G:\Projects\uninstall-tool\Ready\x64\UTShellExt.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
4fc90290ee0c503c00448df7a3a84c1a88f07ba776dad08dfe43dd3e960d105c.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4fc90290ee0c503c00448df7a3a84c1a88f07ba776dad08dfe43dd3e960d105c.dll
Resource
win10v2004-20240226-en
General
-
Target
4fc90290ee0c503c00448df7a3a84c1a88f07ba776dad08dfe43dd3e960d105c
-
Size
12.4MB
-
MD5
827eca9ec457f3c5180f602832f44955
-
SHA1
f2cf3e8e45aef14e1dae48f71dd4a1661bf7d6e8
-
SHA256
4fc90290ee0c503c00448df7a3a84c1a88f07ba776dad08dfe43dd3e960d105c
-
SHA512
76d02dfd8a4f88488b85a89914b704b72314798f546beaf4605f577b9202abbf9b64121f70b540eefa71554ebc109499f71f112bb3f318a02bda36b966e883e6
-
SSDEEP
393216:wAOrOodVuw/7L8mCV9MPiojSJ4hToqTLe:wAOrRd4Lme9tJ4hje
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4fc90290ee0c503c00448df7a3a84c1a88f07ba776dad08dfe43dd3e960d105c
Files
-
4fc90290ee0c503c00448df7a3a84c1a88f07ba776dad08dfe43dd3e960d105c.dll regsvr32 windows:6 windows x64 arch:x64
83a30b7262b2b1a4fc5db727d872cc6a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
GetCurrentThreadId
CreateProcessW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
FormatMessageW
lstrlenW
GetUserDefaultUILanguage
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
WriteFile
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsW
EnterCriticalSection
FreeLibrary
OutputDebugStringA
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
GetStringTypeW
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
HeapSize
SetEndOfFile
WriteConsoleW
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
CloseHandle
OutputDebugStringW
DebugBreak
IsDebuggerPresent
LeaveCriticalSection
ReadFile
CreateFileW
GetCommandLineW
RtlUnwind
GetLastError
user32
GetSystemMetrics
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
PostMessageW
GetMessageW
InsertMenuW
GetMenuItemCount
GetIconInfo
SetRect
MessageBoxW
GetActiveWindow
DrawIconEx
LoadImageW
DestroyIcon
InsertMenuItemW
DefWindowProcW
CharLowerBuffW
uxtheme
BeginBufferedPaint
EndBufferedPaint
GetBufferedPaintBits
gdi32
SelectObject
GetDIBits
DeleteObject
CreateDIBSection
DeleteDC
CreateCompatibleDC
advapi32
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
shell32
ShellExecuteW
SHChangeNotify
DragQueryFileW
SHGetSpecialFolderPathW
ole32
ReleaseStgMedium
StringFromGUID2
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 267KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ