Edit tour

Windows Analysis Report
YY#U6302#U53f7#U534f#U8bae.exe

Overview

General Information

Sample name:	YY#U6302#U53f7#U534f#U8bae.exe renamed because original name is a hash value
Original sample name:	YY.exe
Analysis ID:	1457838
MD5:	765cf453d0cea3719b619e4c55881093
SHA1:	060ae0476bbd908d08537c8b6bb24d2ec83d524c
SHA256:	3d76cc27be3265077a5c15f2c76848b73148df035b7d3a3d2b9ad77232587cfd
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Detected VMProtect packer

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

YY#U6302#U53f7#U534f#U8bae.exe (PID: 908 cmdline: "C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe" MD5: 765CF453D0CEA3719B619E4C55881093)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: YY#U6302#U53f7#U534f#U8bae.exe

Virustotal: Detection: 50%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: YY#U6302#U53f7#U534f#U8bae.exe

Joe Sandbox ML: detected

Source: YY#U6302#U53f7#U534f#U8bae.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: \iext_fnr.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701213455.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701495506.000000006CF60000.00000002.00000001.01000000.00000004.sdmp, iext1.fnr.bbs.125.la.0.dr
Source:	Binary string: C:\Program Files (x86)\e\lib\ExuiKrnln\ExuiKrnln.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\openssl-1.0.0d\openssl-1.0.0d\out32dll\libeay32.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\openssl-1.0.0d\openssl-1.0.0d\out32dll\libeay32.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: \iext_fnr.pdbM source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701213455.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701495506.000000006CF60000.00000002.00000001.01000000.00000004.sdmp, iext1.fnr.bbs.125.la.0.dr

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEFC5C0 FindFirstFileW,FindNextFileW,FindNextFileW,
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEFC790 FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,lstrlenA,

Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000003.1699125254.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://117.72.34.175:1011/?OrderID=4BA33E0B1BE84295&ipnumber=50
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://120.26.95.191:5658/
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://120.26.95.191:5658/http://120.26.95.191:5659/qq17336171577b2cc005c28c42472000e7863283a212&_=h
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://120.26.95.191:5659/
Source: iext1.fnr.bbs.125.la.0.dr	String found in binary or memory: http://bbs.125.la/
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://channel.yy.com/ajax/member/indexAction
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://do-dw.yy.com/user.php?sids=
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://hgame.yy.com/action/getUserLoginInfo.json
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://hgame.yy.com/action/getUserLoginInfo.jsondata.ownChannels
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://peipei.yy.com/web/account/internal/account/list
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://vip.yy.com/service/web/user/info?_time=
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://vip.yy.com/service/web/user/info?_time=vipLevel
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://vip.yy.com/vip/vcard/indexrest?_time=
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.uc.cn/ip
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.uc.cn/ipIP:http://
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.yy.com/
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.yy.com/search-
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.yy.com/sid
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701213455.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701495506.000000006CF60000.00000002.00000001.01000000.00000004.sdmp, iext1.fnr.bbs.125.la.0.dr	String found in binary or memory: https://bbs.125.la/thread-14738139-1-1.html
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://captcha.yy.com/baidu/submit.do?appid=
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://captcha.yy.com/baidu/submit.do?appid=obj
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://hd.vip.yy.com/service/hdplatform/drawgift/202402ee1a8f/giftpagingp?drawGiftGroupId=202402ee1
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://hgame.yy.com/person/p_account
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://iexui.com/downexui
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yyweb
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yywebconfigData/giftDatac
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://nfnba.lanzoub.com/ietaw0udyhid
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passport.baidu.com/viewlog/getstyle?ak=
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passport.baidu.com/viewlog?ak=
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://udb.yy.com/authentication.do?action=authenticate&appid=5060&busiUrl=http%3A%2F%2Fwww.yy.com&
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.dmdaili.com/yaoqing/33405.html
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.xiequ.cn/index.html?dc1bbee2
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.yy.com/gu/
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.yy.com/u/
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.yy.com/zone/assets/total.json
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.yy.com/zone/userinfo/getUserInfo.json
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ysapi.yy.com/api/internal/nobleQuery/QueryUserInfoReq.json?data=
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://yyfkw.cn
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://yyfkw.cn999https://nfnba.lanzoub.com/ietaw0udyhid

System Summary

Detected VMProtect packer

Source: YY#U6302#U53f7#U534f#U8bae.exe

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_00401770
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF03D60
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF03060
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF25CA0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF56C8E
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF08C70
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF27D80
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF58D78
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF04EB0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF32EA0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF29E30
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF30E30
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF22F50
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF0AF40
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF28F20
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF35F20
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF1C860
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF42814
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEF19F0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF24940
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF32930
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF0BAE0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF17A1E
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF1ABC0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEFDB50
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF33B00
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF2B4E0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF424B5
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF20400
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEF4590
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF1F560
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF5D549
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF0C6E0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEF76D0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF496A7
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF2A680
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEF3640
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF22610
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF067A0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF5C790
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEFC790
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF04770
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF13770
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF4B710
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF251C0
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF17180
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEF5190

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: String function: 6CF3C240 appears 47 times

Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSkinH_EL.dll vs YY#U6302#U53f7#U534f#U8bae.exe
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameExuiKrnl.dll* vs YY#U6302#U53f7#U534f#U8bae.exe
Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs YY#U6302#U53f7#U534f#U8bae.exe

Source: YY#U6302#U53f7#U534f#U8bae.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CEFAD60 CreateToolhelp32Snapshot,GetCurrentProcessId,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,FindCloseChangeNotification,

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

File created: C:\Users\user\AppData\Local\Temp\iext1.fnr.bbs.125.la

Jump to behavior

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: YY#U6302#U53f7#U534f#U8bae.exe

Virustotal: Detection: 50%

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: udbauthsdk.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Section loaded: wintypes.dll

Source: YY#U6302#U53f7#U534f#U8bae.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: YY#U6302#U53f7#U534f#U8bae.exe

Static file information: File size 4972544 > 1048576

Source: YY#U6302#U53f7#U534f#U8bae.exe

Static PE information: Raw size of .vmp1 is bigger than: 0x100000 < 0x4b9000

Source:	Binary string: \iext_fnr.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701213455.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701495506.000000006CF60000.00000002.00000001.01000000.00000004.sdmp, iext1.fnr.bbs.125.la.0.dr
Source:	Binary string: C:\Program Files (x86)\e\lib\ExuiKrnln\ExuiKrnln.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\openssl-1.0.0d\openssl-1.0.0d\out32dll\libeay32.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\openssl-1.0.0d\openssl-1.0.0d\out32dll\libeay32.pdb source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: \iext_fnr.pdbM source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701213455.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701495506.000000006CF60000.00000002.00000001.01000000.00000004.sdmp, iext1.fnr.bbs.125.la.0.dr

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CF03D60 CreateIextInterface,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleFileNameW,_wcsrchr,LoadLibraryW,FreeLibrary,GetModuleHandleW,GetCurrentProcess,ReadProcessMemory,OpenFileMappingW,GetCurrentProcessId,MapViewOfFile,UnmapViewOfFile,CloseHandle,LoadLibraryW,GetProcAddress,FreeLibrary,

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: YY#U6302#U53f7#U534f#U8bae.exe	Static PE information: section name: .vmp0
Source: YY#U6302#U53f7#U534f#U8bae.exe	Static PE information: section name: .vmp1
Source: iext1.fnr.bbs.125.la.0.dr	Static PE information: section name: .detourc
Source: iext1.fnr.bbs.125.la.0.dr	Static PE information: section name: .detourd

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_00406D9F pushad ; ret
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_004065AC push ebx; retf
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF5BFC1 push ecx; ret

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

File created: C:\Users\user\AppData\Local\Temp\iext1.fnr.bbs.125.la

Jump to dropped file

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

File created: C:\Users\user\AppData\Local\Temp\iext1.fnr.bbs.125.la

Jump to dropped file

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CEFAD60 CreateToolhelp32Snapshot,GetCurrentProcessId,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,FindCloseChangeNotification,

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\iext1.fnr.bbs.125.la

Jump to dropped file

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

API coverage: 1.2 %

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEFC5C0 FindFirstFileW,FindNextFileW,FindNextFileW,
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CEFC790 FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,lstrlenA,

Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1700974559.000000000131E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllpp

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CF03060 GdiplusStartup,IsDebuggerPresent,

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CEFAD60 CreateToolhelp32Snapshot,GetCurrentProcessId,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,FindCloseChangeNotification,

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CF56124 GetProcessHeap,

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF3B805 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF44984 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe	Code function: 0_2_6CF3C469 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: ExuiKrnln.dll,Tab_HbitmapLayeredTab_UpdateStateTab_RefreshCallBackTab_NeedUpdateFocusManagementTabDownTab_OLDFocuscontrolTab_WM_DESTROYTab_WM_DESTROY_TRUETab_WM_32879Tab_WM_DESTROY_FALSETab_IsWinControlWM_SIZEIsunicodeTab_GraphicsTab_OldHbitmapICON_1DownlistExShell_TrayWnd

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CF3C285 cpuid

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CF3C58C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe

Code function: 0_2_6CF5445D GetTimeZoneInformation,

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
YY#U6302#U53f7#U534f#U8bae.exe	50%	Virustotal		Browse
YY#U6302#U53f7#U534f#U8bae.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\iext1.fnr.bbs.125.la	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	0%	Avira URL Cloud	safe
https://ysapi.yy.com/api/internal/nobleQuery/QueryUserInfoReq.json?data=	0%	Avira URL Cloud	safe
http://www.yy.com/search-	0%	Avira URL Cloud	safe
https://www.yy.com/zone/assets/total.json	0%	Avira URL Cloud	safe
http://hgame.yy.com/action/getUserLoginInfo.jsondata.ownChannels	0%	Avira URL Cloud	safe
http://120.26.95.191:5659/	0%	Avira URL Cloud	safe
http://www.openssl.org/V	0%	Avira URL Cloud	safe
https://ysapi.yy.com/api/internal/nobleQuery/QueryUserInfoReq.json?data=	0%	Virustotal		Browse
https://www.yy.com/zone/assets/total.json	0%	Virustotal		Browse
http://www.yy.com/	0%	Avira URL Cloud	safe
http://www.openssl.org/V	0%	Virustotal		Browse
http://peipei.yy.com/web/account/internal/account/list	0%	Avira URL Cloud	safe
http://www.yy.com/	0%	Virustotal		Browse
https://www.yy.com/u/	0%	Avira URL Cloud	safe
http://www.yy.com/search-	0%	Virustotal		Browse
http://bbs.125.la/	0%	Avira URL Cloud	safe
http://hgame.yy.com/action/getUserLoginInfo.jsondata.ownChannels	NaN%	Virustotal		Browse
https://bbs.125.la/thread-14738139-1-1.html	0%	Avira URL Cloud	safe
http://120.26.95.191:5659/	NaN%	Virustotal		Browse
http://vip.yy.com/service/web/user/info?_time=vipLevel	0%	Avira URL Cloud	safe
https://www.yy.com/u/	0%	Virustotal		Browse
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	0%	Virustotal		Browse
http://peipei.yy.com/web/account/internal/account/list	NaN%	Virustotal		Browse
http://bbs.125.la/	1%	Virustotal		Browse
http://hgame.yy.com/action/getUserLoginInfo.json	0%	Avira URL Cloud	safe
https://www.dmdaili.com/yaoqing/33405.html	0%	Avira URL Cloud	safe
https://captcha.yy.com/baidu/submit.do?appid=	0%	Avira URL Cloud	safe
https://passport.baidu.com/viewlog/getstyle?ak=	0%	Avira URL Cloud	safe
https://bbs.125.la/thread-14738139-1-1.html	1%	Virustotal		Browse
http://vip.yy.com/service/web/user/info?_time=vipLevel	NaN%	Virustotal		Browse
https://www.yy.com/zone/userinfo/getUserInfo.json	0%	Avira URL Cloud	safe
https://passport.baidu.com/viewlog/getstyle?ak=	0%	Virustotal		Browse
http://www.openssl.org/support/faq.html	0%	Avira URL Cloud	safe
https://www.dmdaili.com/yaoqing/33405.html	NaN%	Virustotal		Browse
https://hd.vip.yy.com/service/hdplatform/drawgift/202402ee1a8f/giftpagingp?drawGiftGroupId=202402ee1	0%	Avira URL Cloud	safe
http://hgame.yy.com/action/getUserLoginInfo.json	NaN%	Virustotal		Browse
https://captcha.yy.com/baidu/submit.do?appid=	0%	Virustotal		Browse
https://iexui.com/downexui	0%	Avira URL Cloud	safe
http://www.openssl.org/support/faq.html	0%	Virustotal		Browse
http://do-dw.yy.com/user.php?sids=	0%	Avira URL Cloud	safe
https://hgame.yy.com/person/p_account	0%	Avira URL Cloud	safe
https://iexui.com/downexui	0%	Virustotal		Browse
https://captcha.yy.com/baidu/submit.do?appid=obj	0%	Avira URL Cloud	safe
https://yyfkw.cn	0%	Avira URL Cloud	safe
http://117.72.34.175:1011/?OrderID=4BA33E0B1BE84295&ipnumber=50	0%	Avira URL Cloud	safe
https://hd.vip.yy.com/service/hdplatform/drawgift/202402ee1a8f/giftpagingp?drawGiftGroupId=202402ee1	NaN%	Virustotal		Browse
https://hgame.yy.com/person/p_account	0%	Virustotal		Browse
http://120.26.95.191:5658/	0%	Avira URL Cloud	safe
https://www.yy.com/zone/userinfo/getUserInfo.json	NaN%	Virustotal		Browse
https://captcha.yy.com/baidu/submit.do?appid=obj	0%	Virustotal		Browse
https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yywebconfigData/giftDatac	0%	Avira URL Cloud	safe
https://yyfkw.cn	0%	Virustotal		Browse
http://vip.yy.com/service/web/user/info?_time=	0%	Avira URL Cloud	safe
http://120.26.95.191:5658/	NaN%	Virustotal		Browse
https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yywebconfigData/giftDatac	0%	Virustotal		Browse
http://vip.yy.com/vip/vcard/indexrest?_time=	0%	Avira URL Cloud	safe
http://www.yy.com/sid	0%	Avira URL Cloud	safe
https://www.xiequ.cn/index.html?dc1bbee2	0%	Avira URL Cloud	safe
http://www.uc.cn/ip	0%	Avira URL Cloud	safe
http://www.yy.com/sid	0%	Virustotal		Browse
https://udb.yy.com/authentication.do?action=authenticate&appid=5060&busiUrl=http%3A%2F%2Fwww.yy.com&	0%	Avira URL Cloud	safe
http://do-dw.yy.com/user.php?sids=	0%	Virustotal		Browse
http://vip.yy.com/service/web/user/info?_time=	0%	Virustotal		Browse
https://udb.yy.com/authentication.do?action=authenticate&appid=5060&busiUrl=http%3A%2F%2Fwww.yy.com&	0%	Virustotal		Browse
http://117.72.34.175:1011/?OrderID=4BA33E0B1BE84295&ipnumber=50	NaN%	Virustotal		Browse
https://www.yy.com/gu/	0%	Avira URL Cloud	safe
http://www.uc.cn/ip	0%	Virustotal		Browse
http://www.uc.cn/ipIP:http://	0%	Avira URL Cloud	safe
https://www.yy.com/gu/	0%	Virustotal		Browse
https://www.xiequ.cn/index.html?dc1bbee2	NaN%	Virustotal		Browse
https://nfnba.lanzoub.com/ietaw0udyhid	0%	Avira URL Cloud	safe
https://yyfkw.cn999https://nfnba.lanzoub.com/ietaw0udyhid	0%	Avira URL Cloud	safe
http://120.26.95.191:5658/http://120.26.95.191:5659/qq17336171577b2cc005c28c42472000e7863283a212&_=h	0%	Avira URL Cloud	safe
https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yyweb	0%	Avira URL Cloud	safe
https://passport.baidu.com/viewlog?ak=	0%	Avira URL Cloud	safe
https://nfnba.lanzoub.com/ietaw0udyhid	NaN%	Virustotal		Browse
http://vip.yy.com/vip/vcard/indexrest?_time=	0%	Virustotal		Browse
http://channel.yy.com/ajax/member/indexAction	0%	Avira URL Cloud	safe
http://www.uc.cn/ipIP:http://	0%	Virustotal		Browse
http://120.26.95.191:5658/http://120.26.95.191:5659/qq17336171577b2cc005c28c42472000e7863283a212&_=h	NaN%	Virustotal		Browse
https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yyweb	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ysapi.yy.com/api/internal/nobleQuery/QueryUserInfoReq.json?data=	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://hgame.yy.com/action/getUserLoginInfo.jsondata.ownChannels	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.yy.com/zone/assets/total.json	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.yy.com/search-	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://120.26.95.191:5659/	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/V	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.yy.com/	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://peipei.yy.com/web/account/internal/account/list	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.yy.com/u/	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://bbs.125.la/	iext1.fnr.bbs.125.la.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bbs.125.la/thread-14738139-1-1.html	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701213455.0000000002F09000.00000004.00000020.00020000.00000000.sdmp, YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1701495506.000000006CF60000.00000002.00000001.01000000.00000004.sdmp, iext1.fnr.bbs.125.la.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://vip.yy.com/service/web/user/info?_time=vipLevel	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://hgame.yy.com/action/getUserLoginInfo.json	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://captcha.yy.com/baidu/submit.do?appid=	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dmdaili.com/yaoqing/33405.html	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://passport.baidu.com/viewlog/getstyle?ak=	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.yy.com/zone/userinfo/getUserInfo.json	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://hd.vip.yy.com/service/hdplatform/drawgift/202402ee1a8f/giftpagingp?drawGiftGroupId=202402ee1	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://iexui.com/downexui	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://do-dw.yy.com/user.php?sids=	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://hgame.yy.com/person/p_account	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://captcha.yy.com/baidu/submit.do?appid=obj	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://yyfkw.cn	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://117.72.34.175:1011/?OrderID=4BA33E0B1BE84295&ipnumber=50	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000003.1699125254.0000000001351000.00000004.00000020.00020000.00000000.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://120.26.95.191:5658/	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yywebconfigData/giftDatac	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://vip.yy.com/service/web/user/info?_time=	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://vip.yy.com/vip/vcard/indexrest?_time=	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.yy.com/sid	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.xiequ.cn/index.html?dc1bbee2	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.uc.cn/ip	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://udb.yy.com/authentication.do?action=authenticate&appid=5060&busiUrl=http%3A%2F%2Fwww.yy.com&	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.yy.com/gu/	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.uc.cn/ipIP:http://	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nfnba.lanzoub.com/ietaw0udyhid	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://yyfkw.cn999https://nfnba.lanzoub.com/ietaw0udyhid	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://120.26.95.191:5658/http://120.26.95.191:5659/qq17336171577b2cc005c28c42472000e7863283a212&_=h	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	NaN%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://lxcode.bs2cdn.yy.com/a413808b-e679-47f1-9380-be7b3ebf8813.xml?from=yyweb	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://passport.baidu.com/viewlog?ak=	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://channel.yy.com/ajax/member/indexAction	YY#U6302#U53f7#U534f#U8bae.exe, 00000000.00000002.1699727907.00000000005A0000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1457838
Start date and time:	2024-06-15 20:02:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 35s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YY#U6302#U53f7#U534f#U8bae.exe renamed because original name is a hash value
Original Sample Name:	YY.exe
Detection:	MAL
Classification:	mal60.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Process:	C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	741376
Entropy (8bit):	6.917105002705599
Encrypted:	false
SSDEEP:	12288:wKBQAJdbyF+XZrjvhIeWgtN5XcTXrTmY5GTTTTTTTTTy8L1d8GsgFMwq:wKBZbpXZrjhI8N5sT7TzGTTTTTTTTTy9
MD5:	A96FBD5E66B31F3D816AD80F623E9BD9
SHA1:	4EDA42260BD3EB930CD4EAFD7D15C6AF367BCF18
SHA-256:	2E67BA278646FDE95BB614DCBCC7DA1C6BF7976C918B2C6AD3D78640000326F3
SHA-512:	43921107313775EA14B1BD33CF758C13798F4FA1C1074771C1C96B1B43B98F3416D249ED8AB3171383772D0054829C3754A91B5E94135F1DF6D67A76F599C80E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C...............L.\|.....L.z....L.{.....H......H.z./...H.{.....H.\|.....L.~.......~.......w.H....................}.....Rich....................PE..L......d...........!...".....r............................................................@.........................@...T............0.......................@..`k......p...............................@...............P............................text............................... ..`.rdata..............................@..@.data...4...........................@....detourc.".......$..................@..@.detourd..... ......................@....rsrc........0......................@..@.reloc..`k...@...l..................@..B........................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.921437760987104
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	YY#U6302#U53f7#U534f#U8bae.exe
File size:	4'972'544 bytes
MD5:	765cf453d0cea3719b619e4c55881093
SHA1:	060ae0476bbd908d08537c8b6bb24d2ec83d524c
SHA256:	3d76cc27be3265077a5c15f2c76848b73148df035b7d3a3d2b9ad77232587cfd
SHA512:	2132af60567aaf5c89001c36edd0764ef5e336dd2260d20287953ce2dac4b80c7817d0c0fe410a0d092900181c3d360999f7f2c06b5eba51a2e54821175cec18
SSDEEP:	98304:ygvElT54uia2kf5SCyJsAh6wbwPy7kl/CNBIs0lApvWJ:yFT54rHi4H+Ah/bOUkVQY2oJ
TLSH:	893633D84EF59834C2A6033CE43172374EBFF657D628936E265CE6AEAC4D1819341A37
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#.vOB.%OB.%OB.% ].%FB.% ].%IB.%.^.%bB.%4^.%JB.%.].%cB.%.J.%MB.%OB.%.@.%-].%RB.%yd.%.B.%yd.%7B.%.].%.B.%.].%RB.%OB.%.B.%.D.%NB.

File Icon


Icon Hash:	099c9113582f8b55

Static PE Info

General

Entrypoint:	0xb93dda
Entrypoint Section:	.vmp1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66653771 [Sun Jun 9 05:02:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	fe512f2e549df2214891378c91f66a42

Entrypoint Preview

Instruction
push 0E4B68F2h
call 00007F34FD55337Dh
add byte ptr [eax], al
push esp
insb
jnc 00007F34FD09BFE8h
jc 00007F34FD09C007h
add byte ptr [eax], al
add byte ptr [edi+65h], al
je 00007F34FD09BFF5h
jns 00007F34FD09C015h
je 00007F34FD09C007h
insd
push esp
imul ebp, dword ptr [ebp+65h], 24648D00h
sbb al, E8h
popfd
add dword ptr [eax], eax
add byte ptr [ebx-18h], dl
lock add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [ebx+65h], dl
je 00007F34FD09BFF9h
imul ebp, dword ptr [esi+64h], 7845776Fh
je 00007F34FD09BFE7h
js 00007F34FD09BFA2h
add byte ptr [eax], al
inc edi
je 00007F34FD09BFF9h
outsd
insb
jne 00007F34FD09C00Fh
dec ecx
outsb
outsw
jc 00007F34FD09C00Fh
popad
je 00007F34FD09C00Bh
outsd
outsb
inc ecx
add byte ptr [eax], al
add byte ptr [ebx+72h], al
popad
je 00007F34FD09C007h
push esp
push 64616572h
add al, ch
pop esi
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [ebx+72h], al
popad
je 00007F34FD09C007h
inc esp
imul esi, dword ptr [edx+65h], 726F7463h
jns 00007F34FD09BFE3h
add byte ptr [eax], al
add byte ptr [edi+69h], dl
inc ebx
push 6F547261h
dec ebp
jne 00007F34FD09C00Eh
je 00007F34FD09C00Bh
inc edx
jns 00007F34FD09C016h
add byte ptr [eax], al
add byte ptr [edi+61h], dl
imul esi, dword ptr [esi+eax*2+6Fh], 6C754D72h
je 00007F34FD09C00Bh
jo 00007F34FD09C00Eh
dec edi
bound ebp, dword ptr [edx+65h]
arpl word ptr [ebx+esi*2+00h], si
add byte ptr [eax], al
inc ecx
jo 00007F34FD09C012h
outsb
dec ebp
outsb
jne 00007F34FD09BFE3h
add byte ptr [eax], al
add byte ptr [ebx+72h], al
popad
je 00007F34FD09C007h

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x79627c	0x168	.vmp1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x788000	0x6190	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc4c000	0x4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb9735b	0x850	.vmp1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19e742	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a0000	0x577b12	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x718000	0x6f3ca	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x788000	0x6190	0x3000	a1864bf4c4f443ebfc78e5e2fff8348b	False	0.394287109375	data	4.088331277576032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vmp0	0x78f000	0x3024	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp1	0x793000	0x4b8233	0x4b9000	5d3194b71c1a11ae1687b1d9c64ef151	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xc4c000	0x4c	0x1000	31b33e1e166e82486ce7540bf78125ec	False	0.0224609375	data	0.11968309355305998	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TEXTINCLUDE	0x78a5b8	0xb	data	Chinese	China	1.0
TEXTINCLUDE	0x78a5c4	0x16	data	Chinese	China	0.5
TEXTINCLUDE	0x78a5dc	0x151	data	Chinese	China	0.03857566765578635
RT_CURSOR	0x78a730	0x134	data	Chinese	China	0.04220779220779221
RT_CURSOR	0x78a864	0x134	data	Chinese	China	0.04220779220779221
RT_CURSOR	0x78a998	0x134	data	Chinese	China	0.04220779220779221
RT_CURSOR	0x78aacc	0xb4	data	Chinese	China	0.06666666666666667
RT_BITMAP	0x78ab80	0x16c	data	Chinese	China	0.03571428571428571
RT_BITMAP	0x78acec	0x248	data	Chinese	China	0.025684931506849314
RT_BITMAP	0x78af34	0x144	data	Chinese	China	0.058823529411764705
RT_BITMAP	0x78b078	0x158	empty	Chinese	China	0
RT_BITMAP	0x78b1d0	0x158	empty	Chinese	China	0
RT_BITMAP	0x78b328	0x158	empty	Chinese	China	0
RT_BITMAP	0x78b480	0x158	empty	Chinese	China	0
RT_BITMAP	0x78b5d8	0x158	empty	Chinese	China	0
RT_BITMAP	0x78b730	0x158	empty	Chinese	China	0
RT_BITMAP	0x78b888	0x158	empty	Chinese	China	0
RT_BITMAP	0x78b9e0	0x158	empty	Chinese	China	0
RT_BITMAP	0x78bb38	0x5e4	empty	Chinese	China	0
RT_BITMAP	0x78c11c	0xb8	empty	Chinese	China	0
RT_BITMAP	0x78c1d4	0x16c	empty	Chinese	China	0
RT_BITMAP	0x78c340	0x144	empty	Chinese	China	0
RT_ICON	0x788bf4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.26344086021505375
RT_ICON	0x788edc	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.41216216216216217
RT_ICON	0x789004	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0, resolution 2834 x 2834 px/m			0.6824577861163227
RT_MENU	0x78c484	0xc	empty	Chinese	China	0
RT_MENU	0x78c490	0x284	empty	Chinese	China	0
RT_DIALOG	0x78c714	0x98	empty	Chinese	China	0
RT_DIALOG	0x78c7ac	0x17a	empty	Chinese	China	0
RT_DIALOG	0x78c928	0xfa	empty	Chinese	China	0
RT_DIALOG	0x78ca24	0xea	empty	Chinese	China	0
RT_DIALOG	0x78cb10	0x8ae	empty	Chinese	China	0
RT_DIALOG	0x78d3c0	0xb2	empty	Chinese	China	0
RT_DIALOG	0x78d474	0xcc	empty	Chinese	China	0
RT_DIALOG	0x78d540	0xb2	empty	Chinese	China	0
RT_DIALOG	0x78d5f4	0xe2	empty	Chinese	China	0
RT_DIALOG	0x78d6d8	0x18c	empty	Chinese	China	0
RT_STRING	0x78d864	0x50	empty	Chinese	China	0
RT_STRING	0x78d8b4	0x2c	empty	Chinese	China	0
RT_STRING	0x78d8e0	0x78	empty	Chinese	China	0
RT_STRING	0x78d958	0x1c4	empty	Chinese	China	0
RT_STRING	0x78db1c	0x12a	empty	Chinese	China	0
RT_STRING	0x78dc48	0x146	empty	Chinese	China	0
RT_STRING	0x78dd90	0x40	empty	Chinese	China	0
RT_STRING	0x78ddd0	0x64	empty	Chinese	China	0
RT_STRING	0x78de34	0x1d8	empty	Chinese	China	0
RT_STRING	0x78e00c	0x114	empty	Chinese	China	0
RT_STRING	0x78e120	0x24	empty	Chinese	China	0
RT_GROUP_CURSOR	0x78e144	0x14	empty	Chinese	China	0
RT_GROUP_CURSOR	0x78e158	0x14	empty	Chinese	China	0
RT_GROUP_CURSOR	0x78e16c	0x22	empty	Chinese	China	0
RT_GROUP_ICON	0x78a0ac	0x14	data			1.2
RT_GROUP_ICON	0x78a0c0	0x14	data	Chinese	China	1.2
RT_GROUP_ICON	0x78a0d4	0x14	data	Chinese	China	1.25
RT_VERSION	0x78a0e8	0x214	data	Chinese	China	0.5375939849624061
RT_MANIFEST	0x78a2fc	0x2b9	XML 1.0 document, ASCII text, with very long lines (697), with no line terminators			0.5279770444763271

Imports

DLL	Import
RASAPI32.dll	RasHangUpA, RasGetConnectStatusA
WINMM.dll	midiStreamRestart, midiStreamClose, midiOutReset, midiStreamStop, midiStreamOut, midiOutPrepareHeader, waveOutRestart, waveOutUnprepareHeader, waveOutPrepareHeader, waveOutWrite, waveOutPause, waveOutReset, midiStreamProperty, midiStreamOpen, midiOutUnprepareHeader, waveOutOpen, waveOutClose, waveOutGetNumDevs
WS2_32.dll	WSAAsyncSelect, closesocket, send, select, WSACleanup, WSAStartup, gethostbyname, inet_ntoa, inet_addr, gethostname, htons, socket, sendto, recvfrom, ioctlsocket, connect, listen, getpeername, accept, __WSAFDIsSet, ntohs, htonl, bind, ntohl, WSAGetLastError, getsockname, recv
KERNEL32.dll	UnmapViewOfFile, CreateFileMappingA, MapViewOfFile, OpenFileMappingA, GetCurrentProcessId, GetSystemDirectoryA, GetWindowsDirectoryA, GetCurrentProcess, TerminateThread, GetModuleHandleW, VirtualQuery, LoadLibraryW, GetVersionExW, DeleteFileW, TerminateProcess, GetFileSize, SetFilePointer, CreateFileW, GetTempPathW, FileTimeToSystemTime, GetTimeZoneInformation, SetLastError, GetVersion, LocalFree, FormatMessageA, CreateMutexA, ReleaseMutex, SuspendThread, GetACP, CreateSemaphoreA, ResumeThread, InterlockedExchange, ReleaseSemaphore, IsBadCodePtr, IsBadReadPtr, CompareStringW, CompareStringA, GetStringTypeW, GetStringTypeA, SetUnhandledExceptionFilter, IsBadWritePtr, VirtualAlloc, LCMapStringW, LCMapStringA, SetEnvironmentVariableA, VirtualFree, HeapCreate, HeapDestroy, GetEnvironmentVariableA, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetFileType, SetStdHandle, HeapSize, ExitThread, GetLocalTime, GetSystemTime, RaiseException, RtlUnwind, GetStartupInfoA, GetOEMCP, GetCPInfo, GetProcessVersion, SetErrorMode, GlobalFlags, GetCurrentThread, GetFileTime, TlsGetValue, LocalReAlloc, TlsSetValue, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, lstrcmpA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcmpiA, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, DuplicateHandle, lstrcpynA, FileTimeToLocalFileTime, InterlockedDecrement, InterlockedIncrement, EnterCriticalSection, LeaveCriticalSection, GetProfileStringA, WriteFile, WaitForMultipleObjects, CloseHandle, WaitForSingleObject, CreateProcessA, GetTickCount, GetCommandLineA, MulDiv, GetProcAddress, GetModuleHandleA, GetVolumeInformationA, SetCurrentDirectoryA, GetCurrentDirectoryA, CreateDirectoryA, CopyFileA, DeleteFileA, GetFileAttributesA, SetFileAttributesA, FindClose, FindFirstFileA, GetTempPathA, CreateFileA, SetEvent, FindResourceA, LoadResource, LockResource, ReadFile, lstrlenW, RemoveDirectoryA, GetModuleFileNameA, GetCurrentThreadId, ExitProcess, GlobalSize, GlobalFree, DeleteCriticalSection, InitializeCriticalSection, lstrcatA, lstrlenA, WinExec, lstrcpyA, FindNextFileA, GlobalReAlloc, HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetUserDefaultLCID, MultiByteToWideChar, WideCharToMultiByte, GetFullPathNameA, FreeLibrary, LoadLibraryA, GetLastError, GetVersionExA, WritePrivateProfileStringA, GetPrivateProfileStringA, CreateThread, CreateEventA, Sleep, GlobalAlloc, GlobalLock, GlobalUnlock
USER32.dll	GetClassNameA, GetDesktopWindow, GetDlgItem, SetWindowTextA, MessageBoxW, GetSysColorBrush, wsprintfA, WaitForInputIdle, FindWindowExA, GetWindowTextA, ReleaseDC, LoadStringA, GetMenuCheckMarkDimensions, GetMenuState, SetMenuItemBitmaps, CheckMenuItem, MoveWindow, GetForegroundWindow, DefWindowProcW, GetPropA, RegisterClassA, CreateWindowExA, SetPropA, LoadIconA, TranslateMessage, DrawFrameControl, DrawEdge, DrawFocusRect, WindowFromPoint, GetMessageA, DispatchMessageA, SetRectEmpty, RegisterClipboardFormatA, CreateIconFromResourceEx, CreateIconFromResource, DrawIconEx, CreatePopupMenu, AppendMenuA, ModifyMenuA, CreateMenu, CreateAcceleratorTableA, GetDlgCtrlID, GetSubMenu, EnableMenuItem, ClientToScreen, EnumDisplaySettingsA, LoadImageA, SystemParametersInfoA, ShowWindow, IsWindowEnabled, TranslateAcceleratorA, IsDialogMessageA, ScrollWindowEx, SendDlgItemMessageA, MapWindowPoints, AdjustWindowRectEx, GetScrollPos, GetMenuItemCount, GetMenuItemID, SetWindowsHookExA, CallNextHookEx, GetClassLongA, UnhookWindowsHookEx, CallWindowProcA, RemovePropA, GetMessageTime, GetLastActivePopup, RegisterWindowMessageA, GetWindowPlacement, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamA, DestroyWindow, GrayStringA, DrawTextA, TabbedTextOutA, EndPaint, BeginPaint, GetWindowDC, CharUpperA, GetWindowTextLengthA, GetKeyState, CopyAcceleratorTableA, PostQuitMessage, IsZoomed, GetClassInfoA, DefWindowProcA, GetSystemMenu, DeleteMenu, GetMenu, SetMenu, PeekMessageA, IsIconic, SetFocus, GetActiveWindow, GetWindow, DestroyAcceleratorTable, SetWindowRgn, GetMessagePos, ScreenToClient, ChildWindowFromPointEx, CopyRect, LoadBitmapA, WinHelpA, KillTimer, SetTimer, ReleaseCapture, GetCapture, SetCapture, GetScrollRange, SetScrollRange, SetScrollPos, SetRect, InflateRect, IntersectRect, DestroyIcon, PtInRect, OffsetRect, IsWindowVisible, EnableWindow, RedrawWindow, GetWindowLongA, SetWindowLongA, GetSysColor, SetActiveWindow, SetCursorPos, LoadCursorA, SetCursor, GetDC, FillRect, IsRectEmpty, UnregisterClassA, IsChild, TrackPopupMenu, DestroyMenu, SetForegroundWindow, GetWindowRect, EqualRect, UpdateWindow, ValidateRect, InvalidateRect, GetClientRect, GetFocus, GetParent, GetTopWindow, PostMessageA, IsWindow, SetParent, DestroyCursor, SendMessageA, SetWindowPos, MessageBoxA, GetCursorPos, GetSystemMetrics, EmptyClipboard, SetClipboardData, OpenClipboard, GetClipboardData, CloseClipboard
GDI32.dll	ExtSelectClipRgn, LineTo, MoveToEx, ExcludeClipRect, GetClipBox, ScaleWindowExtEx, SetWindowExtEx, SetWindowOrgEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetTextColor, SetROP2, SetPolyFillMode, SetBkMode, SelectClipRgn, DeleteObject, CreateDIBitmap, GetSystemPaletteEntries, SelectPalette, RealizePalette, GetDIBits, GetWindowExtEx, GetViewportOrgEx, GetWindowOrgEx, BeginPath, EndPath, PathToRegion, CreateEllipticRgn, CreateRoundRectRgn, GetTextColor, GetBkMode, GetBkColor, GetROP2, GetStretchBltMode, GetPolyFillMode, CreateCompatibleBitmap, CreateDCA, CreateBitmap, SelectObject, CreatePen, PatBlt, CombineRgn, CreateRectRgn, FillRgn, CreateSolidBrush, CreateFontIndirectA, GetStockObject, GetObjectA, EndPage, EndDoc, DeleteDC, StartDocA, StartPage, BitBlt, CreateCompatibleDC, Ellipse, Rectangle, LPtoDP, DPtoLP, GetCurrentObject, RoundRect, GetTextExtentPoint32A, GetDeviceCaps, GetViewportExtEx, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, GetTextMetricsA, CreatePolygonRgn, GetClipRgn, SetStretchBltMode, CreateRectRgnIndirect, SetBkColor, CreatePalette, StretchBlt, SaveDC, RestoreDC
WINSPOOL.DRV	OpenPrinterA, DocumentPropertiesA, ClosePrinter
ADVAPI32.dll	RegSetValueExA, RegOpenKeyExA, RegCloseKey, RegQueryValueA, CryptReleaseContext, CryptDestroyHash, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptAcquireContextA, RegCreateKeyExA
SHELL32.dll	DragQueryFileA, SHGetSpecialFolderPathA, Shell_NotifyIconA, ShellExecuteA
ole32.dll	OleRun, CoCreateInstance, CLSIDFromString, OleUninitialize, OleInitialize, RegisterDragDrop, RevokeDragDrop, ReleaseStgMedium, CLSIDFromProgID
OLEAUT32.dll	SafeArrayAccessData, SafeArrayGetElement, VariantCopyInd, VariantInit, SysAllocString, SafeArrayDestroy, SafeArrayCreate, SafeArrayPutElement, RegisterTypeLib, LHashValOfNameSys, LoadTypeLib, SafeArrayUnaccessData, UnRegisterTypeLib, SafeArrayGetDim, SafeArrayGetLBound, SafeArrayGetUBound, VariantChangeType, VariantClear, VariantCopy
COMCTL32.dll	ImageList_Destroy
WLDAP32.dll
WININET.dll	InternetCanonicalizeUrlA, InternetCrackUrlA, HttpOpenRequestA, HttpSendRequestA, HttpQueryInfoA, InternetReadFile, InternetConnectA, InternetSetOptionA, InternetCloseHandle, InternetOpenA
comdlg32.dll	ChooseColorA, ChooseFontA, GetFileTitleA, GetSaveFileNameA, GetOpenFileNameA
KERNEL32.dll	VirtualProtect, GetModuleFileNameA, ExitProcess
USER32.dll	MessageBoxA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Target ID:	0
Start time:	14:02:56
Start date:	15/06/2024
Path:	C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YY#U6302#U53f7#U534f#U8bae.exe"
Imagebase:	0x400000
File size:	4'972'544 bytes
MD5 hash:	765CF453D0CEA3719B619E4C55881093
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Disassembly

⊘No disassembly

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YY#U6302#U53f7#U534f#U8bae.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\iext1.fnr.bbs.125.la

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

System Behavior

Analysis Process: YY#U6302#U53f7#U534f#U8bae.exePID: 908, Parent PID: 2580

General

Disassembly

Windows Analysis Report
YY#U6302#U53f7#U534f#U8bae.exe