UniKeyNT[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

UniKeyNT.exe
Size

14.7MB
MD5

8a5cbb692185aa1ca7369b11fa3c86d2
SHA1

3f04c850e3eebd93c5551e9fd2b5a8d303ba72b1
SHA256

e8733e9229e6b5a0f820e1d15b553c227bdb1e8e27e638d500c6ec8bec5874a7
SHA512

206461f28304c14861e1f20323095a135d2a82512ba839105bff8563c17702a610352e0e97c1a794e99b3e0de8179fd85c1d2ba5d0fddde7cf9ecf94c8c34674
SSDEEP

49152:w1uftanwYvRv/+/BBgfXELFZbvmXEHYOvkzfNiu17r86vs3HSR9KvP8k:4+/7gKcKvz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UniKeyNT.exe

Files

UniKeyNT.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BOT\BOT\Build Bot Export\Bot Trứ\Ver 2.0.2.8\Client_51.79.247.XX-Ver2.0.2.8\XDownload\obj\Debug\UniKeyNT.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14.6MB - Virtual size: 14.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ