Uninstall[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Uninstall.exe
Size

908KB
MD5

d79234914a4a193ccb9a571f2f1a040b
SHA1

be5fe12ec94a7d229bfc7ed765bd296903582991
SHA256

f8e57cb37efe55d571964a3d8f6b0331703b6041449986c5eb7156b966c5b3f5
SHA512

849304651d5e275883efd76f21b8a48e253256067812bc6c6b6b4f1cd09cc61e2670802b7838f8224240839a622fc1ace661180849b32c0d4ae6df618cb6b00f
SSDEEP

6144:4m/s/vJkys+S2j94gCjf7yxwk4NCu0x/kh1kK5zG5aDzbYRUKwizfI54oizH0p2U:4m/s/OysGfIeH0p+s1h//X/q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Uninstall.exe

Files

Uninstall.exe
.exe windows:4 windows x86 arch:x86

2fbd591001ffcc0807c623b3469448fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetVersionExA
GetWindowsDirectoryA
GetModuleFileNameA
HeapAlloc
HeapFree
LoadResource
LockResource
FindResourceA
GetEnvironmentVariableA
SetCurrentDirectoryA
SizeofResource
CopyFileA
lstrcatA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
GetCommandLineA
CreateProcessA
ExitProcess
DeleteFileA
MoveFileExA
RemoveDirectoryA
WritePrivateProfileStringA

user32

MessageBoxA
wsprintfA

advapi32

RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

comctl32

InitCommonControls

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 302B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 904KB - Virtual size: 903KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE