ieUnatt[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ieUnatt.exe
Size

120KB
MD5

a077070139011cd0706288ef79219382
SHA1

3e39df9137a971e9b5046908da313da3ebbe1bf7
SHA256

43dd871eee337cb3f36d13b83bc5ddd95d74dc0effa0b46ef0fc3a79054b2860
SHA512

41e275b4732a0c978b1e76d5b9c49bd68f852719fc904333d9fac5897ffbb71bf43d8c928f4ca62fc91df999e09a80a0511c0322dde906c211bfeb40d38eb538
SSDEEP

3072:GUC1V1GvS/T/DFEISSYX5PFG0qYsXHsghJON0X:JUVaS/nmFLpwHrJOeX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ieUnatt.exe

Files

ieUnatt.exe
.exe windows:10 windows x86 arch:x86

1e43ff632aa51c8fffba8bef3073e0dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
EventWriteTransfer
EventRegister
EventProviderEnabled
EventUnregister
SetSecurityDescriptorDacl
EqualSid
OpenProcessToken
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
CheckTokenMembership

kernel32

DeviceIoControl
GetExitCodeProcess
GetDriveTypeW
GlobalUnlock
CopyFileExW
GlobalMemoryStatus
GetFileType
CreateProcessA
CreateProcessW
MoveFileExW
GlobalLock
ReleaseSemaphore
HeapCompact
GetOverlappedResult
GlobalFree
GlobalAlloc
GetVersionExA
GetDiskFreeSpaceExW
GlobalSize
GetPrivateProfileStringW
GetLogicalDriveStringsW
SetFileAttributesW
OpenProcess
HeapValidate
DuplicateHandle
HeapWalk
GetComputerNameExW
GetVersionExW
OpenEventW
GetLocaleInfoW
SetEndOfFile
SetErrorMode
SetFileTime
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
HeapSize
lstrcmpiW
LocalFree
GetLastError
GetCommandLineW
WritePrivateProfileStringW
CreateSemaphoreExW
HeapDestroy
Sleep
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
ExpandEnvironmentStringsW
LocalAlloc
TlsSetValue
HeapFree
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
GetTempPathW
GetFileAttributesW
UnmapViewOfFile
FormatMessageW
TlsAlloc
HeapReAlloc
RaiseException
GetWindowsDirectoryA
HeapAlloc
GetLocalTime
GetFileSize
DeleteCriticalSection
ExitProcess
GetProcessHeap
TlsGetValue
GetTempFileNameW
TlsFree
CreateFileMappingW
MapViewOfFile
VirtualQuery
GetModuleFileNameA
WriteFile
GetModuleFileNameW
SetFilePointer
CreateMutexW
CreateMutexA
WaitForSingleObject
CreateFileW
ReleaseMutex
GetVersion
CreateFileA
GetCurrentThread
DeleteFileA
DeleteFileW
CloseHandle
GetSystemInfo
GetProcAddress
CreateFileMappingA
FreeLibrary
DebugBreak
LoadLibraryExW
GetModuleHandleExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateDirectoryW
GetFileSizeEx
OutputDebugStringA
MultiByteToWideChar
GetWindowsDirectoryW
WideCharToMultiByte
IsDebuggerPresent
FlushFileBuffers
WaitForMultipleObjectsEx
CreateEventW
SetEvent
CreateThread
ResetEvent
ReadFile
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetVolumeInformationW
GetLogicalDrives
HeapCreate
VirtualFree
GetFullPathNameW
GetShortPathNameW
GetDiskFreeSpaceW
VirtualAlloc

msvcrt

_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
free
_callnewh
memcpy_s
__CxxFrameHandler3
_acmdln
_vsnprintf
wcsrchr
strrchr
_purecall
_wcsicmp
toupper
iswctype
swscanf_s
fclose
_wtoi
wcstok_s
_wfopen
fgetws
feof
wcschr
iswalpha
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_controlfp
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
memcpy
memmove
malloc
wcsncmp
_wcsnicmp
_itow_s
iswspace
_vsnwprintf
towlower
memset

shell32

CommandLineToArgvW
ord165
SHGetFolderPathW

shlwapi

ord158
StrChrW
StrCmpW

user32

UnregisterClassA
LoadStringW

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateGuid

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e43ff632aa51c8fffba8bef3073e0dd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

shell32

shlwapi

user32

api-ms-win-core-com-l1-1-0

oleaut32

Sections

.text Size: 101KB - Virtual size: 101KB

.data Size: 3KB - Virtual size: 6KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 101KB - Virtual size: 101KB

.data
Size: 3KB - Virtual size: 6KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB