d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PYG64.dll
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
uxtheme.dll
Resource
win11-20241007-en
General
-
Target
YT Saver .dll Yama.rar
-
Size
1.3MB
-
MD5
5e2ff219e89f43f8254f7a8c503d5f76
-
SHA1
adf702b10b7e79aa488c03458d9db8ec90e9b97b
-
SHA256
74ef97b76fef99ba25c0c37f2afade42d19c566c4c2ae3700fcec8e55e9c8d35
-
SHA512
44bf9eaef201f1a563626c4845858af6165ebb577d0a27de44dc7320f766acac7a6376368b454457bda2911b6aee0f368a561e8d8219a3c3356e256f7a3aeadc
-
SSDEEP
24576:ZD6bxfA4n3+V7qQTuQS/HcrdLTnK9mnuaQI9ZCGnQYaF+oNtg43hjJFf:ZDIq4uV7TTujPcFTnGmnnudhRN5
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/PYG64.dll unpack001/uxtheme.dll
Files
-
YT Saver .dll Yama.rar.rar
-
PYG64.dll.dll windows:5 windows x64 arch:x64
f500aa64fe5766d56f43bd18f6680486
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
ole32
CoUninitialize
gdi32
CreateCompatibleDC
Exports
Exports
ChinaPYG
\Mo�y�� h5ׄV����vn,(�ZR��L2���|j3ZQIKMDz�����Yڷ��}��;hvtXY�Oi��kEE-n����,:ˑ�����#$T5�M{�T�hm����fmZQ�Ԉ:�yn�T.���� ʈ��_��,�l�H)�L8���T�D>�w���Vt��]��Z��m@õ:�c+���7�պ-��x_B^��x!��2�}������$D��o�M�0���V@�����魚V��Ie�I��t)���&�-�XCj�=egZb�o"g�yh,��>;�Qc�4�e�!�-@�O����휯���\�� m^S��փ�d����x mpփl�U)S��^9�Ϸ���0_��O�|l��TT�IΚD�;+�K�8oy5�T�%����������9���Ɨp�q�[�� � 4s�����bS��&�zsQ��t�]�E��E�����iOؚ�/��t��I��1�~o��ɾ��2h�����8A��^�T^R�-C�J!V��'ܧ�8X^���y��m:oTZ�d�I+0��Sn��cQ�Q�O�۾jx�~*�C �A�:&D�V���uM�/"p�H�]�9�M5ύ��U�U�R���^u���+(�D��C�{�L�1�j��锴j���c�\^����KP'��"@���u���x���61��f�|յ3_K6"T�uj^�;��.��p�S/�֪9F��slv�I���SP�_ �w_����E��~8����3�.������t�vR�PnO]���o��#�si���o�Sa��p/�8]��dU��¿q�M�HE�o(��=��I)��������i��4�>b5��S�o��*�w"Z8��J"��C��_p�0ߔ�ܽ�7��,|�g�mAr� r� !�<�/��<0��WyU����m���격r�����>/�5;�G�vó�����8����aT�`X�_ΠFeL��o�J- !��� �2�7t��Mq���O0uͱv���1t6��Po^'�L��u�b��i��$<U5�;�|B ����]J4B8���w��o^��+�"�8-�h�,۪U�qs��=�]�����@�n.�~h�g`�I$j(����wa*Ja>%� �����YZ�r=/5���UN���l�{�엷�n+2��x����+/���$�Kɫ��}Gvl�`�u��mr|$�� YbD�W b�Z��a�y�y1���ZlC�T^���:1k7�ӫ�0�d�0�Y/� ��G �X�7���8�Wo���#���q��t}I��\�������d�x�TϺ��4�]v���#%UuM:��UՑ��["�Q���@s��ŸW�[�u��O�<�~�����X��feZ�Y�����~��H{�{o3���2]� ��^�Dk�#q�F�9'������D�7��<3Q�V�g ͜&J'�tc���R>�쯤�Fdsp�)��0��m��"X�]�~�5���������V��/ Z�[iξ+�Y٫-E�P��n)��4����P�e�����J,�ʱ D��lK��\#���������_��&��;�L���'x��;��k-Q�,���(rT�8����d �N% ��4�:@E]������%��)�<�*P��)���u�BK�ċٻ�/C���Ƹ�F��~�w�iHl�T��j��t����⯳~xF� @l%H��� HM/0Č�� qlj�// MQ�Zi�m!U�`4�����5tG�0�����B�L=[43��$������v�!#��K븧����bDܵ|����W9t�������ʛ���Un ȯ�l�� 9�c)�g��7�(�"6��뽒8Γ�rZ�b��mE)Z�$����DP�|��E��{T�� �|��o~taw%���(��4�U�\d�lU�̙���%8��Z S[5=�C.�tj1��}t��<�F���Li�D �[�%�U�\h����m�7�7� r�{��p�+!+��Kc���߹ ��&@��n�4F��^�(�#38W�l7��I�I����f��]T�,�0�T�G3�7��ط��䃏H�,��N��^���]6���cg�������!�2�u�l{��ؾW�5�� ,T�;r� �)���x��F|,0?ਫ���U@�']�s��7x����o�X���d�[%�>��.]��W$�o�;��/�~�W��no�U7�k��j����\L��A'ku<n�N�iw�:� ��?Jx����� �J����|�Zn����qo��%��śs^���H5)%[��ol�^F/I���S��k5e��� ��B���L��t�A���RtÔ�zyl�GF �D4#��F��z`��d0P�k�Gd��v&M���MI��:�ZU���x�G�����Q����� CA>T���lyP �D����$.1R�����������Y���U��E?O�W������1�l;���eؼj�6�4ub�91����ҥ:�y��_{�V/��&�fG��!�������9E����c@�w�������d3X��K���Kq�N�2sz@�^����0ag��b��Ǭ֞0Ӹ���kNݧ����Xz�0��d~w��� �L`a��c�#�� Bld�1�4{�����]�f�Ɲjk;m�4��g�[))� �IQzb{HAl�VdJ��� 40�%��M�Ɲ�+�!pRV��,c4���7���l���&�,�m{�A�W��j�B���Žo�@��z�PB�:D���3�f�R\�Π�[��`���vMO�,w��M������ܹ����펂m �h,M��:��zl����m����%dh��7 7�W){d�X�D\��8�=�B�"��z���_�`��5+ٓ�P}&8�:f�dz����q��(�=���9<1��D�T��}�N�A� g݉��w�� ���R�>�٪� d&�(���g�~�#r��[ƚ�ff����V�8��Sr1��9���5���\�V�:��|�Dw>M����H~����O���Z�e�K.�N��oXDR<�@���@�,�%w�����q�[sÕ7r��^T�X���5�0C��B{�!�؍
Sections
.text Size: - Virtual size: 585KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
uxtheme.dll.dll windows:5 windows x64 arch:x64
8b990a02d9eff7bd4479034e75c91c23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
d:\NsStudy\Home\InjectDllx64\bin\uxtheme.pdb
Imports
kernel32
DisableThreadLibraryCalls
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
GetCommandLineW
GetTickCount
Sleep
ExitProcess
CreateThread
GetModuleFileNameW
LoadLibraryW
OutputDebugStringW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapSize
GetModuleHandleW
RtlUnwindEx
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
shlwapi
SHGetValueW
PathRemoveFileSpecW
user32
FindWindowW
RegisterWindowMessageW
SendMessageW
shell32
CommandLineToArgvW
Exports
Exports
BeginBufferedAnimation
BeginBufferedPaint
BeginPanningFeedback
BufferedPaintClear
BufferedPaintInit
BufferedPaintRenderAnimation
BufferedPaintSetAlpha
BufferedPaintStopAllAnimations
BufferedPaintUnInit
CloseThemeData
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DrawThemeBackground
DrawThemeBackgroundEx
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeParentBackgroundEx
DrawThemeText
DrawThemeTextEx
EnableThemeDialogTexture
EnableTheming
EndBufferedAnimation
EndBufferedPaint
EndPanningFeedback
GetBufferedPaintBits
GetBufferedPaintDC
GetBufferedPaintTargetDC
GetBufferedPaintTargetRect
GetColorFromPreference
GetCurrentThemeName
GetImmersiveColorFromColorSetEx
GetImmersiveUserColorSetPreference
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeBitmap
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeStream
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThemeTimingFunction
GetThemeTransitionDuration
GetUserColorPreference
GetWindowTheme
HitTestThemeBackground
IsAppThemed
IsCompositionActive
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
OpenThemeData
OpenThemeDataEx
OpenThemeDataForDpi
SetThemeAppProperties
SetWindowTheme
SetWindowThemeAttribute
ThemeInitApiHook
UpdatePanningFeedback
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ