D:\yunyi-code\yunyi-cleaner\bin\kscsys.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f76258d09e1c59d5dac131f22bb750a2d6c1b4a1bccbd5d889452db86b4cb37aN.exe
Resource
win7-20240903-en
General
-
Target
f76258d09e1c59d5dac131f22bb750a2d6c1b4a1bccbd5d889452db86b4cb37aN
-
Size
570KB
-
MD5
76d131c19380d564cd4f21211457f530
-
SHA1
e0307255c37b774c625c833a5287a138bebd9b22
-
SHA256
f76258d09e1c59d5dac131f22bb750a2d6c1b4a1bccbd5d889452db86b4cb37a
-
SHA512
ef1fbbfc0277c37c5ac186f0cefb26dcc071c997a8d3f1a53c7ddc4600a3b2134977707887629966fc033d108adeb0dae3f7acb4dce2026e48dffbdaae0db7c0
-
SSDEEP
12288:W/ixUo9GlkfvJKBmCS0M4niRb6azoSvmstP/xJK+cZC:W/iHiwpvB9/xYG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f76258d09e1c59d5dac131f22bb750a2d6c1b4a1bccbd5d889452db86b4cb37aN
Files
-
f76258d09e1c59d5dac131f22bb750a2d6c1b4a1bccbd5d889452db86b4cb37aN.exe windows:6 windows x86 arch:x86
31ed3a5f1951b3fe98d116016a9d8ff5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
TerminateProcess
GetModuleFileNameW
ExpandEnvironmentStringsA
FindClose
CreateFileW
GetModuleHandleA
MultiByteToWideChar
GetLastError
CloseHandle
ExpandEnvironmentStringsW
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReleaseSemaphore
WriteConsoleA
WriteFile
GetDynamicTimeZoneInformation
LocalAlloc
GetCurrentThreadId
OpenSemaphoreA
Sleep
GetConsoleMode
GetFileAttributesA
LocalFree
GetCurrentProcessId
OpenFileMappingA
FormatMessageA
MapViewOfFile
WriteConsoleW
GetModuleHandleExW
GetStdHandle
GetCurrentProcess
FindFirstFileW
GetModuleFileNameA
GetProcAddress
ReadFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateDirectoryW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
ReadConsoleW
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
HeapReAlloc
FindFirstFileExW
FindNextFileW
SetEndOfFile
advapi32
RegCloseKey
RegQueryValueExA
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
AdjustTokenPrivileges
ole32
CLSIDFromString
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize
Sections
.text Size: 377KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 13KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE