d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b496861028c33b4a5a037445499e4a210c3946eecf674be9043f9e8a20738eec.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b496861028c33b4a5a037445499e4a210c3946eecf674be9043f9e8a20738eec.dll
Resource
win10v2004-20241007-en
General
-
Target
b496861028c33b4a5a037445499e4a210c3946eecf674be9043f9e8a20738eec
-
Size
1.3MB
-
MD5
c11e5f4e20eb780d6fbce5ca9b99ce53
-
SHA1
25926f835ed06ec74fe8920b091e5a416360c6c6
-
SHA256
b496861028c33b4a5a037445499e4a210c3946eecf674be9043f9e8a20738eec
-
SHA512
f8153e100e3791c6380bb4a1bab2c3d0a401f198924c683238ec23f7522e2ca416323df2cebd12a12877195f1b0b1f41d1e2fe7639d85bcc1b9eacc1cd36d0a6
-
SSDEEP
24576:ZdsTjpIsqRRROoaLut7GnAW9UeP3W7Hp3TJgHemDA6UhrGfifSB93G4xKNAA:6OLhaSu/e7Hp392nE/4SSB93GJAA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b496861028c33b4a5a037445499e4a210c3946eecf674be9043f9e8a20738eec
Files
-
b496861028c33b4a5a037445499e4a210c3946eecf674be9043f9e8a20738eec.dll windows:5 windows x64 arch:x64
f500aa64fe5766d56f43bd18f6680486
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
ole32
CoUninitialize
gdi32
CreateCompatibleDC
Exports
Exports
ChinaPYG
\Mo�y�� h5ׄV����vn,(�ZR��L2���|j3ZQIKMDz�����Yڷ��}��;hvtXY�Oi��kEE-n����,:ˑ�����#$T5�M{�T�hm����fmZQ�Ԉ:�yn�T.���� ʈ��_��,�l�H)�L8���T�D>�w���Vt��]��Z��m@õ:�c+���7�պ-��x_B^��x!��2�}������$D��o�M�0���V@�����魚V��Ie�I��t)���&�-�XCj�=egZb�o"g�yh,��>;�Qc�4�e�!�-@�O����휯���\�� m^S��փ�d����x mpփl�U)S��^9�Ϸ���0_��O�|l��TT�IΚD�;+�K�8oy5�T�%����������9���Ɨp�q�[�� � 4s�����bS��&�zsQ��t�]�E��E�����iOؚ�/��t��I��1�~o��ɾ��2h�����8A��^�T^R�-C�J!V��'ܧ�8X^���y��m:oTZ�d�I+0��Sn��cQ�Q�O�۾jx�~*�C �A�:&D�V���uM�/"p�H�]�9�M5ύ��U�U�R���^u���+(�D��C�{�L�1�j��锴j���c�\^����KP'��"@���u���x���61��f�|յ3_K6"T�uj^�;��.��p�S/�֪9F��slv�I���SP�_ �w_����E��~8����3�.������t�vR�PnO]���o��#�si���o�Sa��p/�8]��dU��¿q�M�HE�o(��=��I)��������i��4�>b5��S�o��*�w"Z8��J"��C��_p�0ߔ�ܽ�7��,|�g�mAr� r� !�<�/��<0��WyU����m���격r�����>/�5;�G�vó�����8����aT�`X�_ΠFeL��o�J- !��� �2�7t��Mq���O0uͱv���1t6��Po^'�L��u�b��i��$<U5�;�|B ����]J4B8���w��o^��+�"�8-�h�,۪U�qs��=�]�����@�n.�~h�g`�I$j(����wa*Ja>%� �����YZ�r=/5���UN���l�{�엷�n+2��x����+/���$�Kɫ��}Gvl�`�u��mr|$�� YbD�W b�Z��a�y�y1���ZlC�T^���:1k7�ӫ�0�d�0�Y/� ��G �X�7���8�Wo���#���q��t}I��\�������d�x�TϺ��4�]v���#%UuM:��UՑ��["�Q���@s��ŸW�[�u��O�<�~�����X��feZ�Y�����~��H{�{o3���2]� ��^�Dk�#q�F�9'������D�7��<3Q�V�g ͜&J'�tc���R>�쯤�Fdsp�)��0��m��"X�]�~�5���������V��/ Z�[iξ+�Y٫-E�P��n)��4����P�e�����J,�ʱ D��lK��\#���������_��&��;�L���'x��;��k-Q�,���(rT�8����d �N% ��4�:@E]������%��)�<�*P��)���u�BK�ċٻ�/C���Ƹ�F��~�w�iHl�T��j��t����⯳~xF� @l%H��� HM/0Č�� qlj�// MQ�Zi�m!U�`4�����5tG�0�����B�L=[43��$������v�!#��K븧����bDܵ|����W9t�������ʛ���Un ȯ�l�� 9�c)�g��7�(�"6��뽒8Γ�rZ�b��mE)Z�$����DP�|��E��{T�� �|��o~taw%���(��4�U�\d�lU�̙���%8��Z S[5=�C.�tj1��}t��<�F���Li�D �[�%�U�\h����m�7�7� r�{��p�+!+��Kc���߹ ��&@��n�4F��^�(�#38W�l7��I�I����f��]T�,�0�T�G3�7��ط��䃏H�,��N��^���]6���cg�������!�2�u�l{��ؾW�5�� ,T�;r� �)���x��F|,0?ਫ���U@�']�s��7x����o�X���d�[%�>��.]��W$�o�;��/�~�W��no�U7�k��j����\L��A'ku<n�N�iw�:� ��?Jx����� �J����|�Zn����qo��%��śs^���H5)%[��ol�^F/I���S��k5e��� ��B���L��t�A���RtÔ�zyl�GF �D4#��F��z`��d0P�k�Gd��v&M���MI��:�ZU���x�G�����Q����� CA>T���lyP �D����$.1R�����������Y���U��E?O�W������1�l;���eؼj�6�4ub�91����ҥ:�y��_{�V/��&�fG��!�������9E����c@�w�������d3X��K���Kq�N�2sz@�^����0ag��b��Ǭ֞0Ӹ���kNݧ����Xz�0��d~w��� �L`a��c�#�� Bld�1�4{�����]�f�Ɲjk;m�4��g�[))� �IQzb{HAl�VdJ��� 40�%��M�Ɲ�+�!pRV��,c4���7���l���&�,�m{�A�W��j�B���Žo�@��z�PB�:D���3�f�R\�Π�[��`���vMO�,w��M������ܹ����펂m �h,M��:��zl����m����%dh��7 7�W){d�X�D\��8�=�B�"��z���_�`��5+ٓ�P}&8�:f�dz����q��(�=���9<1��D�T��}�N�A� g݉��w�� ���R�>�٪� d&�(���g�~�#r��[ƚ�ff����V�8��Sr1��9���5���\�V�:��|�Dw>M����H~����O���Z�e�K.�N��oXDR<�@���@�,�%w�����q�[sÕ7r��^T�X���5�0C��B{�!�؍
Sections
.text Size: - Virtual size: 585KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ