YimMenu Legacy[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
YimMenu Legacy.zip
Size 5.8MB
Sample260804-qljk4axyas
SHA256 4893d6c4b2b0476c5cae46f681d40ef31cc39e915182dc10e3eb6e6725c9037e
MD5 529ce49caae0d1763f1e342b99af09e4
SHA1 babc810583d6a410a5c295a2af53058c9e577445
SHA512 e09bf9cd1461858d5dda7776d390bb6cd07ef29a642caa5a196f84d8d4291ca97b45fa91f450b62b2f56284680cb52b742d6b6b0644f803e4b9fdc80d29390ae
SSDEEP 98304:IdgcdLGOszGMLKByGHHvAaPkcBvI0k6gy/hhrrJ8G1VdrLCkbhk7ESyyBWvjIhdk:UgcdILKUYPAasc5dkOrJ5hL7+dyyBWK6
TLSH
T179563328F2EA1F10381B691BBB4DC7689ABB23D9FB1D9C99C440881578593B4327D1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/YimMenu Legacy/KAPTAN_KAPLAN injector.exe	ConfuserEx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/YimMenu Legacy/KAPTAN_KAPLAN injector.exe
unpack001/YimMenu Legacy/YimMenu.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack002/Xenos/Xenos64.exe

File Explorer

YimMenu Legacy.zip

.zip 5.8MB
YimMenu Legacy/KAPTAN_KAPLAN injector.exe

.exe 1.5MB
YimMenu Legacy/Ultimate_Menu_V2.lua

.bat 211KB
YimMenu Legacy/Xenos.zip

.zip 569KB
Xenos/Xenos64.exe

.exe 1.2MB
YimMenu Legacy/YimMenu.dll

.dll 10.9MB

YimMenu Legacy.zip

SHA256 4893d6c4b2b0476c5cae46f681d40ef31cc39e915182dc10e3eb6e6725c9037e
MD5 529ce49caae0d1763f1e342b99af09e4
SHA1 babc810583d6a410a5c295a2af53058c9e577445
SHA512 e09bf9cd1461858d5dda7776d390bb6cd07ef29a642caa5a196f84d8d4291ca97b45fa91f450b62b2f56284680cb52b742d6b6b0644f803e4b9fdc80d29390ae
SSDEEP 98304:IdgcdLGOszGMLKByGHHvAaPkcBvI0k6gy/hhrrJ8G1VdrLCkbhk7ESyyBWvjIhdk:UgcdILKUYPAasc5dkOrJ5hL7+dyyBWK6
TLSH
T179563328F2EA1F10381B691BBB4DC7689ABB23D9FB1D9C99C440881578593B4327D1B7
MD5 SHA1 SHA512 SSDEEP TLSH

YimMenu Legacy/KAPTAN_KAPLAN injector.exe

SHA256 f09c860ec6aed94872c98c5a1930b852a81b5d037619d0fae56e99162a4a6981
MD5 07d3107978f1557d98ff2d8023307812
SHA1 c38fda7c76f355743e4b0ab75300b91012e62aac
SHA512 ca2a4101cecc9a298e17d73c8adc1a71086d49111ccb7ff643c83aae0049c70eb57f2d7e2a899cce04dd2de487ce8ebf3712613f41a25c714a30535d8bf83be3
SSDEEP 24576:AGUFwIphyxytbWzJOrfMpuqcZJhrFQcCPbnGwvbq2CwBQbL0RJ7zAyVRnC6N/G:MFpphyYtbVMpOL5QrjnGwvmbLo9zAKn0
TLSH
T18375DF430A178E8BD13273FC5158FB9D416647E4B8278BA4EC792252EAD4F876D3E1E0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Xenos/Xenos64.exe

IMPHASH 4a7ec7340da8cbdca5da87aee6d354fb
SHA256 addf1e5903c21c0af873a45c7fc79f4d4eb2487c970a19ea96f51418431601a2
MD5 bdeee5ec578fff586ed7b492ecd8849f
SHA1 0445186897091a49458819d447fe92e457f088c6
SHA512 dd898414b6ac27a58464c23511eb7e0cb7d411356b8f6ed26fddbbde9c628f92cc4e104f7fb1b6116631006893ffe37249e19b191d4c14cf801c2bc75fcaa497
SSDEEP 24576:A+W3P+Wi1+WGHy8/8gdHn9mGIfBTcVmYWys18ES9DsKRzoome/sBiBJeBIi:A+W3P+Wi1+WGHDfH9mZddbP1fSZzZ1g
TLSH
T165457C5A7BA841F4D0B7913A8AA69156E7F2BC461B3187EF02A4531E7F33AE04D3D311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

48:a8:c4:aa:ac:3e:e5:e3:a2:d4:e9:76:86:30:b4:49:15:ea:91:34

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

356284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Ton\Documents\Visual Studio 2015\Projects\Xenos\build\x64\Release\Xenos64.pdb

shlwapi

SHDeleteKeyW SHSetValueW

dbghelp

MiniDumpWriteDump

kernel32

DeleteCriticalSection CreateProcessW GetCurrentProcess GetModuleFileNameW WaitForSingleObject CreateFileW GetCurrentThreadId Sleep CreateThread GetLocalTime ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter FlushFileBuffers GetFileAttributesW ResumeThread SizeofResource GetCommandLineW WriteFile LockResource DeleteFileW GetNativeSystemInfo GetWindowsDirectoryW FindResourceW GetProcAddress GetModuleHandleW DecodePointer RaiseException CloseHandle GetLastError Wow64RevertWow64FsRedirection InitializeCriticalSectionEx Wow64DisableWow64FsRedirection SetEndOfFile ReadConsoleW WriteConsoleW HeapSize SetStdHandle FindNextFileW FindFirstFileExW FindClose GetCommandLineA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetProcessHeap GetTimeZoneInformation SetFilePointerEx EnumSystemLocalesW VirtualProtect LoadResource GetUserDefaultLCID IsValidLocale GetTimeFormatW MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte EnterCriticalSection DeviceIoControl LeaveCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree VirtualAlloc TerminateProcess CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW GetExitCodeProcess Thread32Next Thread32First InitializeCriticalSection CreateActCtxW GetTempPathW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ResetEvent QueueUserAPC GetTickCount LoadLibraryW FreeLibrary ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx Module32FirstW GetCurrentDirectoryW ReadFile CreateNamedPipeW TerminateThread SuspendThread GetExitCodeThread GetThreadTimes OpenThread OpenProcess IsWow64Process WriteProcessMemory VirtualProtectEx GetThreadContext VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx SetThreadContext VirtualQueryEx GetSystemInfo GetStringTypeW TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx EncodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlPcToFileHeader RtlUnwindEx HeapAlloc HeapFree ExitThread GetModuleHandleExW HeapReAlloc GetStdHandle GetACP GetFileType GetConsoleCP GetConsoleMode GetDateFormatW

user32

DestroyIcon LoadIconW ChangeWindowMessageFilterEx EnableMenuItem wsprintfW GetMessageW CreateDialogParamW CallWindowProcW DestroyWindow MessageBoxW SetWindowLongPtrW SendMessageW EndDialog SetWindowTextW CreateWindowExW ShowWindow IsWindow DispatchMessageW IsDialogMessageW TranslateAcceleratorW TranslateMessage SendMessageA GetDlgItem DialogBoxParamW EnableWindow GetWindowTextW GetMenu LoadAcceleratorsW

comdlg32

GetSaveFileNameW GetOpenFileNameW

shell32

DragQueryFileW CommandLineToArgvW

advapi32

RegOpenKeyW SystemFunction036 RegEnumValueW LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges RegCreateKeyW RegSetValueExW RegCloseKey OpenThreadToken

ole32

CoCreateInstance CoUninitialize CoInitialize

YimMenu Legacy/YimMenu.dll

IMPHASH a10236a263713ede1021de9484ec4a64
SHA256 45400ff910a637d563791fadc97bee672cf3306a452f2e5821b49e03fd78fa46
MD5 41a5c330bd310d721b2d318b187306ce
SHA1 05f1aaa25f0f5f19cdf47b2bcebac62c5e582079
SHA512 ef3fb087216c315c4fe1b6905715abcd71943173d7b986033a1e71ad8e7d941b1949a10474f142e8b32d22cb4f4b34e6fab95fd41baed9904e945c990970146d
SSDEEP 196608:ERAfriKHP41IEBT8wQGNxm9XsXDr+lp7dbVtFK:ERAfriKHP41IEBT8wQGNxm9XsXDrcK
TLSH
T1D3B65B2BE2A411ECD47ED1F4DE86A823E2F13448077499EB0AE04F565F777E0463AA53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8438680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\YimMenu\YimMenu\build\YimMenu.pdb

dbghelp

SymFromAddr SymCleanup SymGetLineFromAddr64 SymInitialize StackWalk64 SymFunctionTableAccess64 SymGetModuleBase64

ws2_32

WSACloseEvent send getsockopt htons WSACreateEvent WSAEnumNetworkEvents WSAEventSelect ioctlsocket getpeername recv listen getsockname connect bind accept select __WSAFDIsSet WSAIoctl setsockopt htonl freeaddrinfo getaddrinfo socket WSAResetEvent WSACleanup WSAStartup inet_ntop WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents inet_pton

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptAcquireContextA

crypt32

CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertGetNameStringA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFindExtension CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptStringToBinaryA

bcrypt

BCryptGenRandom

kernel32

SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation WaitForSingleObject GetExitCodeProcess CreatePipe DeleteFileW SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize CreateProcessW DuplicateHandle VirtualAlloc GetModuleHandleA VirtualFree GetCurrentThreadId GetModuleFileNameA WideCharToMultiByte GetLastError K32GetModuleInformation GetCurrentProcess lstrcpyW SetErrorMode SetUnhandledExceptionFilter IsBadReadPtr SetConsoleMode FreeConsole AttachConsole GetCurrentProcessId AllocConsole GetStdHandle SetConsoleTitleA SetConsoleOutputCP GetConsoleMode GetCurrentThread VirtualProtect GetProcAddress LoadLibraryA GlobalFree CloseHandle FreeLibraryAndExitThread WriteConsoleW CreateThread CreateFiber DeleteFiber SwitchToFiber ConvertThreadToFiber GetModuleFileNameW HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree Sleep FileTimeToSystemTime SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache GetModuleHandleW CreateToolhelp32Snapshot Thread32First Thread32Next GetSystemInfo VirtualQuery MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter LoadLibraryExA FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryA GetEnvironmentVariableA SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx SleepEx VerifyVersionInfoW CreateFileA GetFileSizeEx ReadFile RtlUnwind InterlockedFlushSList RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer InitOnceComplete InitOnceBeginInitialize ExitThread ReadConsoleW WriteFile GetConsoleOutputCP SetFilePointerEx ExitProcess LoadLibraryExW FlushFileBuffers FlsAlloc FlsGetValue FlsSetValue OpenThread FlsFree DisableThreadLibraryCalls TlsFree TlsSetValue TlsGetValue TlsAlloc LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx TryAcquireSRWLockExclusive SwitchToThread GetExitCodeThread GetStringTypeW SleepConditionVariableSRW FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent WakeConditionVariable WakeAllConditionVariable RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount

user32

LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture GetMessageExtraInfo OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxA FindWindowW FindWindowA CallWindowProcW SetWindowLongPtrW SetCursorPos GetCursorPos GetAsyncKeyState GetForegroundWindow GetKeyState

winmm

timeGetTime

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

165KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

311KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

YimMenu Legacy.zip

YimMenu Legacy/KAPTAN_KAPLAN injector.exe

generic

YimMenu Legacy/Ultimate_Menu_V2.lua

YimMenu Legacy/Xenos.zip

Xenos/Xenos64.exe

PE Signature issue

shlwapi

dbghelp

kernel32

user32

comdlg32

shell32

advapi32

ole32

generic

YimMenu Legacy/YimMenu.dll

dbghelp

ws2_32

advapi32

crypt32

bcrypt

kernel32

user32

winmm

imm32

d3dcompiler_47

generic