d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x86\PYG.pdb
Static task
static1
Behavioral task
behavioral1
Sample
76cfee876d4fe7a490506229925779f86b7706590a3cf206145a452d724ad2bb.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
76cfee876d4fe7a490506229925779f86b7706590a3cf206145a452d724ad2bb.dll
Resource
win10v2004-20240802-en
General
-
Target
76cfee876d4fe7a490506229925779f86b7706590a3cf206145a452d724ad2bb
-
Size
1.0MB
-
MD5
4141fedab8074a1ae0995ec7d92c5493
-
SHA1
068227c1634b06bd5ea9dbaf8dc56a30b137fb07
-
SHA256
76cfee876d4fe7a490506229925779f86b7706590a3cf206145a452d724ad2bb
-
SHA512
7f18b49e6a5f251e9e4b8ac3a743aa81d22f4c93cd37016691e4810f27f166ab8fe061478ef99c43683691d4b24f312df4c9231fd63de7a24ee4621b72d5e56d
-
SSDEEP
24576:8HoPLZ8PrLDfAkyUv06B8wC8RnhWyMaM10vOFvPQtC7YqkHL0T:7Z8PfDf3y5QBCanhnMXCvOFGsYqkHLQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76cfee876d4fe7a490506229925779f86b7706590a3cf206145a452d724ad2bb
Files
-
76cfee876d4fe7a490506229925779f86b7706590a3cf206145a452d724ad2bb.dll windows:5 windows x86 arch:x86
12c81bbd6b30f1fb977cdd3af195c1fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
shell32
ShellExecuteW
ole32
CoUninitialize
shlwapi
PathFileExistsW
version
VerQueryValueW
gdi32
SetBkMode
Exports
Exports
ChinaPYG
���w$~��7w�^�+t�L��4������Hu���k3CsQd6�b{���QmT��܀��Ys9].a.A]��|��غ0䨬X��BT�����z���u�r��6�^` ���BA�ZB�<���q�C��c1����֙tZ\�Z�0�m>?),�� t�H�A����o�@�<����z��<�����)( ���Z� 8<�=��b�l�U��C���U��6�6/�WU!n��������mPcuU���*7��������M�8$Om̈́zƝ��۸|`�?�J��Z1|�l���S�3�E���������J�������b�:����#�|M�ʄ��K�En�E�ЀQ���ǥ�r���e�B��hW{j W��9))�7-�����;�R-��1H��M����;(��^�w��ši��9��r��� �ALR��������l��t�w�����c��$4q�t E���L¯A���F�H'�)䍌��XU!e�ɥ- ��J�6m��ȓO���3Ȁ���0�B��)��b�8�ͽ�#q�E��ˌr�vh��� �iNz�`���������D��ԧ,qՠέ�f�\�F���� '͌���Ӻ<���)��/rθ��w;�UΜs�v���_��e��S�t��g�z;.��CS����P�-c�N��U�Vt���*�� C�ߠ�M�G��U` �2�?|��l7Uy���Rjۧ�ȹ�\�l7�ˤ~Q$NN]���}�� A��;�R����P9 ��L1NE��m7j�)F^��``Q^� �p��/ #X�BU��`�[���J(���Cv�p&��E�$kCI_�:W^3-� Y�~5�y�2r�<"}Y�v���(|�K˼�:�P�u�"ϟq�ep�� ]��g����Une4w�hy��W�n�"F"��9{Gu���{� �����B��F�3�}uv�@�C�>�����0Q��+6"�7�@Y㯓Уw:�b���^�\k�[�z �����������G*������H�Ʋc~�!.)�����i�bC~-����=�솩�x�k|��?,.c�-t�Ѩ<���e�@�j��8����&jx�1E3N�*1F����3�����۵��Y16����{z5�7`+�nuF@Y ��QS�.�"���z*I��CFr���5^J2��X�}�QrA�"�)�2�:�Ya����c2 w�@bdl��r$��N�H��Ɋ�����M���{�D:������a�S=�?Q@Lj�<��"��ld|��,1��Mf��:1��J��YY�D'�U��(����IM��1Hi�'�m^e�Z�K$R 5o���d��&�o���ך�M&���\p4EtQ���8(>F����R��z^ �گ �W�_M��a8����?���� n&��l�K%�9`�*G7��.��&C�i�p%��p���W*�me�8��q�� �bp���{�+� 9懳\�:'����?�YrB]��U�Z�"F �O`��M�V���DW��p�����3V'�wB���E��<奋`��+������|:��r0,���E��t�¸7���0�t��#�/l�a�N���/����YB��u�Q���0����Dj� �5��䣋�f��{i }���&�H:Yn"�E���nS���S�!���4�OIQd5Fh�~52�"��p��7*������� ?Z9ۥ��yx�����u���ۮP�XW����b���Ǣ\}e �o�OD�t��^p[�Q$&<vd!�Bi�y���k�mh_���B*�t���l�F:�C��4矜x��1�O㧩bX�9 �.AFZR�p�ya��C��ZqZ[����:��Ia�.������E�-*��cLw�{V�h�M�C�'����)��֤s}1�/Gb����ϖJ#�2'��L� ��_kM�ªv3J�Ҫ��l�����U\����Մ���G�o*k��"�@^��������=+�<9)�?ji�J}�,���u�_� �I�����>J�د�Z����~�vw�ţ� 9�Ok��2�[��m��>��n�Ez�#�G�m����#�j��S�|&0��%���E�*4f�E�{;]�|�K���7�����2�l�%�C�nl���HV,��� ��T�(��Jt�z��FSμ�o�c��3���T4�@(�������zY[$45��6y~4.� qA�#B "�O��i�FȇD�K������ͯR/t�Su�g�����F�ضݯ}�@�A���'�VM�<֪�/���7E�h]T�m�]�<&]�C�Z�&��˝��g�� /%�GĄ>R6�Δ�mS�5/p+��F��D}�:�x�'*2�8�o���� �$Ӗe�{<�?�(]FeU�Ǣu��m�6�U�*9�@t���h �wdğ)81a�igb���UV��?�Q��@�����1]�z�0���U�C~�(+��m��Wg����#��E M>X���U�Au�2�����������{���b@B��GK�I::}E�<��2�����`2��?�{�l�V�{���aH���籉$���?�����J�*�jj��ơ��l��G)w���A �dǤ����L�l(I+�68�Kr���s7O�Ti8��A뭙p*���P�@<���J������?�mK��=� 3���������h�%���R��!ۣ���V^j��鐳sI7�x��L_��e�Y�Q��1����T/��T����[���%��y����q� ��W:�v��кCg�"��b�<�Y�B�X�Ԛ=4���A�"',2��/ah#C56����P�D�5�V��.1'�ѺW�s����.6�~X����}ܪI��o��H�:pF`�н华���`�m����` ��F���<� � kM��Xk�Z��0X���|�S,?���OU��<� ؚ�&˦�!��0Q���Ov��[#�⧨���˥^���"��ҎN��tw��Z���x%}�����F����P!qz�x�]���"���(�_k��i㚒5©r��q-�OX�� ����^�naM��$r���^�����;ļ
Sections
.text Size: - Virtual size: 452KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax0 Size: - Virtual size: 514KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ