d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c6c2395eaef9b4699a13aabcd6e6df6fda2eec174d2c0a15ac3844ddf01e62ec.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c6c2395eaef9b4699a13aabcd6e6df6fda2eec174d2c0a15ac3844ddf01e62ec.dll
Resource
win10v2004-20240802-en
General
-
Target
c6c2395eaef9b4699a13aabcd6e6df6fda2eec174d2c0a15ac3844ddf01e62ec
-
Size
1.3MB
-
MD5
ce4754633aed2bed96c19f2321b3509e
-
SHA1
ad4813ebac9ca186a0cc36009e2b3c02b4b04571
-
SHA256
c6c2395eaef9b4699a13aabcd6e6df6fda2eec174d2c0a15ac3844ddf01e62ec
-
SHA512
24315e8731f249049b6d4aa8cc3be68dda1952f0c4470a99da8adab8aeacb3e121f3f67a83fca7923b8df55b539740d9a0cad446ab3f788c0f6805d2b7393567
-
SSDEEP
24576:arfbbezHTmKprAA490HN81QRZ05NwtFLtlBxi9n9eKHMUfIBU8Ahd:WGzzJrAA84N81QR25NkxtlW7UBU8AX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6c2395eaef9b4699a13aabcd6e6df6fda2eec174d2c0a15ac3844ddf01e62ec
Files
-
c6c2395eaef9b4699a13aabcd6e6df6fda2eec174d2c0a15ac3844ddf01e62ec.dll windows:5 windows x64 arch:x64
c5d9894eb399117219d1fa379c1a557f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WriteConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
ole32
CoInitialize
gdi32
StretchDIBits
Exports
Exports
ChinaPYG
��:���l%E�L_]*��PQ��Xht�Pՙ�1)�� f#��0/\A�k�Kk��]�fr4�ݗ�ӿe�9j~yE��0��K��c���]!Vm4CRW�Ss���� +��HMԜ���E�`B�(D{����Gi�|� ��zq44s�M������R���PX�g��uMd�Y�����K�RV�J��3�5�ɴ��I,��Zq]vߟ<S�9}E��r��<4��ѓ�ƺ�N[ٿ�B�;���K'��'U`HJ��Rx�X�Y�5����[��W�H"]��>l���G���q�S����~'�֞�&ON�t"��}�_E��6�����cq�}L�����wؑ�I9��9�lzƲd�u;�9J5����@��h���ň��=���)�Ҏ���j�:�쀿�����q�k(�GSKѶ��x�L�M�[Jݒ��hP�S�7�q+r�[���g����Ѻ /��^t�1��Q?ܸ��J.���0M���Nݗ��:�)s�(��fL�w�(C�0؉G�������l�����K^�1����^��y��Ȟ?G3�ce� cD��V�;Br��3�7��oORBA�hJO��t�����ˑ�>5����L��@h���R�V�̢����QC�XNg�9L:[>I��LKRO1�Y{�w��0�3�R���_D8���8�Ϣ�Ie�u��������|�0���0.З���c����<n,N.���i�|sb]��8Sւ� �;^��DJVh���]�ғ�I1�3�,�}�t�a�t������}�O >������*��1(N`�x���"ç&hBulP'-��Y2��}�HĪ`#�_��!�W�V�庌,�~~������������f�we�L�&#{� �&��7dwj+����k8!`��\�4��G�H�H���ߛ��XʣM?�6`�:/ypM���E�3�ͻ��I�&VNa�y+`-���f���a'}������N����e��e�=������.cT��z�+A�-���r[Ϟ���8RZ0pɭ:2m�.n abS������O���-6��j�[�C8��͚��e�����=��"�|[B)`���p�%|��l��ZqnPI+�6����vN��8g u�E���yw.VJ6��V�ƅ7_<N��3���kc��_��G%(t4F��l�;��qt��OJ���J�FW7q)�[e�01�q����T7V�@t!#AY�btz��b�k&f��"��v�#L�A��A�%<A�1��ю���N����?x��#���g�@�����7�oa_�~-<���~k�]5w�H��ܥ�R�>�S��D�>�U/l3�v��� �!���ʮ��������DVL� >Hg��V��[��.���K�����P� U��MD��?�S�"P���O�l� ��lm����yM52�J�65�:�B�_*���*A�Q��"��ZXٕk,O]�{[[��z�Q�������_�e��l-� d�^�wJ7����~-�i���7ո�fXv$���NUx�N3�ɮ;L�*����j��/�!;d�b��Nn���E?����Oқ&PR��}R�"�%�4h��i;?Yuf����H��Q�g�Z�8��xu�yJ�.8k3o��7�٥a}t��;���Q�pA`�o���/\�x���m0�`��[7�Tf:�V�F�W�/�9yS����'��w�I_��sL�z=X���wr�����k,]B4E;?�^F�e��*�5�xB�s�$W`(�0��L��)[MѤ�Z��e)@Qd�p- u���5?R��Q�J���P�AJ�&}7�d��;ҳ���n�1�çd����)1�~q�X��j�u �r������sx E���JquQ�R��7 �lI>�,�ѹ YЅ8ٷdzM��i>���_]���� (/.��y8��%u�צ��Ћ#���=�eN|A��hi�����I=em ��N�Z0��BS9xh�OQ�K�ue�SB�?;��`�tE�$�4�&tu}A���.��Zob���!���E�T(��K҄.B�A��0�t�:�F���>�k�ߕ�M�[CP�X* �.t����<� ��v��;��b|J� � ,@m�����L�ZJ���p�'YH�l.��\��10�ð� v+oI11iJ�W�� n�7=8A7�vl(BYO^8!�[��<�!<YR��I�&�QPo Nb���ZTDf�`u��V��"TD���"|��BC�M�NMn���yh̵�9��V-�u&��C�<:�zmu-4���V�qo������(yE��V�w��ġsp��R%�~ƃ^^�z�Ƒ�0��r�偙l>�N(n�,[1�Z�;px���Ng&����vk�$��"��p���ID��$�T|��� B�|�Q��q�Z&��8�A�g��z1�QA�������1�S��2c�T�4/r�PIt��=q�(�em������A��8��1��pd�����S�mvf�)YtD���"�g��� ���)�J�nj4Y6li��h�� �'TD�����Te��8 ��_]K$W#|2�.ʤ�-�>����c��2�W�G�'ܿ����\X��>�ᅲoޭ����~eh'�v���T���ȼ������k��8?P�Ϻ��av�6˱<��d��. 6�����P������^⳪h��(��~��1�ݜ�#�P�@�0F��б���eZ�P��&�Y��BVz5�p�$<W�rr�0#���R�xi+A��������7g�j�_��*'3���謘�q,�.<�����,�#��C��Ƅҥ����]�Դ��T[�)�R�j�"��� ��E"�veA�A�*�7s�����Ւ=���j ��SF���Y�4d�<����� s����xd��5������V����X|�(��g;�v���XB�s�lWC�;����!��^����8������z���x t?��A�(�ս!���q@�ëh�V��j�t��y�z����OT���9������ tn#-4 ���n����,{�3 NVȝ��c�gW҂���q�?T�����fA$1trY�&������I�����
Sections
.text Size: - Virtual size: 585KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 832KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ