yubx-ui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
yubx-ui.exe
Size 38.5MB
Sample260623-1evd5agw2s
SHA256 14fa3a631df3da33de5cc8fcadc7f5cb041a38f1eacfb762f2d2deb905494658
MD5 fb0ac6de51d2cea72db9c97b7891f3fc
SHA1 c846d8fe9accdb9090b3e8e032a333e1ccb54554
SHA512 bebf2042dfad44f7aefca9b9ede1ed24843b1fc4c296dded822c4250f48995920217495531bda850039b16df4fd7d27396fdb90ecf86dd0338930f4d03d44c6d
SSDEEP 786432:5mhNUp12KbiROd+xJYJQKn61+jVungUXY+EkC7eCFfFAsrbQq:5mcp12lRL0QKxQgUiymfFAsHp
TLSH
T1059723C319EA92FCC8DB5B4801C711CFD5E1A5A9C869E75E3AC59C03AD60F7A0C96372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
yubx-ui.exe

File Explorer

yubx-ui.exe

.exe 38.5MB

yubx-ui.exe

IMPHASH 2e0fc167f13ae416e4dfda81462b3fc8
SHA256 14fa3a631df3da33de5cc8fcadc7f5cb041a38f1eacfb762f2d2deb905494658
MD5 fb0ac6de51d2cea72db9c97b7891f3fc
SHA1 c846d8fe9accdb9090b3e8e032a333e1ccb54554
SHA512 bebf2042dfad44f7aefca9b9ede1ed24843b1fc4c296dded822c4250f48995920217495531bda850039b16df4fd7d27396fdb90ecf86dd0338930f4d03d44c6d
SSDEEP 786432:5mhNUp12KbiROd+xJYJQKn61+jVungUXY+EkC7eCFfFAsrbQq:5mcp12lRL0QKxQgUiymfFAsHp
TLSH
T1059723C319EA92FCC8DB5B4801C711CFD5E1A5A9C869E75E3AC59C03AD60F7A0C96372
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57287913

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive InitializeCriticalSectionEx GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

bcryptprimitives

ProcessPrng

advapi32

RegGetValueW

ntdll

NtOpenFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle

user32

SetWindowLongW

ole32

CoInitializeEx

gdi32

GetDeviceCaps

dwmapi

DwmSetWindowAttribute

comctl32

DefSubclassProc

shlwapi

SHCreateMemStream

shell32

CommandLineToArgvW

oleaut32

GetErrorInfo

ws2_32

WSADuplicateSocketW

secur32

FreeContextBuffer

crypt32

CertEnumCertificatesInStore

bcrypt

BCryptGenRandom

pdh

PdhCloseQuery

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

roundf

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-convert-l1-1-0

_ultow_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

11.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

706KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.0tg

Size

Virtual Size

16.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

./RX

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.@3u

Size

38.4MB

Virtual Size

38.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

yubx-ui.exe

kernel32

bcryptprimitives

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

user32

ole32

gdi32

dwmapi

comctl32

shlwapi

shell32

oleaut32

ws2_32

secur32

crypt32

bcrypt

pdh

powrprof

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic