MALICIOUS — YimMenuV2.dll

MALICIOUS — YimMenuV2.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the HUILoader family. 3 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: ac4cbcc25baeace9e9640ed59a5a596d6432fc6affc9c7c83993197a5cbfd625
• SHA-1: 31bb0767e405798d3d98deaf61a5bb3e55273f14
• MD5: f1a1b592e88c511bfb7c92315dd8785d
• imphash: 016b9aeee2c8d9d21b3dab4dd5786531
• ssdeep: 49152:3g010Y4jlYX23944j+IsJtXGeBWuJkyYEayfTCyYeX9fW0ugRkJdZJ/N/h/UEvy:B1y/CWeMKrGydSQkJdt20XcUXl
• TLSH: T1AF676D5964567581C0F2BC18F431C9DEC143E958B53549CE938AD20BA2B9FFBA3F84A0
• Submitted as: YimMenuV2.dll
• File type: pe · Size: 6921728 bytes
• Verdict: malicious (88/100) · Family: HUILoader

Detections (3 of 55 engines)

• capa (capabilities): capability:collection/keylog
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Kepavll!rfn

MITRE ATT&CK

• T1057
• T1056.001

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Kepavll!rfn (rule Trojan:Win32/Kepavll!rfn) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://matrix.to/#/#yimmenu:matrix.org, https://www.dearimgui.com/faq/ - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://github.com/YimMenu/YimMenuV2
• https://matrix.to/#/#yimmenu:matrix.org
• https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage
• https://github.com/ocornut/imgui/issues/8465
• https://www.dearimgui.com/faq/

Embedded domains

• github.com
• matrix.to
• matrix.org
• www.dearimgui.com
• dearimgui.com

File paths

• T:\:d:p:
• R:\2
• D:\a\YimMenuV2\YimMenuV2\build\YimMenuV2.pdb

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report