�3���L�¡?��|���2�ei iܑ���=6�9ꂭ���tD��vqFU%���[:��mV��K��5�j8�仝���+x�#g=yLPl�� *���B旡���@������Z��.�_����Qx�� ���| ��8@&����2.�!��G:�e�]���&�/���* �^�����x�0#pT 9���3�1�u�N|`?~�H6��K3�v��fU��2�H��^;�����戂��v����%I�f%1a�WK�[��a�cz1��Z0T���<����ΐ؇�m� ��e�/�u�QB�����0_lՆ�D�li�զ��z���J�] ��7DA[�N�ja�7#�6��eQ L�^K������-�)E��).�q����$���S�����S9�(b�Q��k�R�a�%����5����LB��kǨ����ޢ�����b �*���j�ݏ��$ �҃�Yj�����jwq��]�G���(�7dZi]�£�8'HαUA�� �������įT�sd�y=b�mh��ْ:�[gr�����r�4f��ҟj����8-%w۹h��W�)g��(�]�W���k�P�[b��0��J[��_�bղK8@���������}! h[E!%O������W�� -�":� �l� Ш�[�����N#�nf���+�}�17D�L�}Hf�"5���f W��63��J �\>����B�Z[�� IH�H�����5ԩ>|����N�����@-e��^q�c�\q\\.Q>�@y��W��wU�K/p' �Z��6�Ʊ��'^]v��Cv��ո0I,��Ɇ+�ܓ$�FK�nL�D�ltPxPwV\2֮d�yXN �Τ����I�/����`,�tV|���;�,���`2 ��4��դ\�4[~l�5��8^��4a��>�ƽ�����\R��)R����4/�����jph����u��G��ʩ��'���D.9��̂�x�ocjGI^dfHm�ubU�Y#�k#˒X����F%�D���sm/�uwF�-�%�b'�H�w�7y�3e���P���$\���e�C4�Hѣ���C� c{H���$.h]O�h����NN�jn���I\���.�oP><z���4^3���ھ�����ᇈ!)�w�ſ�z�IV������G�F�+���U4yx������ֲ��X4�K%<s�ƥV��rj@���v�ƌpʒC%��}�)c��rkO�IZ@���¯ T�=�@?��M�����Ibj�-�3IP�]W.� � `���b�R��{+���X"ò�ٽ��Z��@O}�c��s�B���7��^A���y�us���'O��c��;�b��*?�wS��=�'�t��dcu���D�9�t�0/&^8ʁ�K��m��2���]j��T��' ���]E�]�������<������8��H7f��4<$p#s|���;;5��4�Q�����~��ܨ1��+29xzʹ>�^Q�����7��)v� �,A�Y<G�#19?�q�"�����M��n'��y��Hl�5�ԕ5���^�D��$�$������A��\�Ͼ�I���nWh��eBFn���aS�>��&�>����w�� �:�g�0 �������wt�Bu�&*�Ǔ���d{�4d��h�4�E�O|��T��D��г�!}��9>��UP"�`Q�D0�<���w� ��{R��ګP�W�����)�d�`��Q�����)*�TA)�rޙF�j:�n�%9��� Y7���Ԏ2K��ň7Q��Ƣ%���p��� �k�m|J���c�4�K'��v ��a�k��Δ2c��,k���r@C��g\��}j8��Ef���GX������V}��e�k��r4���-SGA^s���`OLJ♓����lJ��_F����V�J�8�I�_�L��|�S�.�=N��3��_Yf����h8�+�Mj�2a3:Q���u��&�g�D�G���O��v���1*t �:h ��7�Q���K>*��S*������G��|aP�b��?��-�(�b�g��UCSz��xn�|�7$��~�D6% �n�� ��o$�{���9Gɥo� b������=!lͫhQ��a������vS���ܸ��:�W�b^'����_X���q���&;c.X��H�b}Ae$ߗ~�m�����������tG�.g�=g �^�E��[�G~f�Z������&�29%�/�f���������1c�Ə:άz����#���+�j�5ӯ���Y�;pܦ�Y���GѺR�Dx���������&10��2�~���PK�e#z�7)��&����*����-�5t�M���Rb��r�:x�M�]p�(��lp������r$�E�"���obCES3'u 5.'���f\_�O�U|��j(.r2�!׆�d4�(����x}5��9KB����)���ϼ��r��mlS�� �cRO�����u���}� E�{�Ӗ������q*P'�;]ڏUR�-6�k���2�<|� P&��wZ�f�0��_�+~�ρb�K��S���M?1�����_t�M��u+���M�'�?N����<�U�)�T&ty����a/rƻfc`�b�J��ԍ�]��J�%�����N9+�q���k����dmD�_ԋ�~c�>�ci�T��(.�D�F,9A�G������4�Q�5���{��y����Q�OOȂa\&c>�4`02�2���Ȣ�m�^�nK�b��mݠT���:�-�Uߠ��x����p��*F��c�Z@u�6 jO���e��#Ȓ̾]�Mn������6��qlӢ0A�q�s��� G��:��ꀦ�Q��A4p@����>uw��_s0I,�X��ܦ�r��[XAf�6���EUݢ�~�,��'t���~H���֠s0w�:_K�x��E�� ɻH0��Ș�hΓ��=���*�.%=�� ����A���~m/ZH���_�3��֏��dGO�n�Icd��������EF!��ǫ]Ȅ�,w_�EH��;��ӹ�pG�O É�Y�
Static task
static1
Behavioral task
behavioral1
Sample
uwuu.exe
Resource
win10-20230220-en
General
-
Target
uwuu.exe
-
Size
5.4MB
-
MD5
80b687555fbdfdd3181bf56957d47af5
-
SHA1
141d3febb3e9e641396b87a182b64651c53b09c0
-
SHA256
17682cdc2b8c088c374e65ba520490cda68442ee9bf83d9e5e0e8ba4280f6ac7
-
SHA512
7721359fcc144e75a25538494fda6a174e49509440960ba23349223f75a73a560266f3b258d68371711f7926595f930cb81f043ae35849a26bcc65fda484e698
-
SSDEEP
98304:B7HVcv9B5g4/nD4XZZdyLtGN/wKc9hlEy90rKTtz0AbxZ2IJe9hU:B7yv9Dg4/sZq5UaXEgWKBz0oyIM9hU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource uwuu.exe
Files
-
uwuu.exe.exe windows x64
b8b2421f89a6d26e1b29ee7c3280b58b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
iphlpapi
GetAdaptersInfo
kernel32
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegSetValueExA
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXVec3Transform
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
wininet
InternetReadFile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 831KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 418KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uwu0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uwu1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ