Yandex (1)[.]exe | Triage™

Resubmissions

19/01/2025, 12:27

250119-pm75eaxlay7

19/01/2025, 12:25

250119-pl5mwsxqdk1

Sharing

Copy URL Twitter E-mail

General

Target
Yandex (1).exe
Size 35.0MB
Sample250119-pm75eaxlay
SHA256 ac4ac4ea8b95737df76f962b82b09fe677068941e41367078f51b4f2eb8bc93f
MD5 11b69a108a33ce80a82a7e16ffbc4f12
SHA1 d077c7974ffaabd114dd88dc685e7a8e22a29401
SHA512 49d16057a86c7a26593c2e10f44e138fe6b7e26787262bd5f94c020bbe295d3a3438e43e3f458ea6aa0e4978d4b93159ddefa56e6af6b56388b6e691a1b0b84f
SSDEEP 786432:/zQZ1GQICJGgLTb4z9EcJzm7vJqU3/IGs3ulkKyc3Bjuk5bw2DqK:/UZQ0JGQAz9Ecx7UPhtlcQBjGS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Yandex (1).exe

.exe 35.0MB

Yandex (1).exe

IMPHASH a9e0fc4f44f5b8c24b0376c5ecfe5828
SHA256 ac4ac4ea8b95737df76f962b82b09fe677068941e41367078f51b4f2eb8bc93f
MD5 11b69a108a33ce80a82a7e16ffbc4f12
SHA1 d077c7974ffaabd114dd88dc685e7a8e22a29401
SHA512 49d16057a86c7a26593c2e10f44e138fe6b7e26787262bd5f94c020bbe295d3a3438e43e3f458ea6aa0e4978d4b93159ddefa56e6af6b56388b6e691a1b0b84f
SSDEEP 786432:/zQZ1GQICJGgLTb4z9EcJzm7vJqU3/IGs3ulkKyc3Bjuk5bw2DqK:/UZQ0JGQAz9Ecx7UPhtlcQBjGS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

6e:c3:25:de:45:a7:37:10:a1:fa:76:d4:d5:0a:39:7c:30:13:91:90

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=YANDEX LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=YANDEX LLC,L=Moscow,ST=Moscow,C=RU

Chains

Aug 5, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=YANDEX LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=YANDEX LLC,L=Moscow,ST=Moscow,C=RU

Serial Number

36:67:e1:58:b5:24:c8:ff:bf:e5:38:17:27:86:f1:e2

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 15, 2013 - Jan 15, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

69796

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildAgent\work\92146517cf65a2bb\src\build\Release\full_installer.exe.pdb

wininet

InternetCloseHandle HttpQueryInfoW InternetReadFile InternetOpenUrlW InternetOpenW

msimg32

AlphaBlend

wintrust

WinVerifyTrust

kernel32

LeaveCriticalSection GetModuleFileNameW MultiByteToWideChar lstrlenW RaiseException GetLastError GetProcAddress EnterCriticalSection lstrcmpiW DeleteCriticalSection HeapAlloc HeapFree GetProcessHeap ExpandEnvironmentStringsW GetCommandLineW LocalFree GetFileSize FindResourceExW WriteFile GetUserDefaultLangID GetFileAttributesW ReadFile GetTempPathW LockResource GetTempFileNameW SetFilePointer SetEndOfFile CreateProcessW WaitForSingleObject GetTickCount Sleep GetExitCodeProcess DeleteFileW GetCurrentProcess FlushInstructionCache SetLastError GetCurrentThreadId LoadLibraryW GlobalLock GlobalAlloc GlobalUnlock WriteConsoleW SizeofResource LCMapStringW WideCharToMultiByte TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent HeapReAlloc HeapSize GetStdHandle ExitProcess HeapDestroy HeapCreate GetStartupInfoW HeapSetInformation CreateThread ExitThread TerminateProcess IsDebuggerPresent SetHandleCount SetUnhandledExceptionFilter UnhandledExceptionFilter DecodePointer EncodePointer LoadLibraryA InterlockedExchange LocalAlloc InitializeCriticalSectionAndSpinCount GetModuleHandleW InterlockedDecrement InterlockedIncrement LoadLibraryExW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode RtlUnwind SetStdHandle LoadResource FreeLibrary FindResourceW CloseHandle CreateFileMappingW CreateFileW VirtualQuery UnmapViewOfFile MapViewOfFile GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW FlushFileBuffers InterlockedCompareExchange InterlockedPushEntrySList VirtualFree VirtualAlloc InterlockedPopEntrySList GlobalFree GetFileType

user32

GetWindowTextLengthW GetWindowTextW SetCursor GetSystemMetrics DrawTextW LoadImageW CopyRect UnregisterClassA RegisterWindowMessageW DialogBoxParamW InvalidateRect ShowWindow GetActiveWindow EndPaint BeginPaint GetDlgCtrlID DestroyWindow UpdateLayeredWindow GetWindowDC GetClassInfoExW OffsetRect ReleaseDC SetWindowLongW IsWindow CreateWindowExW CallWindowProcW DefWindowProcW PostMessageW EndDialog FindWindowExW HideCaret GetWindowRect GetParent GetClientRect GetWindowLongW MonitorFromWindow GetDlgItem SetWindowPos SendMessageW MapWindowPoints SetWindowTextW GetMonitorInfoW GetWindow CharNextW RegisterClassExW LoadCursorW ScreenToClient

gdi32

SetBkMode SetLayout BitBlt DeleteDC GetDeviceCaps SetTextColor SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW GetStockObject LPtoDP GetTextExtentPoint32W SetViewportOrgEx DeleteObject CreateFontW

advapi32

RegQueryValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW RegSetValueExW

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize CreateStreamOnHGlobal CoCreateInstance

oleaut32

VarUI4FromStr

comctl32

ImageList_Add ImageList_Draw InitCommonControlsEx ImageList_Create

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Yandex (1).exe

PE Signature issue

wininet

msimg32

wintrust

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

generic