ie4uinit[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ie4uinit.exe
Size

711KB
MD5

2e5388450aa4c0a6bc043b6973d5098c
SHA1

b85697f483b3b3eb15c96f4c86f2d745554665ee
SHA256

2754ef94888284532acc0a61a508e6d17aefb41d75b97ec2c651e99a2c3a35d9
SHA512

312a578e41747c12cd1f0fe77d645552d7b31af00a73138efd233733a1aa0d5316da82ba17452990e30264f280543965acd48ec2124be75bc8aeda93db56ef76
SSDEEP

12288:4dK3VgNyowHwzpIpxfbOToMrEDL1FwhdFbjzlZXHFtlxJuZUQd3i/SmDtVvg8JAC:Iyo1FIptbO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ie4uinit.exe

Files

ie4uinit.exe
.exe windows:6 windows x64 arch:x64

6d023c6857267c189fff1d2f3e38f73d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ie4uinit.pdb

Imports

advapi32

RegCreateKeyExW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegGetValueW
CryptGenRandom
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
ConvertSidToStringSidW
EventWrite
GetNamedSecurityInfoW
SetNamedSecurityInfoW
AddMandatoryAce
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
IsValidSid
CopySid
GetTokenInformation
OpenProcessToken
GetSecurityDescriptorDacl
GetLengthSid
AddAce
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
InitializeAcl
SetKernelObjectSecurity
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
EqualSid
GetKernelObjectSecurity
AddAccessAllowedAceEx
GetSidSubAuthorityCount
DeleteAce
GetSidSubAuthority
GetSidIdentifierAuthority
ConvertStringSidToSidW
CryptVerifySignatureW
CryptDestroyKey
CryptDeriveKey
CryptSetKeyParam
CryptGetKeyParam
CryptEncrypt
CryptSetHashParam
CheckTokenMembership
OpenThreadToken

kernel32

OpenFileMappingW
GetCurrentThread
QueueUserWorkItem
QueryPerformanceFrequency
LCMapStringW
GetSystemTime
CreateFileMappingW
OpenMutexW
GetFileSizeEx
FlushFileBuffers
SetFileTime
ExpandEnvironmentStringsW
FlushViewOfFile
SystemTimeToFileTime
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
GetFullPathNameW
MultiByteToWideChar
ReleaseMutex
CreateMutexW
DeleteCriticalSection
GetSystemInfo
GetProductInfo
EnterCriticalSection
RaiseException
GetUserPreferredUILanguages
LeaveCriticalSection
InitializeCriticalSection
GetSystemDefaultLCID
GetUserDefaultLCID
GetSystemDefaultLangID
VirtualAlloc
GetFileAttributesW
OpenProcess
GetProcessHeap
HeapFree
HeapAlloc
LocalAlloc
WideCharToMultiByte
GetNativeSystemInfo
IsWow64Process
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
DuplicateHandle
GetStdHandle
GetTempPathW
GetExitCodeProcess
CompareStringOrdinal
WaitForSingleObject
GetTempFileNameW
SetFilePointer
SetFileAttributesW
DeleteFileW
CloseHandle
GetVersionExA
GetShortPathNameW
FindNextFileW
SetCurrentDirectoryW
LockResource
FindClose
GetCurrentDirectoryW
lstrcmpW
CreateFileW
ReadFile
SizeofResource
WriteFile
GetTickCount
FindFirstFileExW
CreateDirectoryW
GetCurrentProcess
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
SetPriorityClass
LocalFree
HeapSetInformation
GetProcAddress
GetLastError
GetModuleFileNameW
GetVersionExW
Sleep
LoadLibraryW
GetSystemDirectoryW
GetModuleHandleW
FreeLibrary
SetErrorMode
GetEnvironmentVariableW
GetUserDefaultLocaleName

user32

CharNextW
LoadStringW
PostMessageW
SendMessageTimeoutW
GetShellWindow

msvcrt

??3@YAXPEAX@Z
_vsnwprintf
_time64
??_U@YAPEAX_K@Z
_wcsnicmp
wcsrchr
??_V@YAXPEAX@Z
_wfopen_s
fgetws
swscanf_s
fclose
??2@YAPEAX_K@Z
_XcptFilter
_amsg_exit
memcmp
sprintf_s
_CxxThrowException
memcpy_s
wcschr
iswalpha
wcscat_s
rand_s
_purecall
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_wcmdln
_fmode
_commode
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
_ultow_s
_wtoi
isalnum
strnlen
wcsnlen
wcsncpy_s
_vsnwprintf_s
memset

shell32

CommandLineToArgvW
SHGetDesktopFolder
SHSetLocalizedName
ord190
SHChangeNotify
ord526
SHCreateItemFromParsingName
SHGetSpecialFolderLocation
SHGetKnownFolderPath
ord155
ord165
SHGetSpecialFolderPathW
SHGetFolderPathW

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

ieadvpack

RegRestoreAllW
ExecuteCabW

shlwapi

StrCmpIW
SHRegSetUSValueW
ord388
PathFileExistsW
SHDeleteKeyW
StrCmpNIW
PathRemoveExtensionW
PathFindFileNameW
SHDeleteValueW
PathRemoveBlanksW
StrCmpNIA
SHGetValueW
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
UrlCreateFromPathW
SHSetValueW
SHStrDupW
ord158
SHRegDeleteUSValueW
StrStrW
SHRegGetUSValueW
ord2
StrTrimW
SHCopyKeyW
ord487
StrCmpNA
StrCmpNW
UrlEscapeW
UrlUnescapeW
StrCmpW
ord433
ord219
StrStrIW
PathIsNetworkPathW

iertutil

ord660
ord675
ord678
ord672
ord655
ord677
ord651
ord657
ord650
ord665
ord652
ord656
ord653
ord662
ord654
ord701
ord151
ord682
ord91
ord74
ord81
ord90
ord76
ord85
ord79
ord134
ord558
ord282
ord281
ord559
ord791
ord398

oleaut32

VarBstrCmp
SysAllocStringByteLen
SysStringByteLen
VarBstrCat
SysAllocStringLen
SysStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
VariantCopy

ole32

CoInitializeEx
StringFromGUID2
CoCreateGuid
CoTaskMemFree
PropVariantClear
OleInitialize
OleUninitialize
CoCreateInstance
CoUninitialize

iedkcs32

BrandIEActiveSetup

crypt32

CryptStringToBinaryA
CryptBinaryToStringA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CryptStringToBinaryW
CertGetNameStringW
CertOpenStore
CertCreateCertificateContext
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CryptImportPublicKeyInfo
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptHashCertificate
CertEnumCertificatesInStore
CertGetCertificateContextProperty

urlmon

CoInternetCreateSecurityManager
CreateIUriBuilder
ord410
ord414
CreateUri

wininet

InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetConnectW
HttpOpenRequestW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetReadFile

netapi32

NetApiBufferFree
NetGetJoinInformation

version

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

mlang

ord123

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 511KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d023c6857267c189fff1d2f3e38f73d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shell32

ntdll

ieadvpack

shlwapi

iertutil

oleaut32

ole32

iedkcs32

crypt32

urlmon

wininet

netapi32

version

mlang

Sections

.text Size: 177KB - Virtual size: 177KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.idata Size: 12KB - Virtual size: 11KB

.rsrc Size: 511KB - Virtual size: 511KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 177KB - Virtual size: 177KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.idata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 511KB - Virtual size: 511KB

.reloc
Size: 1KB - Virtual size: 1KB