uotd[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

uotd.exe
Size

1.9MB
MD5

cd80a00dfd1fd4af68f61150876f5110
SHA1

62fb27f5e9b29a8942c779a69a71669e61b96f17
SHA256

ba80384f3b7429c4cb34fb32154eb23b4b896da8f86ff9ce27c49e54a1ef106c
SHA512

6c16a0d210fd7f3e88ce10684de363f06b06285f33c90977c84a8be01cbce86476a4f7265aa256d6753aa9eb85d9d6080dfc8147a7123de1f8b7b2fcf08fe7d8
SSDEEP

49152:1knnVveVVj6r3Q4Vfe1lhyGlxu+Bt3Bwv:1knnVveVh4Vfe1GGlxu+fRc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
uotd.exe

Files

uotd.exe
.exe windows x86

a0c96ae64fcb045831b68dc3227372b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

binkw32

_BinkDDSurfaceType@4
_BinkOpenDirectSound@4
_BinkSetSoundSystem@8
_BinkOpen@8
_BinkWait@4
_BinkClose@4
_BinkCopyToBuffer@28
_BinkNextFrame@4
_BinkDoFrame@4

granny

_GrannyLockSequenceForRendering@16
_GrannyUnlockIntersection@8
_GrannyGetNextIntersection@12
_GrannyGetIntersectionsLeft@12
_GrannyLockSequenceForRayIntersection@20
_GrannyGetBoneTreeState@20
_GrannyAttachSequence@32
_GrannyDetachSequence@8
_GrannyStopWearingSequence@8
_GrannyWearSequence@16
_GrannyGetAnimationParameter@20
_GrannyHasControlExpired@16
_GrannyAddControlledAnimation@20
_GrannySetAnimationParameter@24
_GrannySetSequenceAccumulating@12
_GrannyOpenSequence@12
_GrannySetSequencePosition@12
_GrannyCloseSequence@8
_GrannyReleaseControlledAnimation@12
_GrannyClose@4
_GrannyOpenVersion@20
_GrannyGetPreference@12
_GrannySetPreference@12
_GrannyGetBoneCount@12
_GrannyGetBoneState@20
_GrannyOpenAnimation@12
_GrannyGetToolCoordinateSystemForAnimation@16
_GrannyTransformAnimation@16
_GrannyOpenModel@12
_GrannyGetToolCoordinateSystemForModel@16
_GrannyRecommendTransform@28
_GrannyTransformModel@16
_GrannyCloseAnimation@8
_GrannyCloseModel@8
_GrannyGetExpiredTexturesLeft@8
_GrannyGetNextExpiredTextureCookie@8
_GrannyGetCurrentTime@8
_GrannyAdvanceTime@12
_GrannyGetNewTexturesLeft@8
_GrannyLockNextNewTexture@8
_GrannyUnlockNewTexture@8
_GrannyAllowTextureFormat@8
_GrannyUnlockRendering@8
_GrannyUnlockRenderingState@4
_GrannyLockNextRenderingState@12
_GrannyGetRenderingStatesLeft@12

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

SetFilePointer
FlushFileBuffers
GetFileType
GetStartupInfoA
WideCharToMultiByte
CreateDirectoryA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetSystemTime
RaiseException
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetFullPathNameA
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
HeapSize
LCMapStringA
LCMapStringW
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
Sleep
InterlockedExchange
CloseHandle
WriteFile
CreateFileA
GetLastError
LeaveCriticalSection
EnterCriticalSection
FindClose
FindNextFileA
FindFirstFileA
QueryPerformanceFrequency
GetEnvironmentStringsW
LocalFree
FormatMessageA
GetDiskFreeSpaceA
GetDriveTypeA
GetProcAddress
LoadLibraryA
GetLogicalDrives
GlobalMemoryStatus
GetTickCount
SetThreadPriority
CreateThread
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResumeThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
FlushViewOfFile
GetCurrentProcessId
FreeLibrary
GetVersion
OpenFileMappingA
ExitProcess
GetVersionExA
GlobalUnlock
GlobalLock
MultiByteToWideChar
GetACP
IsDBCSLeadByte
CreateMutexA
ReleaseMutex
GetTimeZoneInformation
GetSystemInfo
DeviceIoControl
GetLogicalDriveStringsA
GetCurrentDirectoryA
GetModuleFileNameA
SetFileAttributesA
GetFileAttributesA
GetCommandLineA
GetProfileStringA
TerminateProcess
CreateProcessA
OpenProcess
HeapFree
GetProcessHeap
HeapAlloc
MoveFileA
DeleteFileA
GetExitCodeProcess
SetCurrentDirectoryA
ReadFile
GetCurrentProcess
OpenMutexA
GetModuleHandleA
lstrcmpiA
IsBadReadPtr
GetWindowsDirectoryA
SetEndOfFile
SetStdHandle
GetStringTypeA
GetStringTypeW
IsBadCodePtr
CompareStringA
CompareStringW
QueryPerformanceCounter
SetEnvironmentVariableA

user32

GetAsyncKeyState
GetKeyNameTextA
GetDoubleClickTime
DestroyMenu
ShowCursor
GetMenu
SetWindowTextA
SetWindowTextW
IsWindowUnicode
CheckMenuItem
LoadAcceleratorsA
SetCursor
LoadCursorA
GetWindowDC
GetDesktopWindow
FindWindowA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
PeekMessageA
UnregisterClassA
UnregisterClassW
SendMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
CreateWindowExW
RegisterClassW
LoadIconA
LoadMenuA
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
DefWindowProcA
DefWindowProcW
GetActiveWindow
SetFocus
SetCapture
ReleaseCapture
IsZoomed
GetSystemMetrics
EndPaint
BeginPaint
PostQuitMessage
GetWindowRect
GetFocus
ScreenToClient
GetCursorPos
DestroyWindow
GetMessageA
SetWindowPos
SetWindowLongA
GetWindowLongA
SetMenu
MoveWindow
MapVirtualKeyA
KillTimer
SetTimer
LoadImageA
GetParent
GetClassInfoA
DrawTextA
SetWindowPlacement
AdjustWindowRectEx
GetWindowPlacement
wsprintfA
MessageBoxA
CopyRect
IsIconic
GetClientRect
ClientToScreen
GetDC
ReleaseDC
GetKeyState

gdi32

StretchBlt
GetObjectA
GetPaletteEntries
GetDeviceCaps
DeleteDC
SetBkMode
CreateDIBSection
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
GetStockObject
SetTextColor

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

ole32

CoUninitialize
CoInitialize

wsock32

socket
recvfrom
sendto
ntohl
gethostbyname
gethostname
WSAStartup
WSACleanup
closesocket
inet_ntoa
setsockopt
send
connect
htons
htonl
__WSAFDIsSet
select
WSAGetLastError
recv
ntohs
bind

ddraw

DirectDrawEnumerateExA
DirectDrawCreateEx

dsound

ord1

winmm

timeKillEvent
timeSetEvent
mciSendCommandA
midiOutSetVolume
midiOutGetDevCapsA
midiOutGetVolume
timeGetTime

igrping

?SendPingMessage@@YA_NPADH00H@Z

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 268KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 9.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

LBMPEG_D
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0c96ae64fcb045831b68dc3227372b9

Headers

File Characteristics

Imports

binkw32

granny

version

kernel32

user32

gdi32

advapi32

ole32

wsock32

ddraw

dsound

winmm

igrping

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 268KB - Virtual size: 264KB

.data Size: 100KB - Virtual size: 9.5MB

LBMPEG_D Size: 4KB - Virtual size: 1024B

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 268KB - Virtual size: 264KB

.data
Size: 100KB - Virtual size: 9.5MB

LBMPEG_D
Size: 4KB - Virtual size: 1024B

.rsrc
Size: 8KB - Virtual size: 4KB