InputInterceptorUninstaller[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

InputInterceptorUninstaller.exe
Size

6.0MB
MD5

6f76bcb23278e969f31ca02c50d6b19b
SHA1

63da2fcab3406d0df96da821ab36c9aa044b2e71
SHA256

bef512ad4d8b2ee34835e2df35dc45852f3ce8488eb2bb28f6852d8590044582
SHA512

8d9a6dce8ccff65cb7d92a6cb502249d7ea761d5e244656d29d704e06a98aa88bdde68ff712a1b52176a33f32a34bd99278d639ebd0d835de1d33d9f5a63094b
SSDEEP

49152:xY6KHawqrYrQ8ZKDudN0yjmwQ+U0CgjuFApadygUQifAvs6MQewaTkIN2QgFJnj7:xY65Kd8j5UIDd1xOi3wq13b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InputInterceptorUninstaller.exe

Files

InputInterceptorUninstaller.exe
.exe windows:6 windows x64 arch:x64

78b0c23a8e86a76a7090f70cb54bba33

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
DuplicateTokenEx
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
CheckTokenMembership
EventWrite
EventRegister
EventEnabled

bcrypt

BCryptGenRandom

kernel32

TlsFree
TlsSetValue
GetCPInfoExW
GetConsoleOutputCP
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetConsoleMode
GetFileType
ReadFile
ReadConsoleW
ReadConsoleInputW
WriteFile
WriteConsoleW
ExitProcess
RaiseFailFastException
GetTickCount64
GetCurrentProcessorNumber
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetProcAddress
CloseThreadpoolIo
FindNLSStringEx
CompareStringEx
FindStringOrdinal
GetUserPreferredUILanguages
InitializeConditionVariable
WakeConditionVariable
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FileTimeToSystemTime
GetLastError
GetCurrentProcess
GetSystemTime
LocalAlloc
LocalFree
SetLastError
SystemTimeToFileTime
WaitForMultipleObjectsEx
WaitForSingleObject
Sleep
GetCurrentThread
TzSpecificLocalTimeToSystemTime
WaitForThreadpoolWaitCallbacks
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
CompareStringOrdinal
GetLocaleInfoEx
EnumTimeFormatsEx
GetCalendarInfoEx
EnumCalendarInfoExEx
ResolveLocaleName
SleepConditionVariableCS
CreateFileW
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFullPathNameW
GetLongPathNameW
GetOverlappedResult
GetSystemDirectoryW
GetTempFileNameW
LoadLibraryExW
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
CloseHandle
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
FormatMessageW
GetConsoleCP
GetExitCodeProcess
CreateProcessW
OpenProcess
K32EnumProcesses
GetProcessId
CreatePipe
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
VirtualQuery
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
TerminateProcess
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
DebugBreak
SleepEx
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
GetCurrentProcessorNumberEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetProcessGroupAffinity
SetThreadGroupAffinity
SetThreadAffinityMask
GetNumaProcessorNodeEx
K32GetProcessMemoryInfo
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

ole32

CoUninitialize
CoGetApartmentType
CoCreateGuid
CoWaitForMultipleHandles
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

__setusermatherr
fmod
nan
_fdclass
_dclass
roundf
ceil
nanf
cos
floor
pow
round
fmodf
modf
tan
sqrt
sin

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_callnewh
_set_new_mode

api-ms-win-crt-string-l1-1-0

strcpy_s
strncpy_s
wcsncmp
strcmp
_stricmp
strncmp
_wcsicmp

api-ms-win-crt-convert-l1-1-0

strtoul
atol

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_seh_filter_dll
_initialize_narrow_environment
_exit
abort
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
terminate
_crt_at_quick_exit
_crt_atexit
exit
_execute_onexit_table
_register_onexit_function
_seh_filter_exe
_set_app_type
_initterm_e
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
_set_fmode
__stdio_common_vsprintf_s
__p__commode
__stdio_common_vsprintf
__stdio_common_vsscanf
__acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 601KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

memcpy_
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78b0c23a8e86a76a7090f70cb54bba33

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 601KB - Virtual size: 600KB

.managed Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 2.5MB - Virtual size: 2.5MB

.data Size: 125KB - Virtual size: 184KB

.pdata Size: 199KB - Virtual size: 199KB

memcpy_ Size: 512B - Virtual size: 264B

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 65KB - Virtual size: 64KB

.text
Size: 601KB - Virtual size: 600KB

.managed
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 125KB - Virtual size: 184KB

.pdata
Size: 199KB - Virtual size: 199KB

memcpy_
Size: 512B - Virtual size: 264B

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 65KB - Virtual size: 64KB