MuiUnattend[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

MuiUnattend.exe
Size

61KB
MD5

0c3201f9dffaa3a53d40dc7fed00d948
SHA1

f74c65c1a6d938efe110413699493bbbe1fd1da5
SHA256

a4ad03c8b96059ac25cc470965653bc1ea2a0c88926337c62dee94a303087ce3
SHA512

e8422225833217beed3c1a4176d2cc8e0c7ca0519c170eaaa2dce6bfae3433b3c4be6f6adb7fcd4ca6f56d51c2091c5fdda315de092347098ea2a94deecc0442
SSDEEP

1536:dLBbUEw5AAzBdmnjR06uzQvNJaI1Z3UxSFMx:ltaSAziR06uzgNJasf4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MuiUnattend.exe

Files

MuiUnattend.exe
.exe windows x86

6d846b02041a824ac83ecb2f61cc5a00

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
PrivilegeCheck

kernel32

ExpandEnvironmentStringsW
HeapSetInformation
LocaleNameToLCID
SetUserGeoID
GetSystemDefaultLocaleName
GetProcAddress
GetLastError
GetLocaleInfoEx
CompareStringOrdinal
LoadLibraryW
GetProcessHeap
HeapFree
HeapAlloc
FreeLibrary
GetUserDefaultLocaleName
GetWindowsDirectoryW
GetFileAttributesW
NlsUpdateLocale
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
MapViewOfFile
UnmapViewOfFile
CreateFileW
SetLastError
CreateFileMappingW
RegEnumKeyExW
CloseHandle
FindFirstFileW
FindClose
FindNextFileW
GetFileAttributesExW
RegLoadKeyW
RegUnLoadKeyW
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
DeleteCriticalSection
GetFullPathNameW
CreateDirectoryW

msvcrt

_wcsicmp
memcpy
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_vsnwprintf
wprintf
memmove
memset
wcschr
_wcsnicmp
bsearch
wcsrchr
_vsnprintf

ntdll

RtlpSetInstallLanguage
RtlpSetPreferredUILanguages
RtlNtStatusToDosError
RtlGetUILanguageInfo
RtlFreeHeap
RtlAllocateHeap

input

ord104
ord111
ord107
ord109

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d846b02041a824ac83ecb2f61cc5a00

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

input

Sections

.text Size: 51KB - Virtual size: 50KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 51KB - Virtual size: 50KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB