Usermode[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Usermode.exe
Size

891KB
MD5

6af0b7343735d2a8097161da818bf695
SHA1

a32b4b752604a0cc22f1c20908bf382c6ba72e2d
SHA256

a9d964904a37104d0f7479d3105c9c3d49a114db428b8cb76f93ea0cedec613f
SHA512

3d7494d555199e9043cb725eaa717b8dccc537603a385c8d0fd9a499eca04eda790643f8481723345d21932134c3d0bd8637f394b521d8b7915ab1a033d74a1d
SSDEEP

24576:NPIEWpik1u5utseNqvSpahyWCYIA+exjVd9ztKyG7I+oTh:NgEWknwsMAiEyWCYIAdZVd9zIy4boT

Score

1^/10

Malware Config

Signatures

Files

Usermode.exe
.exe windows x64

4d3bcac96bd74c8c3e69b4563a91d9af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GlobalFindAtomA
GetModuleHandleA

user32

GetForegroundWindow
GetDC

advapi32

RegOpenKeyW
RegQueryValueA

msvcp140

_Mtx_lock

ntdll

RtlInitUnicodeString

imm32

ImmReleaseContext

d3d9

Direct3DCreate9Ex

xinput1_4

ord2

normaliz

IdnToAscii

wldap32

ord41

crypt32

CertFindCertificateInStore

ws2_32

WSAGetLastError

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

system

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

shell32

ShellExecuteA
DragFinish

Sections

.data
Size: - Virtual size: 805KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: - Virtual size: 454KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 888KB - Virtual size: 888KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4d3bcac96bd74c8c3e69b4563a91d9af

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

kernel32

user32

advapi32

msvcp140

ntdll

imm32

d3d9

xinput1_4

normaliz

wldap32

crypt32

ws2_32

psapi

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

shell32

Sections

.data Size: - Virtual size: 805KB

.rsrc Size: - Virtual size: 454KB

.pdata Size: - Virtual size: 28KB

.rsrc Size: 1KB - Virtual size: 1KB

.pdata Size: 888KB - Virtual size: 888KB

.data
Size: - Virtual size: 805KB

.rsrc
Size: - Virtual size: 454KB

.pdata
Size: - Virtual size: 28KB

.rsrc
Size: 1KB - Virtual size: 1KB

.pdata
Size: 888KB - Virtual size: 888KB