YBClicker[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
YBClicker.exe
Size 3.6MB
Sample260930-vpdapsdf84
SHA256 e2e42e46117ef4a52271f2b3546581982d4e10277d432f428924f6441d6b95db
MD5 14d7d8d03731b827044f6e5b22b5694a
SHA1 48dd853bd1cfcba7de9bef29d84d665e575ad363
SHA512 52528cb93afb7a65492122ad439ae7c1a17fda5b60363db39d626b41d21c864cfc6d7a8fca2c4c4c0b7ba694003a0e9ea663179617c81b6f591e4192a7a339f9
SSDEEP 49152:YwuhLk93jWqeFocKr7SG1HNAhVw2dvI1mwyHjOg5m1rVwL6xeHqn5EtXbN2cdyuP:7zl0g5tqjwt19yHjOhVlxeHq69V
TLSH
T1F4062391F6D218FAE17BE474C9679845E67238850730E9E7037886A66F2B3D05B7EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YBClicker.exe

File Explorer

YBClicker.exe

.exe 3.6MB

YBClicker.exe

IMPHASH 457372a72cad5df42048829bcd62ce88
SHA256 e2e42e46117ef4a52271f2b3546581982d4e10277d432f428924f6441d6b95db
MD5 14d7d8d03731b827044f6e5b22b5694a
SHA1 48dd853bd1cfcba7de9bef29d84d665e575ad363
SHA512 52528cb93afb7a65492122ad439ae7c1a17fda5b60363db39d626b41d21c864cfc6d7a8fca2c4c4c0b7ba694003a0e9ea663179617c81b6f591e4192a7a339f9
SSDEEP 49152:YwuhLk93jWqeFocKr7SG1HNAhVw2dvI1mwyHjOg5m1rVwL6xeHqn5EtXbN2cdyuP:7zl0g5tqjwt19yHjOhVlxeHq69V
TLSH
T1F4062391F6D218FAE17BE474C9679845E67238850730E9E7037886A66F2B3D05B7EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

LoadIconW LoadCursorW CallNextHookEx UnhookWindowsHookEx GetMessageW SetWindowsHookExW GetWindowThreadProcessId GetClassNameW GetDesktopWindow SetWindowLongPtrW GetWindowLongPtrW ScreenToClient GetWindowRect GetClientRect DestroyIcon GetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC GetForegroundWindow UpdateWindow GetSystemMetrics LoadImageW SetTimer MsgWaitForMultipleObjectsEx ReleaseCapture SetCapture MapVirtualKeyExW MapVirtualKeyW SendInput GetKeyNameTextW SetFocus EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetWindowPos UpdateLayeredWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage MonitorFromWindow KillTimer GetMonitorInfoW

winmm

timeEndPeriod timeBeginPeriod

gdi32

DeleteObject SelectObject CreateDIBSection CreateCompatibleDC DeleteDC

gdiplus

GdipAlloc GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdipDrawString GdipGetFontSize GdipGetFontStyle GdipGetFamily GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipRestoreGraphics GdipSaveGraphics GdipResetClip GdipSetClipRegion GdipSetClipPath GdipSetClipRect GdipDrawImageRect GdipFillPath GdipFillEllipse GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawEllipse GdipDrawRectangle GdipDrawArc GdipDrawLine GdipTranslateWorldTransform GdipMultiplyWorldTransform GdipResetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipGetSmoothingMode GdipSetSmoothingMode GdipDeleteGraphics GdipBitmapSetPixel GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetPenMode GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipSetPenLineCap197819 GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteRegion GdipCreateRegionPath GdipCreateRegionRect GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree

ole32

CoTaskMemFree CreateStreamOnHGlobal

urlmon

URLDownloadToFileW

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle

advapi32

RegOpenKeyExW RegEnumKeyExW RegCloseKey RegQueryValueExW

kernel32

GetModuleHandleW GetModuleFileNameW GetTickCount64 GetLocalTime GlobalMemoryStatusEx OpenProcess SetThreadPriorityBoost SetThreadPriority GetCurrentThread SwitchToThread Sleep CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter GetLastError CloseHandle DeleteFileW CreateDirectoryW GetEnvironmentVariableW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GetSystemTimePreciseAsFileTime WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable WriteConsoleW SetEndOfFile HeapReAlloc HeapSize GlobalUnlock GlobalLock GlobalFree QueryFullProcessImageNameW MultiByteToWideChar FlushFileBuffers CreateFileW GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW LoadLibraryExW VirtualProtect SetFilePointerEx GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode ReadFile GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter

shell32

SHGetKnownFolderPath ShellExecuteW

Name

.text

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

YBClicker.exe

user32

winmm

gdi32

gdiplus

ole32

urlmon

winhttp

advapi32

kernel32

shell32

generic