Static task
static1
Behavioral task
behavioral1
Sample
uad-ng-windows.exe
Resource
win11-20231215-en
General
-
Target
uad-ng-windows.exe
-
Size
12.7MB
-
MD5
89c5ffb35db7d88abe856ab846f14d09
-
SHA1
fef32c2880eb8fdca553ec785c658ca30bbe5e87
-
SHA256
b1d0e0fe625ed2def9eef3e77b32af2b24cd836ac2d60fa9cf2974a5879159c3
-
SHA512
502f97777c7873ee953335baac8628e942966ebcc9094fa58863ecca05db52c1e3b5c6c4cdfe4a5a97ab071ff71e9c5a3ee20b951ae683278ee671d87a665348
-
SSDEEP
98304:9oNDrfRzYjv9X5TbsKaYowognN5f+P34tEarVvqnj1gUe+7GPcyPe7iZw38iWdba:cavqYowoAR+7EcyPWsMtj+f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource uad-ng-windows.exe
Files
-
uad-ng-windows.exe.exe windows:6 windows x64 arch:x64
f967479318cfc24bcbf5b6c0b94953e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GlobalFree
GlobalUnlock
lstrlenW
HeapAlloc
GetProcessHeap
SwitchToThread
FindClose
FindFirstFileW
GetSystemInfo
CreateFileMappingW
MapViewOfFile
DuplicateHandle
VirtualProtect
UnmapViewOfFile
CloseHandle
CreateMutexA
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
GetModuleHandleA
WakeConditionVariable
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
HeapSize
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
LCMapStringW
GetFullPathNameW
FindNextFileW
CreateDirectoryW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
SetHandleInformation
FlsAlloc
GetCurrentProcessId
GetFileType
GetCurrentThread
GetCPInfo
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
SetThreadStackGuarantee
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
GetACP
GetUserPreferredUILanguages
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RtlLookupFunctionEntry
ReleaseMutex
RaiseException
RtlPcToFileHeader
RtlUnwindEx
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
WaitForSingleObjectEx
ReleaseSRWLockExclusive
RtlCaptureContext
GetCurrentProcess
AcquireSRWLockExclusive
GetLastError
LoadLibraryExW
SetThreadErrorMode
HeapReAlloc
GetCurrentThreadId
SetStdHandle
GlobalAlloc
GetProcAddress
WideCharToMultiByte
GlobalSize
GlobalLock
RemoveVectoredExceptionHandler
GetStringTypeW
HeapFree
GetCommandLineW
AddVectoredExceptionHandler
MoveFileExW
DeleteFileW
CreateEventA
FreeLibrary
SetConsoleMode
shell32
DragQueryFileW
SHGetKnownFolderPath
DragFinish
ole32
CoUninitialize
CoInitializeEx
OleInitialize
CoCreateInstance
RevokeDragDrop
CoTaskMemFree
RegisterDragDrop
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
user32
InvalidateRgn
GetMessageW
DestroyIcon
CloseClipboard
RegisterTouchWindow
EmptyClipboard
SetClipboardData
CreateIcon
GetClipboardData
MsgWaitForMultipleObjectsEx
RegisterWindowMessageA
MonitorFromPoint
ChangeDisplaySettingsExW
RegisterRawInputDevices
OpenClipboard
ShowWindow
CreateWindowExW
EnableMenuItem
SetWindowLongW
GetWindowLongW
AdjustWindowRectEx
GetClipCursor
ClipCursor
ShowCursor
GetKeyboardLayout
GetKeyState
ToUnicodeEx
GetKeyboardState
GetSystemMetrics
ClientToScreen
GetWindowRect
IsProcessDPIAware
SetWindowPlacement
RegisterClassExW
IsWindowVisible
SystemParametersInfoA
ReleaseCapture
MapVirtualKeyW
SendInput
SetForegroundWindow
GetForegroundWindow
FlashWindowEx
IsIconic
TranslateMessage
SendMessageW
GetWindowLongPtrW
GetActiveWindow
RedrawWindow
DispatchMessageW
GetUpdateRect
PeekMessageW
PostMessageW
PostThreadMessageW
GetSystemMenu
GetClientRect
GetRawInputData
MapVirtualKeyA
SetWindowPos
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
CloseTouchInputHandle
MonitorFromRect
GetWindowPlacement
SetCursor
LoadCursorW
DefWindowProcW
SetCapture
DestroyWindow
GetMenu
GetTouchInputInfo
SetWindowLongPtrW
ScreenToClient
SetWindowDisplayAffinity
TrackMouseEvent
ValidateRect
SetWindowTextW
GetDC
ntdll
NtWriteFile
NtReadFile
RtlNtStatusToDosError
ws2_32
WSADuplicateSocketW
getsockname
getpeername
WSASend
WSARecv
recv
setsockopt
getsockopt
send
WSASocketW
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
getaddrinfo
connect
select
ioctlsocket
listen
bind
accept
closesocket
gdi32
GetDeviceCaps
DeleteObject
StretchDIBits
CreateRectRgn
imm32
ImmAssociateContextEx
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
dwmapi
DwmEnableBlurBehindWindow
winmm
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
d3dcompiler_47
D3DCompile
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
uxtheme
SetWindowTheme
Sections
.text Size: 8.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 292KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ