d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ad6dc84d3dcec2dfb39e0e74ec7162b6e2cd860b9383cf8abebfdf8723c10238.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ad6dc84d3dcec2dfb39e0e74ec7162b6e2cd860b9383cf8abebfdf8723c10238.dll
Resource
win10v2004-20240802-en
General
-
Target
ad6dc84d3dcec2dfb39e0e74ec7162b6e2cd860b9383cf8abebfdf8723c10238
-
Size
1.3MB
-
MD5
d74460a5f639f283d986f27d2815dc98
-
SHA1
6449146dc8c3e585b4b66481221e5c9bc3c7a930
-
SHA256
ad6dc84d3dcec2dfb39e0e74ec7162b6e2cd860b9383cf8abebfdf8723c10238
-
SHA512
46c33c026cadcd11a0035bea56dfbfe9bc6334efac79e2849c469765cab685bf09bdea2af2724e4541fb90cf39e4f9bde0e822c965fbe69c7ef4d41d86525595
-
SSDEEP
24576:syXrbprozekA3dJG7xjOeGtqYVYkXTY6TTdTatPo0QT0PiQjVRY:sGVoyJ3C7xjTGtqYVYkXPlTaW9T03a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad6dc84d3dcec2dfb39e0e74ec7162b6e2cd860b9383cf8abebfdf8723c10238
Files
-
ad6dc84d3dcec2dfb39e0e74ec7162b6e2cd860b9383cf8abebfdf8723c10238.dll windows:5 windows x64 arch:x64
6c66827ef435d573f209060a5c13f54d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadStringW
ole32
CoInitialize
version
GetFileVersionInfoSizeW
gdi32
SetTextColor
Exports
Exports
ChinaPYG
�텂f;e>y��@�ɶ��ث�-���La͵�u;�1����� RDn{{yń&��e�={3�����8J7Lb3��a<���Ck��|�*�(J���F�[D`�X���FȀ����M�b<§tUe�}�C���'�������&��_�1�\j|q#/��Xm��N���/G��g�ŴS��@E ?',��M���=��"�)��khu4ߊE��U��]8��!� +�+�R2"O��[0��K��U�����de��̤I^�}?��'/3�9~x4�1i���;��;�;�m��.�����b�W<�HF���1�����M�� 6Nn+�^.d��<�k����nz�7�U}�����'��;8�V���o�)kPB[�-��eQkr�^^�+ȇ;��&�t��o���y~s�|�;���Ͽ(*f7��Z� �Nz��@�SR�&�0(6�I�����f��Z��k��@.��-M�*YU�V���g���l�!^�h/��$�J2�i��\0r:R��Q}^�����G�a�̀���$ټ�]S�����Kg�?���<檓�"�ܛ�=a�2;Lty���5�(�2��=P����*�_g����0�u��JB[�h#���.�+@D���8�Rx[���3>GA>��5�����4�M���!�� R_4͖�ax���@��Ę#�g�l�]�m��wuvp�"�k=��ꐃ</>k��b�d0C^���������a�ӐX����/PR�!�/�F�x*��&RѤ���l��ں�]��M��7l�G ~�jO��g4N$��yA�)j5�:v톺= zNx�xT�����23���,6=�Vs��lv�ٿ�ȁ~��q��N;��$����v[��A������Ҝ�ޙ�M�6�dӌ���N`���x�����o7E<��G Ϲ�7������zC.����}B��h���z2'<A� ��(��"�D�&�%��H�s�;�E]�c����Ll�9�D�W��En)������4�\��{�, �l�q�W!8�m?������u+�eRt1<J�P��l�.,��G����>����n{�tS���ܗ�u+�:���b�[�L� ��W�/�����Y2��y��U���D��q��keN�V�E��jE��i)��s^����|���L�P#8����6A�``�=�7ӱ�ZQ��*�8��*����DY���i/��c�>£�a?��x�QQ�g�����u�T��>��6 VΤ�k�t��j��<�� �u���,��姺rM*����ݑ���}�o������L̆��xk�Ynj���_�[+E͜v �CE��+<#�~���U`�z.����O~��ã��w���;�;�D'�Z���r�*F�����iǐ�6�o@p#���sxFR�a�����$R�8�*O���"����z;3 M����g��9K���LO_p�R�z��/�ϝ!�C��9�*�{`�-�E�_,Y 5_��������3�;9,h���I'��㎒_}�9���5fF��EϢ_�������G� ���.3u���6)�$���~��p���u5~�"��J�a0/=+J�����"���_|(~5=�ZZ��W�F2 �~t<���l�sxO�2�-L'��oGm�g�k;���US�Z����$oޔ�̄呷q�:; IV��J���v�n��d{�8�~�_���X�~N�]pJ��8�=�Y[�)�QQ�/��Ez��4�g��(µ�'.�ʒ��ҷ�� �[c%���bo�BP!�!I��}���L0�h=հ�7K�� �F>�t�`�$��S���þ^"�ځi��x/�0����+�K�+��� �w��n$>-�Ϋ=� &���̓��y���ɑؘ<]=/²�e�>�v��EE�S��$4<����0��b�6Y�6�KMo�ݣ�,��BXx)�"��ʍ�Z�-7M�� &���=�ۺZ�YYX#�h�wEzn�$F�*Yxy qab;�ঋ���\?_6��� +=�K�@�J��<Eo����mE>�M6�q�C��qv:F?K�&A�}���le�#�PC��l��.��v`a@g3��i��;��2�ܿ�om�5�����K�"�K�0 \Q�X�w�I��`רJLA�fĖ�#T�m! �%٢D�Z[�^ޘ��:7Z��X��2ˁ����h3�eF�k)h������@ d�1T\�P�W�r��PcS�p`C!���'�4��1�#�3ikP���#�_{N]^�O�G���A�!���sA�a�<F����w�R#f��L�=鈌�OĄ ]*�]�ע�+� [�KGB/�z4Z�����b��u8�uM{f�� �����;Zy�y%�C�| �����d���B p�U:�/@�� �߷��b�w���SHg���!�֘"��\�L���G�>Vړ*�^ɐ�O�&i���_}L͟u�NQ����͕Λ���ю��GA��'�K�hn�~��k�����d�Y�v����U��{�������L@����`�eu-]�>u����Ԩ�>j�� qM� []i�E���x�^��w_ ��yẊ`Ph{���Cԑ@ �8��}&����� �THB@Ty=z_k�<c��Y�&�ܻ�w�M��g�j ��tV�!�r���?��F֊.4fDM�!�é1�� ��6,{����%�;�Ȉ3���G.^�����&���\�zO����!���$MXE-��ů���r��6�o�a����px��pu '�^jF��9��_�)Uo�?�֭x�li��,�b)Y~TAyG�n����u�Dr�S�re/]�����e�G�B�x/M�O�w�l.`I��ܲn�T����ԯ���ts���CS:���)�zXB�hԙz �Rɻ�Nޭoa�����Qy���CA�2^�]4���(��d��|�<���LBd�Py��ODv�阙4Io�N���K5��3��5��N���\8�.QѤ#��0����Jn�hC/4#KO�h��q}l��5��=yz�pP#�� �"�����I����^����lvQ]��9f�8�1h]��*vo���$��EO,��W0������53 ��R�''�� SE
Sections
.text Size: - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 840KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ