DotNetRuntimeDebugHeader
Static task
static1
Behavioral task
behavioral1
Sample
yxlnqs.exe
Resource
win10-20240404-en
General
-
Target
yxlnqs.exe
-
Size
32.7MB
-
MD5
c5d73e5af1ab3ecaa5598110a5c7bd55
-
SHA1
89d4b6539ed0ceda964cb18d396740e5579dce9f
-
SHA256
e28ea5c9e2ec5b6ab6e7f4e4a24f6183af331db278691a4febf83ae4626ac56b
-
SHA512
96a0d85f4254f04b90ffe2000ce9d382267bfa233d60e4472964d8ac2831b34b04caabe5bcf8bd90d9bd35162a58aa3db559e3f3602aa447b9b67064a3d2d65b
-
SSDEEP
786432:XJUlo17lZND584YL9/dfZV6PFDQWCCC57m5/nx0LX:5Uur98BLxV6PqR7mYL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource yxlnqs.exe
Files
-
yxlnqs.exe.exe windows:6 windows x64 arch:x64
09f927dbf84bb0ffa458894140f1fc0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCloseKey
bcrypt
BCryptGenRandom
crypt32
CertNameToStrW
iphlpapi
GetAdaptersAddresses
kernel32
RtlPcToFileHeader
ncrypt
NCryptOpenKey
ole32
CoTaskMemFree
secur32
GetUserNameExW
ws2_32
GetAddrInfoW
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.managed Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 442KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
."G5 Size: - Virtual size: 22.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.~:E Size: 1024B - Virtual size: 552B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FN8 Size: 32.5MB - Virtual size: 32.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 208KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ