855c12d8558e7a009516c0b609d8e63b16edc276830d79a70c69872bf66b1974[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

855c12d8558e7a009516c0b609d8e63b16edc276830d79a70c69872bf66b1974.exe
Size

12.3MB
MD5

1175e1164d21dc61f5d8813587cbdc5a
SHA1

46625b88715e74891ba496a3bf910ff7333982d0
SHA256

855c12d8558e7a009516c0b609d8e63b16edc276830d79a70c69872bf66b1974
SHA512

5ed20ded02ce0ab691741ea06784f8b64f5123843343b13f0e8ec490307ade75ea61c2406d90e8991e2e6095bd56269cbb6aab59b5d49914c3edbcd01a3c25f0
SSDEEP

196608:PYZUIe/+I+W2ToqTZ+eRiaP9XFSY+w4qE6jBdWVtv573gd/TzHt3gRGtB92CyKSa:PYu4hToqTzRtVDjnWzv573kFLPHr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
855c12d8558e7a009516c0b609d8e63b16edc276830d79a70c69872bf66b1974.exe

Files

855c12d8558e7a009516c0b609d8e63b16edc276830d79a70c69872bf66b1974.exe
.dll regsvr32 windows:6 windows x64 arch:x64

0fe102e3161cd5db9221235bd0aa370f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\Projects\uninstall-tool\Ready\x64\UTShellExt.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
GetCurrentThreadId
CreateProcessW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
FormatMessageW
lstrlenW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
WriteFile
LoadResource
LockResource
SizeofResource
FindResourceW
GetUserDefaultUILanguage
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsW
HeapFree
FreeLibrary
OutputDebugStringA
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
GetStringTypeW
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetStdHandle
GetFileType
ExitProcess
GetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
HeapSize
SetEndOfFile
HeapAlloc
SetLastError
CloseHandle
OutputDebugStringW
DebugBreak
IsDebuggerPresent
GetProcessHeap
ReadFile
CreateFileW
GetCommandLineW
WriteConsoleW
GetLastError
RtlUnwind

user32

GetSystemMetrics
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
CharLowerBuffW
SetRect
DrawIconEx
LoadImageW
DestroyIcon
GetMessageW
GetIconInfo
InsertMenuItemW
MessageBoxW
GetActiveWindow
InsertMenuW
GetMenuItemCount
PostMessageW

uxtheme

BeginBufferedPaint
GetBufferedPaintBits
EndBufferedPaint

gdi32

SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateDIBSection
CreateCompatibleDC

advapi32

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHChangeNotify
DragQueryFileW

ole32

StringFromGUID2
ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 335KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0fe102e3161cd5db9221235bd0aa370f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

uxtheme

gdi32

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 335KB - Virtual size: 335KB

.rdata Size: 109KB - Virtual size: 108KB

.data Size: 7KB - Virtual size: 12KB

.pdata Size: 18KB - Virtual size: 18KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 22KB - Virtual size: 21KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 335KB - Virtual size: 335KB

.rdata
Size: 109KB - Virtual size: 108KB

.data
Size: 7KB - Virtual size: 12KB

.pdata
Size: 18KB - Virtual size: 18KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 22KB - Virtual size: 21KB

.reloc
Size: 3KB - Virtual size: 2KB