yubx-ui.rar
- SHA256 919eea823ac5c65a5c55169f768a2d35502f92280fc7ba5b70de35d2b50b96af
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
yubx-ui.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
yubx-ui.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target yubx-ui.rar
- Size 29.2MB
- Sample261104-3y76faet3v
- SHA256 919eea823ac5c65a5c55169f768a2d35502f92280fc7ba5b70de35d2b50b96af
- MD5 7b3951d1f7987be6392e2ab80a599d4c
- SHA1 588252a78754ba3ce04ebcbaa515fcec1c47bdd0
- SHA512 28b7dc209f7993db187ac8cee1b45d73b61dd469251b819f2e8500e9bb44906d628bcc6e0dc91eb4672cd2f36a3a0add1c84bd3952b16cb72949976a93e0d9cd
- SSDEEP 786432:YXw0smV6Gmjs+/9i0z57apRWBcAXtdG7l/ePpVpxUAv/RY+C:AwFmVPJ+/vEpRWB7X+J/QrzY
- TLSH T15B673389C3FA6562C9CDD270C1BEE228E32AFA19161F8EE3411D5623DBDC96C447D784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/yubx-ui.exe
File Explorer
-
yubx-ui.rar.rar 29.2MB
-
yubx-ui.exe.exe 34.0MB
yubx-ui.exe
- IMPHASH 49cf66e569197ca4173d1c64a7b5a58e
- SHA256 658a10a37a0792bc215fb4bce3e360af0541c923862429b4ef400ec1aa606a52
- MD5 1c87bf26a17d5a1e1be38c3b9d5ded49
- SHA1 3a4810a40039a7cfaf2be829a4ffa19400dd576e
- SHA512 d79e8bcdc98ed73d6eee2370a8c85f6082895dbcd3da313adc39f152b7947cee8060df49be7d7e72c8ee82e253abca51eeac3bc87023e60e5158ebb7dbedad06
- SSDEEP 393216:ALhYSx9VqjbvpCr/HUyS0rLNUQnZ1qI1oxqHZijZPUrYID2MuYR1DEm6Dp84V4Yr:EhYSx9yvyrRvqzUHZ8ZMPD2FUdz6hF
- TLSH T1397723C32CE846ADC456D635C2CA1AFEE0C9B9A58D75992FBFC618032931D46CCF2635
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
51599323
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CreatePipe
SetUnhandledExceptionFilter
bcryptprimitives
ProcessPrng
advapi32
RegDeleteValueW
EventRegister
ntdll
NtQueryInformationProcess
user32
DefWindowProcW
gdi32
CreateDIBSection
ole32
RevokeDragDrop
comctl32
DefSubclassProc
shell32
SHOpenFolderAndSelectItems
CommandLineToArgvW
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
dwmapi
DwmSetWindowAttribute
shlwapi
SHCreateMemStream
oleaut32
SysFreeString
ws2_32
WSAStartup
crypt32
CertAddCertificateContextToStore
secur32
InitializeSecurityContextW
bcrypt
BCryptGenRandom
pdh
PdhCloseQuery
powrprof
CallNtPowerInformation
psapi
GetModuleFileNameExW
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
16.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
12.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
939KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.A6;
Size
Virtual Size
12.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.cWN
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.+lx
Size
34.0MB
Virtual Size
34.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ