UsendMii[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

UsendMii.exe
Size

17.0MB
MD5

5882737477ef2b2085ba453f79d50c32
SHA1

22808d71b5aed324d40a5e7daa478574301a2afd
SHA256

c27c89226579caefdaee2dcb11802e6b4e9b5ab4c8396f66091e76d0cbc3e2b4
SHA512

fe988cdf7cc76a1a2e0a2811d701b00432cfda464aeeff45073bab9d4b2ba17adbdc6c1edb89c1cfe8185ad6f99c9ebcfcbf26d7d726b60cb8c8c80e8e39e569
SSDEEP

98304:39dwpTwpGxOaECuHZV81sWSJ7FfYS1ep9piT/3eCTXfligzJCC:3YpEUxOaYHQ4vfYix/VXfD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UsendMii.exe

Files

UsendMii.exe
.exe windows:6 windows x64 arch:x64

2ffebfa5ad9ddfb8a97746dc60d39a79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
RegFlushKey
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegReplaceKeyW
RegRestoreKeyW
RegSaveKeyW
RegSetValueExW
RegUnLoadKeyW

kernel32

AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CompareStringA
CompareStringW
CopyFileW
CreateDirectoryA
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateMutexA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
EnumCalendarInfoW
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindResourceA
FindResourceW
FormatMessageW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCPInfoExW
GetCommandLineW
GetConsoleCP
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDriveStringsW
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadLocale
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultUILanguage
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationW
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockResource
MapViewOfFile
MoveFileW
MulDiv
MultiByteToWideChar
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryA
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleCount
SetLastError
SetThreadLocale
SetThreadPriority
SizeofResource
Sleep
SuspendThread
SwitchToThread
SystemTimeToFileTime
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualQuery
VirtualQueryEx
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
lstrlenW
RtlRestoreContext
RtlUnwindEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winspool.drv

ClosePrinter
DeviceCapabilitiesW
DocumentPropertiesW
EnumPrintersW
GetDefaultPrinterW
GetPrinterW
OpenPrinterW
SetPrinterW

comctl32

InitCommonControls

comdlg32

GetOpenFileNameW
GetSaveFileNameW
PageSetupDlgW
PrintDlgW

gdi32

AbortDoc
BeginPath
BitBlt
CombineRgn
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreateICW
CreateRectRgn
DeleteDC
DeleteObject
EndDoc
EndPage
EndPath
EnumFontFamiliesExW
EnumFontsW
ExcludeClipRect
ExtCreateRegion
GetCharABCWidthsFloatW
GetDeviceCaps
GetObjectA
GetPath
GetRegionData
GetStockObject
GetTextExtentPoint32W
GetTextMetricsW
GetWindowOrgEx
SelectObject
SetAbortProc
SetBkColor
SetMapMode
SetTextAlign
SetTextColor
SetWindowOrgEx
StartDocW
StartPage
TextOutW

shell32

DragQueryFileW
SHGetSpecialFolderPathW
ShellExecuteW

user32

ActivateKeyboardLayout
AppendMenuW
BeginPaint
CallNextHookEx
CallWindowProcW
CharLowerBuffA
CharLowerBuffW
CharLowerW
CharNextW
CharUpperBuffA
CharUpperBuffW
CharUpperW
CheckMenuItem
ClientToScreen
CloseClipboard
CreateMenu
CreateWindowExW
DefWindowProcW
DestroyMenu
DestroyWindow
DispatchMessageW
DrawIconEx
DrawTextW
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndPaint
EnumChildWindows
EnumDisplayMonitors
EnumThreadWindows
FindWindowExW
FindWindowW
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClassInfoW
GetClassNameW
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetFocus
GetKeyNameTextW
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameW
GetMenu
GetMenuItemCount
GetMenuItemInfoW
GetMessageExtraInfo
GetMessageTime
GetMonitorInfoW
GetParent
GetPropW
GetRawInputData
GetScrollInfo
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetUpdateRect
GetUpdateRgn
GetWindow
GetWindowDC
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsMenu
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadIconW
LoadKeyboardLayoutW
LoadStringW
MapVirtualKeyW
MessageBoxIndirectW
MessageBoxW
MonitorFromPoint
MonitorFromWindow
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
RegisterDeviceNotificationW
RegisterRawInputDevices
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropW
ScreenToClient
SendInput
SendMessageTimeoutW
SendMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetCursor
SetFocus
SetMenu
SetMenuItemInfoW
SetParent
SetPropW
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowScrollBar
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnloadKeyboardLayout
UnregisterClassW
UnregisterDeviceNotification
UpdateLayeredWindow
UpdateWindow
WINNLSEnableIME
WaitMessage
WindowFromPoint
GetWindowLongPtrW
SetWindowLongPtrW
wsprintfA

winmm

timeGetTime

imm32

ImmGetCompositionStringW
ImmSetCompositionStringW

ole32

CLSIDFromProgID
CoCreateInstance
CoGetClassObject
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
DoDragDrop
IsEqualGUID
OleDraw
OleInitialize
OleRegEnumFormatEtc
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop

oleaut32

CreateErrorInfo
GetActiveObject
GetErrorInfo
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArrayUnaccessData
SetErrorInfo
SysAllocString
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringLen
VariantChangeType
VariantClear
VariantCopy
VariantCopyInd
VariantInit

d3d9

Direct3DCreate9

ws2_32

WSACleanup
WSAGetLastError
WSALookupServiceBeginW
WSALookupServiceEnd
WSALookupServiceNextW
WSASetServiceW
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getsockname
listen
recv
select
send
setsockopt
socket

Exports

Exports

Form1
ThreadedStringQueue
WebDataModule
_ZN16Resourceincluder12FinalizationEv
_ZN16Resourceincluder14initializationEv
_ZTR10TWiiRemote
_ZTR11IXMLBoxType
_ZTR11TController
_ZTR11THTTPParser
_ZTR11TXMLBoxType
_ZTR12IXMLRectType
_ZTR12TGameControl
_ZTR12TWiiUGamePad
_ZTR12TXMLRectType
_ZTR13THTTPDispatch
_ZTR14IXMLButtonType
_ZTR14IXMLScreenType
_ZTR14TEventRenderer
_ZTR14TWebDataModule
_ZTR14TXMLButtonType
_ZTR14TXMLScreenType
_ZTR15THTTPDispatcher
_ZTR15TInputProcedure
_ZTR15TStreamRenderer
_ZTR15TXboxController
_ZTR16IXMLUsendMiiType
_ZTR16TContentRenderer
_ZTR16TListBoxWithRect
_ZTR16TXMLUsendMiiType
_ZTR17IXMLExtensionType
_ZTR17IXMLWiiRemoteType
_ZTR17TResourceRenderer
_ZTR17TXMLExtensionType
_ZTR17TXMLWiiRemoteType
_ZTR18IXMLButtonTypeList
_ZTR18IXMLExtensionsType
_ZTR18IXMLWiiRemotesType
_ZTR18TClassicController
_ZTR18TGameControlButton
_ZTR18TVirtualController
_ZTR18TWiiUProController
_ZTR18TXMLButtonTypeList
_ZTR18TXMLExtensionsType
_ZTR18TXMLWiiRemotesType
_ZTR19IXMLWiiUGamePadType
_ZTR19TGameCubeController
_ZTR19TWinInputSimulation
_ZTR19TXMLWiiUGamePadType
_ZTR20IXMLGCControllerType
_ZTR20TBaseInputSimulation
_ZTR20TDualShockController
_ZTR20TXMLGCControllerType
_ZTR21IXMLGCControllersType
_ZTR21TClassicControllerPro
_ZTR21TXMLGCControllersType
_ZTR25IXMLWiiUProControllerType
_ZTR25TXMLWiiUProControllerType
_ZTR26IFMXInputSimulationService
_ZTR26IXMLWiiUProControllersType
_ZTR26TXMLWiiUProControllersType
_ZTR30TGameControlAxisEmulatedButton
_ZTR5TVJoy
_ZTR6TForm1
_ZTR6TViGEm
_ZTR8IUnknown
_ZTR8TNunchuk
_ZTRN10Containers15TCircularBufferIN6System13UnicodeStringEEE
_ZTRN3Xml7Xmlintf18IXMLNodeCollectionE
_ZTRN3Xml7Xmlintf8IXMLNodeE
_ZTRN5Tools19TResourceDataStreamE
_ZTRN6System10IInterfaceE
_ZTRN6System20TCppInterfacedObjectI26IFMXInputSimulationService8IUnknownNS_10IInterfaceEEE
__CPPdebugHook
__setRaiseListFuncAddr

Sections

.text
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 301KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 592KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 548KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ffebfa5ad9ddfb8a97746dc60d39a79

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

version

winspool.drv

comctl32

comdlg32

gdi32

shell32

user32

winmm

imm32

ole32

oleaut32

d3d9

ws2_32

Exports

Exports

Sections

.text Size: 7.0MB - Virtual size: 7.0MB

.rodata Size: 4.3MB - Virtual size: 4.3MB

.data Size: 301KB - Virtual size: 585KB

.tls Size: 2KB - Virtual size: 2KB

.pdata Size: 592KB - Virtual size: 592KB

.xdata Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 512B - Virtual size: 40B

.idata Size: 17KB - Virtual size: 16KB

.didata Size: 37KB - Virtual size: 37KB

.edata Size: 3KB - Virtual size: 2KB

.rsrc Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 548KB - Virtual size: 547KB

.text
Size: 7.0MB - Virtual size: 7.0MB

.rodata
Size: 4.3MB - Virtual size: 4.3MB

.data
Size: 301KB - Virtual size: 585KB

.tls
Size: 2KB - Virtual size: 2KB

.pdata
Size: 592KB - Virtual size: 592KB

.xdata
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 512B - Virtual size: 40B

.idata
Size: 17KB - Virtual size: 16KB

.didata
Size: 37KB - Virtual size: 37KB

.edata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 548KB - Virtual size: 547KB