d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x86\PYG.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4b9a9eda32c271ddcf1296f86314760ebbbd6750df726782ac209f3ec8a1a95a.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4b9a9eda32c271ddcf1296f86314760ebbbd6750df726782ac209f3ec8a1a95a.dll
Resource
win10v2004-20240802-en
General
-
Target
4b9a9eda32c271ddcf1296f86314760ebbbd6750df726782ac209f3ec8a1a95a
-
Size
1.1MB
-
MD5
91433c1e8a1c54f934421dbe3e9974b2
-
SHA1
f3fb8b5751ce711e63cb565955ddfefae0d79434
-
SHA256
4b9a9eda32c271ddcf1296f86314760ebbbd6750df726782ac209f3ec8a1a95a
-
SHA512
78f765c6b46eff1f12628c16737f30e701277d6a40ad19c8f9baf94cb4be461a55ecb94ed0d08d72c3d9f62b833d290951ad89f8449723ef51486baf2f1155e4
-
SSDEEP
24576:sx256dCEIsBlpLia8fKhqg6mYtUoSklJdZ8KnHR5FqNLSvAVorrfBh6Itew1:I2kkElBLLivKhqg63Co5VnH7OWbrDf6Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b9a9eda32c271ddcf1296f86314760ebbbd6750df726782ac209f3ec8a1a95a
Files
-
4b9a9eda32c271ddcf1296f86314760ebbbd6750df726782ac209f3ec8a1a95a.dll windows:5 windows x86 arch:x86
d4767dd97f9a5516b2bbd27c0bdd2c0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GlobalUnlock
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindow
ole32
CoUninitialize
gdi32
DeleteObject
Exports
Exports
ChinaPYG
��> �Cʬ4k�4�k�+��F��j���n*���UCJ�e�j(Z��Ξ�PF2�G��;�w�C#2R��Ba0����& ��b��6 ��͠�!��T�/8P��'$w�y�{{�� ŀ�-fn5��j0����6�����-I�1yt5��E��8��>@�5�F�'�ߠc�J�k[�Wh�k��'Xop��x�-:RZ{T�ec��cA��(�#��E@�[������� � k6�[$ģ~p@JE�?�\�؇"oxX��/ vj���0l6F���{5�z�֍\�������G����U�#[�.��b�x�u/�z&$d-���m����$��^��'���qy��첳�=��� 3k��Y�]�_R�� �F�r�D a&4��m;A�V���zEr��q9E�Fyڀ�;�fg�P1��{6���b�@e/U�� C4�2���l7�=�mI@t��ŝ�<�|��e��9y����T�W������6N|y�H�{W�JGA�>h��E���<��e��.�2��I���f+u����]@�3Þ��Dsz �܆6z4��~CG~\ �l��FTq$3V����4�5`?����OA�jNg$b$���.zg4�f������z��!|�9�/k�Эb�a9`������֟%˭��I��͠B��,�k�t �Z�};_iޓ��O��������#��:=��x9 �����vx�"�s��7'�{6�1��N�dQz�!*g,�i�����,7�顄�����͚hP,�+b������",�?��a�F���5[��}xUcE���3í��bd� �1���R�T�)n� ��75�B\�gOzb�l�ɸ��bjƈ�m�/E�C�F�D��� �$���8�1��bA������r���~��L��LA���`"�V�P6��;�Z"�9����d�GQ�R՚�IY�����Kˮ��9��_J(P�O�6�K�s?��i��F R�I�\���V4-w5BA3$T�c�č_�d����c���] zÒ@3Y�ƪ���}�saΕ������7D�o�6�>n�E�6�q?~������Ȑd�W�F�4RB"*%�Hl� D^Y���{(��������7��,��<����'$F����}�8u�S .��>�(���w�=Y�c&ˆ%�*�c5w�C�1���[���x�"QaRkG��!�%����7��p�_��k��/�J�>� ��X�ލl��ǯ�UA�W��,{����˲���ƛI]�_Y5+�L���<�е�A����A��|��/�}�ɝ�-:��a��l���<X�u��gf�~��}P��Z}+m,�ۄ��>+p-U��n�ߥ��C�����A�=�����C ����j�)��=�(��������Y��.#r� �*5�٢��~::��`;��땴-Dهӽ ��(��G_i�I�\')�Y�а)�쟥w�ݻ-lh<xu� ZB/��"\kG��m��eS^C'WA���s��� ��@���3�m��l��x:.oY��U�P����:݅�ˁ����.�#Ad��pC�*�\���uiSuY*4I��1-<@L���c���{O�<��[�u8�#0}M1��s�Ov�C}R�q�XO�7�� �m~�[��o�/M�O�Qf�mp~���aW�r��� 7a�M�6��h��g �(��#s9�A�8|]���P���b���,��qWW��'?�$��6���31��=;GA�v��|���v��Ɣ����U��dP]��7��Dvk!hzke����y;TxȮ����.�/FV�Z;��@��a}p�A�[��>� P��c/ %z�8_��Ι/=��ʣȪw��N6���o�=q�-�F(( a��'�v�!�~��i���! Pu��Ϸ���U�1<�]���O�`�@��B��� hdT3`2����%l��tp��!̽��@(����0z�����,u��tب��ÿ�ӟ��` `���A�ud��q����r{����VAw�_U��ό=�&����y"v���u|�9���ׇ@�{��������h�~�k���H�����ȕH�����Pi6w����YF��]��h�J;�"Qn]i^ Ϫ��hn�97w��?q*���C�����c�mEX �VO�Xh+�����f� )���(��1���dK��5:�n+R"����{�!�*.Ϻ�<�c��>Ɠ��L�h���㹗`�s�I�Q��1�,��gi��8<����7��>���� d3��l�E�i�2�*N��W"定cB�$d&4�m�?�<۲�y��;^l�K�/��f��8��}��C�����;�GvOƆ��,���o��-�����)4mʍ�>�m�=��#�}0TV��c"���lz��u��>[r�.&��ܙp+�QCQ�~��SR-y5#�8!�n��D���B�o"�li������u=q]ЂU *)C è;bTP[.$�%�gO4r������b�]�Hv�D���ޔ}��N�=H 铈�f�Dm%h����pч~qN�s9n�Rk !��݊e/<\� q�|�џ��azD�t���D�'ؔ}�g�ݕgi*t�/:o<���-���+9�ݦ�%��F�G?<Y._Տ$��S���,�1� O���MnCph`P{s�]�s۠�q��8?f��0 ��r����Cq�(�����fň�ub���������ݩ���ܡ:{��69e~_��i}]������*�]h���(��Mw^��V�|��]�(�������o�ʶ;�N*Fj �� %�(QgӁ�Z�H������fJ<�]�:� �Z����7nˤ�!O�a:���N�&kI >���T�p��g_��Zl��{�� �����L+��r����ӊ�@�L2k�+��-�$|�N���S�>���ZL��.�$�L'L����KJ�#�S���2�V�͆�V&_|��V��Z T����#��aX�I+zI����K�< �=�=��l� =d�*R�f1X����c.tt)_�M�"��t��/l���WI˝�r����dWƕ�rL��*�Ʋ�èDf��3��V��e�b>l <⏆
Sections
.text Size: - Virtual size: 471KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax0 Size: - Virtual size: 605KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ