yuki-external[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
yuki-external.exe
Size 1.3MB
Sample240922-t1eggayglm
SHA256 b89f85766ebbedae2f2052f0b242efcf1f3c9ebc0e17923d6eb27c6b6a46577f
MD5 084c54a28f7e7dc7dbe3d782af1fd27e
SHA1 ee3d8524e879c71f1c21f4c7bca0458ba97b0af8
SHA512 64a8975384822a1b804af0c250326c54405a0d9087c71e85af8191404d56109b0d63078e6811ca3ce2d62a90be2f348e99931ef8c8d7ab442db456951eeecc9d
SSDEEP 24576:hbXK7Ey3FqbWFvs6fJ/jm3GFZ2KK1HnZGarKDx+8e5c:OH9FFB/U5KCnCK5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
yuki-external.exe

File Explorer

yuki-external.exe

.exe 1.3MB

yuki-external.exe

IMPHASH 72286ac68f5d9d6f3670b97196a169b7
SHA256 b89f85766ebbedae2f2052f0b242efcf1f3c9ebc0e17923d6eb27c6b6a46577f
MD5 084c54a28f7e7dc7dbe3d782af1fd27e
SHA1 ee3d8524e879c71f1c21f4c7bca0458ba97b0af8
SHA512 64a8975384822a1b804af0c250326c54405a0d9087c71e85af8191404d56109b0d63078e6811ca3ce2d62a90be2f348e99931ef8c8d7ab442db456951eeecc9d
SSDEEP 24576:hbXK7Ey3FqbWFvs6fJ/jm3GFZ2KK1HnZGarKDx+8e5c:OH9FFB/U5KCnCK5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1022592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\luis\Desktop\@yuki\src v1\@build\yuki-external.pdb

kernel32

MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx SetConsoleTitleA OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemDirectoryA QueryFullProcessImageNameW GetModuleHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect CreateThread DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError TerminateThread lstrcmpiA Process32Next CreateToolhelp32Snapshot Process32First GetModuleFileNameA SetLastError QueryPerformanceCounter FreeLibrary VerSetConditionMask QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA WideCharToMultiByte GlobalFree GlobalAlloc MultiByteToWideChar GetTickCount GetTempPathW GetCurrentProcessId GetProcAddress CloseHandle GetModuleHandleA GetCurrentThreadId CreateFileW VirtualAlloc GetCurrentProcess VerifyVersionInfoA SleepEx LeaveCriticalSection EnterCriticalSection FormatMessageA GlobalLock GetConsoleWindow GlobalUnlock IsDebuggerPresent VirtualFree LocalFree DeviceIoControl Sleep

user32

SendInput FindWindowA GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture GetAsyncKeyState GetKeyState PeekMessageA MoveWindow UnregisterClassA PostQuitMessage ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow RegisterClassExA SetCapture SetCursor UpdateWindow ShowWindow GetClientRect SetProcessDPIAware IsWindowUnicode ClipCursor ReleaseCapture SetCursorPos GetDesktopWindow GetClipboardData MessageBoxA EmptyClipboard DispatchMessageA SetClipboardData GetCursorPos GetWindowRect OpenClipboard DestroyWindow GetSystemMetrics SetWindowLongA SetWindowDisplayAffinity GetMonitorInfoA DefWindowProcA CreateWindowExA CloseClipboard SetLayeredWindowAttributes TranslateMessage LoadIconA LoadCursorA

gdi32

CreateSolidBrush

advapi32

GetTokenInformation RegCreateKeyW RegDeleteTreeW RegCloseKey RegSetKeyValueW RegOpenKeyExA RegQueryValueExA OpenProcessToken AddAccessAllowedAce GetLengthSid InitializeAcl IsValidSid SetSecurityInfo CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA ConvertSidToStringSidA CopySid RegOpenKeyW

shell32

SHGetFolderPathW ShellExecuteA

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?uncaught_exceptions@std@@YAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Thrd_detach ?_Random_device@std@@YAIXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Mtx_unlock _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

ntdll

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry RtlInitUnicodeString NtQuerySystemInformation

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr strchr __std_exception_destroy _CxxThrowException __std_terminate memcmp __C_specific_handler wcsstr memcpy memmove memset strrchr memchr __current_exception __current_exception_context __std_exception_copy

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free realloc malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_onexit_table abort _register_onexit_function _getpid _register_thread_local_exe_atexit_callback _initialize_narrow_environment _c_exit __p___argv _resetstkoflw _invalid_parameter_noinfo __sys_nerr strerror _crt_atexit __p___argc _exit terminate _beginthreadex _cexit _seh_filter_exe _initterm_e _set_app_type _invalid_parameter_noinfo_noreturn exit _initterm _get_initial_narrow_environment system _errno

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fgetpos __stdio_common_vsprintf fsetpos fwrite fread _fseeki64 __stdio_common_vfprintf fgetc fclose fflush ftell __acrt_iob_func fputc fseek _wfopen __stdio_common_vsscanf fgets _set_fmode _pclose fopen fputs feof _lseeki64 _get_stream_buffer_pointers _open _close _write _read _popen __p__commode

api-ms-win-crt-math-l1-1-0

cos ceilf cosf atan2f acosf fmod _dsign fmodf __setusermatherr sinf powf sin sqrtf

api-ms-win-crt-convert-l1-1-0

atof strtoull atoi strtoll strtod strtol strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _stat64 _fstat64 _lock_file _wremove _access _unlink remove

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-string-l1-1-0

strncpy _stricmp _strdup isupper strspn strcspn strcmp strncmp strpbrk tolower

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 _time64

ws2_32

WSAGetLastError ntohl gethostname bind sendto recvfrom freeaddrinfo getaddrinfo select WSAStartup __WSAFDIsSet ioctlsocket listen connect getpeername getsockname getsockopt htonl closesocket accept recv htons ntohs WSACleanup setsockopt WSAIoctl WSASetLastError socket send

normaliz

IdnToAscii

crypt32

CertEnumCertificatesInStore CertCloseStore CertFindCertificateInStore CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore PFXImportCertStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindExtension CryptStringToBinaryA CertFreeCertificateContext

wldap32

ord26 ord22 ord41 ord50 ord45 ord60 ord27 ord32 ord35 ord79 ord30 ord211 ord46 ord143 ord200 ord301 ord217 ord33