YUMI[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
YUMI.exe
Size 4.4MB
Sample260910-cgwszacn4x
SHA256 4b1af6f9668acb1f62b26f0254e059f510251320a763e60c4ee2740a6ec89378
MD5 fa26ba12d6d06c3144ae608d41221ae0
SHA1 0f4bcd18546512fbee374ec8a35e500e954a2830
SHA512 44046c20cd537704483cde1480c776682a7763fcfb46bd8da8b56b04041901d94753e8050613f4d8c6a8d550875947d42befcec6c66ec391711b813a365c14df
SSDEEP 98304:wFUD4VwdVOoSsUkfUS+DlrpvavA2Tf7Sl:TV7hTUS+DlrpvavIl
TLSH
T12A26D046F2EA40FDD276D13CC6A69217E3B27415173587DB23E04A22AFA3AD08F79711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YUMI.exe

File Explorer

YUMI.exe

.exe 4.4MB

YUMI.exe

IMPHASH c5af04328bade5f54f71027bd5810182
SHA256 4b1af6f9668acb1f62b26f0254e059f510251320a763e60c4ee2740a6ec89378
MD5 fa26ba12d6d06c3144ae608d41221ae0
SHA1 0f4bcd18546512fbee374ec8a35e500e954a2830
SHA512 44046c20cd537704483cde1480c776682a7763fcfb46bd8da8b56b04041901d94753e8050613f4d8c6a8d550875947d42befcec6c66ec391711b813a365c14df
SSDEEP 98304:wFUD4VwdVOoSsUkfUS+DlrpvavA2Tf7Sl:TV7hTUS+DlrpvavIl
TLSH
T12A26D046F2EA40FDD276D13CC6A69217E3B27415173587DB23E04A22AFA3AD08F79711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2382848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpQueryHeaders WinHttpOpen WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpCloseHandle WinHttpConnect WinHttpSetTimeouts WinHttpOpenRequest

wininet

InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA

d3dcompiler_47

D3DCompile

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleFileNameA GetModuleHandleA GetModuleHandleW FreeLibrary LoadLibraryExW

api-ms-win-core-localization-l1-2-0

FormatMessageW GetLocaleInfoA GetLocaleInfoEx FormatMessageA

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime VerSetConditionMask

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW GetSystemInfo GetTickCount GetTickCount64 GetSystemTimeAsFileTime

api-ms-win-mm-time-l1-1-0

timeGetTime timeEndPeriod timeBeginPeriod

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache IsProcessorFeaturePresent OpenProcess

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete Sleep SleepConditionVariableSRW

api-ms-win-core-psapi-ansi-l1-1-0

QueryFullProcessImageNameA K32GetModuleFileNameExA

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-memory-l1-1-0

VirtualAllocEx VirtualQuery VirtualProtect WriteProcessMemory VirtualProtectEx VirtualQueryEx VirtualFreeEx ReadProcessMemory

api-ms-win-core-kernel32-legacy-l1-1-2

Process32Next Process32First

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess GetProcessId OpenProcessToken GetCurrentProcessId GetExitCodeProcess GetCurrentThreadId SetThreadPriority GetCurrentThread TerminateProcess ExitProcess

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA GetStdHandle GetCommandLineA

api-ms-win-core-console-l1-1-0

GetConsoleMode SetConsoleMode

api-ms-win-core-file-l1-2-2

AreFileApisANSI GetVolumeInformationA

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegCloseKey RegQueryValueExA RegOpenKeyExA

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError SetLastError

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW

api-ms-win-core-com-l1-1-0

CoCreateInstance CoInitializeEx CoUninitialize CoCreateFreeThreadedMarshaler

api-ms-win-security-lsalookup-ansi-l2-1-0

LookupPrivilegeValueA

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

kernel32

CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA Module32First Module32Next K32EnumProcessModulesEx

user32

keybd_event MapVirtualKeyA SendInput SetWindowTextA GetWindowThreadProcessId GetWindowTextLengthW DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow IsWindowVisible CreateWindowExW UnregisterClassW GetClassNameA RegisterClassExW ShowWindow IsWindow SetWindowLongA SetWindowDisplayAffinity MoveWindow EnumWindows SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA PostQuitMessage FindWindowA ShowCursor IsIconic GetWindowTextW GetAsyncKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos UpdateWindow GetDesktopWindow

gdi32

GetDeviceCaps CreateSolidBrush

shell32

ShellExecuteA SHGetFolderPathA

msvcp140

?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AEAA@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z _Cnd_register_at_thread_exit ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ _Cnd_broadcast _Thrd_join _Thrd_id ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z _Cnd_wait _Cnd_signal _Thrd_hardware_concurrency ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??1_Facet_base@std@@UEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Strcoll ??_7facet@locale@std@@6B@ ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ??_7_Facet_base@std@@6B@ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

winmm

PlaySoundA

crypt32

CertFreeCertificateChain CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject

ws2_32

bind inet_ntop WSASetLastError htonl inet_pton WSAGetLastError closesocket connect WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt listen getaddrinfo getpeername getsockname htons freeaddrinfo recvfrom recv setsockopt socket WSAIoctl __WSAFDIsSet select sendto ioctlsocket accept gethostname ntohs

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memchr memset memmove memcpy longjmp wcschr __C_specific_handler strchr strstr __std_exception_copy __std_exception_destroy __intrinsic_setjmp strrchr _CxxThrowException _purecall __current_exception __current_exception_context

api-ms-win-crt-runtime-l1-1-0

__sys_nerr _invalid_parameter_noinfo_noreturn _beginthreadex _invalid_parameter_noinfo abort _errno _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment exit _initterm terminate _initterm_e _invoke_watson _exit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc system __sys_errlist

api-ms-win-crt-math-l1-1-0

__setusermatherr sqrt pow logf acosf sin _fdclass log powf _fdopen _dsign roundf _dclass ldexp asinf lroundf floorf atan2f ceilf cosf sqrtf expf exp fmodf sinf tanf

api-ms-win-crt-string-l1-1-0

strcmp wcspbrk strspn wcsncmp strpbrk iswspace wcsncpy strcspn strcpy_s _wcsicmp tolower _strdup isalnum _stricmp toupper strncmp strncpy

api-ms-win-crt-convert-l1-1-0

strtod strtoll strtoul atoi strtol strtoull wcstombs strtof atof

api-ms-win-crt-stdio-l1-1-0

fflush _set_fmode __p__commode fputc __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 _read _write _fileno _close feof ftell fsetpos ungetc setvbuf fgetpos fclose _lseeki64 __stdio_common_vsscanf fread _wopen fgetc fputs __stdio_common_vsprintf __stdio_common_vfprintf _wfopen fgets fwrite __acrt_iob_func fseek

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc calloc realloc _callnewh

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 strftime _localtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _fstat64 remove _unlink _unlock_file _wstat64

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-core-file-l1-1-0

CreateDirectoryW CreateFileW FindClose FindFirstFileW SetFileInformationByHandle FindFirstFileExW FindNextFileW GetFileType GetFileAttributesExW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection LeaveCriticalSection AcquireSRWLockExclusive WaitForSingleObjectEx InitializeCriticalSection EnterCriticalSection WaitForSingleObject ReleaseSRWLockShared AcquireSRWLockShared SleepEx SetEvent CreateEventW ReleaseSRWLockExclusive InitializeCriticalSectionEx

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext CryptGetHashParam CryptCreateHash CryptEncrypt CryptImportKey CryptDestroyKey CryptAcquireContextW CryptDestroyHash CryptHashData

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

oleaut32

SetErrorInfo SysStringLen SysFreeString GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory