 14KB - Virtual size: 13KB

.bss
Size: - Virtual size: 25KB

.idata
Size: 4KB - Virtual size: 3KB

.didata
Size: 512B - Virtual size: 420B

.edata
Size: 512B - Virtual size: 154B

.tls
Size: - Virtual size: 24B

.rdata
Size: 512B - Virtual size: 93B

.rsrc
Size: 79KB - Virtual size: 78KB

.text
Size: - Virtual size: 581KB

.rdata
Size: - Virtual size: 1.4MB

.data
Size: - Virtual size: 212KB

.pdata
Size: - Virtual size: 27KB

.Baymax0
Size: - Virtual size: 840KB

.tls
Size: 512B - Virtual size: 48B

.Baymax1
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 512B - Virtual size: 44B

.rsrc
Size: 11KB - Virtual size: 27KB

.BaymaxN
Size: 16KB - Virtual size: 16KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 9KB - Virtual size: 17KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 668B

.text
Size: 394KB - Virtual size: 393KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 9KB - Virtual size: 21KB

.pdata
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 7KB - Virtual size: 7KB