Static task
static1
General
-
Target
UNINSTALL.exe
-
Size
623KB
-
MD5
2b32eef35102ea26175e5df0456e847a
-
SHA1
e4aa0baf34b3c0995f5ee255d8bab60c6f0d1622
-
SHA256
69bcd0241a5aaab9a63d1cc49a76be0454017ffa0cc1bf02b7de55f10f9b16bc
-
SHA512
a8f106839d38f1fab4956a4d4c4444d00bfc7c4f93deb15a1431ba8977cee4208da991695a47d869a93f36a5f77d099d909bbeca0b878d45f390ae81fbe0767c
-
SSDEEP
6144:t6LT6OYdZFo/Dj9lEYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1ltzqtH:0LTF9jvEZ3CmW9lsq+eYzZtLaxeU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UNINSTALL.exe
Files
-
UNINSTALL.exe.exe windows:6 windows x86 arch:x86
Password: docksin
ab83d78d83be945667da4961e44446da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
FindNextFileW
GetCurrentProcess
WriteFile
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
SetThreadUILanguage
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetTempPathW
FindClose
CreateFileW
MultiByteToWideChar
GetLastError
DeleteFileW
CloseHandle
CreateThread
GetProcAddress
SetFilePointerEx
GetFileSize
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
DecodePointer
HeapReAlloc
HeapSize
FlushFileBuffers
GetConsoleOutputCP
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
WriteConsoleW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetThreadLocale
FindFirstFileW
ReadFile
SetStdHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetFileType
ExitProcess
GetModuleHandleExW
GetStdHandle
GetConsoleMode
HeapAlloc
HeapFree
LCMapStringW
user32
GetMessageW
DefWindowProcW
MessageBoxExW
CreateWindowExW
SendMessageW
GetSystemMetrics
RegisterClassExW
ShowWindow
DispatchMessageW
TranslateMessage
LoadIconW
PostQuitMessage
EnableWindow
DestroyWindow
gdi32
CreateSolidBrush
CreateFontW
advapi32
RegDeleteKeyW
shell32
ShellExecuteW
SHGetSpecialFolderPathW
Sections
.text Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 286KB - Virtual size: 286KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ