Shell UHT Toolbox 5[.]35e - Expires Feb-01-2025[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Shell UHT Toolbox 5.35e - Expires Feb-01-2025.exe
Size

9.9MB
MD5

73053b7e84746bf6d5fa37f926ea86fb
SHA1

5f95d190c0f534fb86cad3f1989d649e575443a0
SHA256

736fc3cc978fb4e53e729058df526e645b9c91d1a67a6685d0d5df84c81fdf8b
SHA512

0ff08f937fe7eb3237d79893d01ee0cc75e635d3030ccfbb26345c09106dfaee3d68d70936aa7f06a4c94d347f237d4579c2882653207f7da9799a6c7d3ee20a
SSDEEP

196608:85d6Rg9BIY/7UUQaeAdqJnSVoEO1uEMw+Wx8cybZOdWywDU/Esiffo9m7:85dXB/oUQaeAIQVoPujw+2dqs4am7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Shell UHT Toolbox 5.35e - Expires Feb-01-2025.exe

Files

Shell UHT Toolbox 5.35e - Expires Feb-01-2025.exe
.exe windows:6 windows x86 arch:x86

Password: thisismypasswordbro

87e6e27eea1d36b01bccbcec01075e1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\OtherComp\D\D1Ex\Projects\src\xls2exe\RtmStarter\Win32\Release\RtmStarter.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wsock32

htonl
recv
connect
htons
ioctlsocket
gethostbyname
select
ntohl
WSAStartup
send
socket

gdiplus

GdipLoadImageFromStream
GdipDrawImageRectI
GdipSetSmoothingMode
GdipCloneImage
GdipGetImageBounds
GdipDeleteGraphics
GdipSetCompositingQuality
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC

kernel32

GetUserDefaultLCID
IsValidLocale
lstrlenW
Sleep
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObject
MulDiv
DecodePointer
GetCommandLineW
GetLongPathNameW
GetModuleFileNameW
GetTempPathW
CreateMutexW
CreateEventW
GlobalFree
CloseHandle
CreateThread
GetProcAddress
LocalFree
GetCurrentProcessId
GetModuleHandleW
GlobalUnlock
SizeofResource
CreateFileW
GetFileAttributesW
LockResource
QueryPerformanceFrequency
LoadResource
FindResourceW
GetWindowsDirectoryW
FreeLibrary
QueryPerformanceCounter
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionEx
GlobalAlloc
GlobalLock
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetDateFormatW
GetVolumeInformationW
DeviceIoControl
GetVersionExW
LoadLibraryW
GlobalReAlloc
TlsGetValue
HeapSize
TlsAlloc
GetSystemDirectoryW
GetLocaleInfoW
LCMapStringW
CompareStringW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
GetStdHandle
ExitProcess
GetTimeZoneInformation
PeekNamedPipe
GetFileType
GetFileInformationByHandle
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RemoveDirectoryW
DeleteFileW
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
GetFileAttributesExW
GetCommandLineA
TlsSetValue
RtlUnwind
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetSystemTimeAsFileTime
LCMapStringEx
WakeAllConditionVariable
HeapReAlloc
ReadFile
ReadConsoleW
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
EnumSystemLocalesW
FreeEnvironmentStringsW
FlushFileBuffers
SetEndOfFile
WriteConsoleW
GetSystemTime
TlsFree
ReleaseSRWLockExclusive
GetStringTypeW
OutputDebugStringW
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer

user32

CreateWindowExW
EndDialog
GetWindowRect
SetWindowLongW
IsWindow
UpdateWindow
ScreenToClient
SetWindowTextW
SendMessageW
GetDC
GetClientRect
DefWindowProcW
MoveWindow
PeekMessageW
GetDialogBaseUnits
SetTimer
HideCaret
EndPaint
BeginPaint
GetDlgCtrlID
SetForegroundWindow
GetSystemMetrics
ClientToScreen
KillTimer
EnumWindows
GetClassNameW
GetWindowThreadProcessId
PostMessageW
GetActiveWindow
DestroyIcon
DialogBoxIndirectParamW
FindWindowW
PostThreadMessageW
DialogBoxParamW
CallWindowProcW
LoadCursorW
GetClassInfoExW
RegisterClassExW
RedrawWindow
ReleaseDC
GetWindowDC
FillRect
GetMessageW
MessageBoxW
GetWindowTextW
SetFocus
CreateDialogParamW
UnregisterClassW
DestroyWindow
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
SetWindowPos
DispatchMessageW
InvalidateRect
ShowWindow

gdi32

GetStockObject
SelectObject
CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
CreateFontW
GetTextExtentPoint32W
DeleteDC
DeleteObject
SetBkColor

comdlg32

GetSaveFileNameW

advapi32

RegCloseKey
IsTextUnicode
RegQueryValueExW
RegOpenKeyExW

shell32

DuplicateIcon
ExtractIconExW
ShellExecuteExW
SHGetFolderPathW

ole32

CLSIDFromString
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CLSIDFromProgID

oleaut32

VariantChangeType
SysFreeString
SysStringLen
CreateErrorInfo
SysStringByteLen
OleLoadPicture
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
VariantCopy

Sections

.text
Size: 334KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.5MB - Virtual size: 9.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: thisismypasswordbro

87e6e27eea1d36b01bccbcec01075e1d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

wsock32

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 334KB - Virtual size: 333KB

.rdata Size: 110KB - Virtual size: 109KB

.data Size: 20KB - Virtual size: 162KB

.rsrc Size: 9.5MB - Virtual size: 9.5MB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 334KB - Virtual size: 333KB

.rdata
Size: 110KB - Virtual size: 109KB

.data
Size: 20KB - Virtual size: 162KB

.rsrc
Size: 9.5MB - Virtual size: 9.5MB

.reloc
Size: 16KB - Virtual size: 16KB