esetuninstaller[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

esetuninstaller.exe
Size

1.0MB
MD5

765bb11911c69c6fcccecd4e58e60b93
SHA1

64409e18525b29fdc9222033f2c169f0d14f6970
SHA256

00f43dd309c01900dd15183f19646f5706b92372d400462eeb35f7506c56657b
SHA512

df95224820b8227540f60a9539b7b1343a31bd769af3fb44af77f3acd6d372b52224bcb8064fd6920dc323564dd44ca97dc02bdcc9db0b38cae4a7f5afc2a0dd
SSDEEP

12288:bwrsGDpZYINBKq26+QLc8um0an4aFhbmNxmlqNM2p1icGYPh8nIRkf8Xg6xPC1z:mDzYI7uQLcpm5n4Akbml0icGXnWQ4C1z

Score

1^/10

Malware Config

Signatures

Files

esetuninstaller.exe
.exe windows:6 windows x86 arch:x86

9a47f1cc66ab9a6bd52b6276191c8e50

Code Sign

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10-06-2015 13:42

Not After

10-11-2030 14:12

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:f9:7d:05:4a:9b:fc:bf:9d:5e:12:f8:d0:ab:be:07
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

08-12-2020 14:34

Not After

08-12-2023 14:34

Subject

SERIALNUMBER=31 333 532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:42:00:ba:5e:23:b0:a1:f3:99:00:00:00:00:00:42
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-07-2015 20:55

Not After

07-07-2025 20:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fa:9c:19:a9:f4:39:a7:aa:c6:bf:8d:46:c8:f8:b4:cd:6a:ca:1e
Certificate

Issuer

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

13-07-2023 00:00

Not After

15-07-2026 00:00

Subject

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8
Certificate

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

17-07-2020 00:00

Not After

17-07-2030 00:00

Subject

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:1b:95:25:17:c8:de:e2:27:42:79:ec:df:05:5d:81:0b:2e:c3:fe
Certificate

Issuer

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

12-07-2023 00:00

Not After

16-07-2026 00:00

Subject

CN=ESET Timestamp,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38
Certificate

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

16-07-2020 00:00

Not After

16-07-2030 00:00

Subject

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:41

Not After

15-04-2021 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4f
Signer

Actual PE Digest

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4f

Digest Algorithm

sha256

PE Digest Matches

true

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4f
Signer

Actual PE Digest

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Uninstaller.pdb

Imports

kernel32

GetExitCodeThread
ExpandEnvironmentStringsW
SetEndOfFile
FlushFileBuffers
SetFileAttributesW
GetFileInformationByHandle
GetSystemInfo
GetLocaleInfoW
GetTimeZoneInformation
VerSetConditionMask
VerifyVersionInfoW
Sleep
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleOutputCP
ReadConsoleW
PeekConsoleInputA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SetConsoleMode
GetConsoleMode
GetFullPathNameW
CopyFileW
GetCurrentThread
GetCurrentThreadId
lstrcmpiW
LoadLibraryExW
RaiseException
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
MoveFileExW
FindFirstFileW
MoveFileW
DeleteFileW
lstrlenW
GetLogicalDrives
ReleaseMutex
CreateMutexW
SetConsoleCtrlHandler
ExitProcess
GetCurrentProcessId
SetFilePointer
WriteConsoleW
WriteFile
FormatMessageW
GetModuleFileNameW
GetModuleHandleW
WideCharToMultiByte
FindResourceExW
FindResourceW
SizeofResource
LockResource
LoadResource
GetCurrentProcess
LocalFree
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
FreeLibrary
LoadLibraryW
GetProcAddress
DeleteCriticalSection
GetExitCodeProcess
CreateProcessW
WaitForSingleObject
TerminateProcess
ReadFile
PeekNamedPipe
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetLastError
RemoveDirectoryW
FindClose
FindNextFileW
GetCurrentDirectoryW
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
GetStdHandle
VirtualQuery
VirtualProtect
VirtualAlloc
SystemTimeToTzSpecificLocalTime
GetFileAttributesExW
GetLocalTime
GetFileType
FindFirstFileExW
SetStdHandle
TlsFree
LCMapStringEx
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
OutputDebugStringW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue

user32

CharNextW
LoadStringW
ExitWindowsEx
GetSystemMetrics
MsgWaitForMultipleObjects

advapi32

RegLoadKeyW
OpenProcessToken
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
LsaRemoveAccountRights
LsaNtStatusToWinError
DeleteAce
EqualSid
GetAclInformation
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
SetServiceStatus
DeleteService
ControlService
QueryServiceStatus
StartServiceW
CreateServiceW
OpenSCManagerW
OpenThreadToken
SetSecurityDescriptorGroup
CopySid
IsValidSid
RegDeleteValueW
RegEnumValueW
RegUnLoadKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RevertToSelf
ImpersonateSelf
AddAccessAllowedAceEx
AddAce
GetAce
InitializeAcl
GetLengthSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetTokenInformation
AdjustTokenPrivileges

shell32

SHFileOperationW
ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CLSIDFromProgID

oleaut32

RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysStringLen
VariantClear
SysFreeString
SysAllocString

Sections

.text
Size: 775KB - Virtual size: 775KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a47f1cc66ab9a6bd52b6276191c8e50

Code Sign

87:82:52:60:00:00:00:00:51:d3:73:d9Certificate

Extended Key Usages

Key Usages

05:f9:7d:05:4a:9b:fc:bf:9d:5e:12:f8:d0:ab:be:07Certificate

Extended Key Usages

Key Usages

33:00:00:00:42:00:ba:5e:23:b0:a1:f3:99:00:00:00:00:00:42Certificate

Extended Key Usages

Key Usages

06:fa:9c:19:a9:f4:39:a7:aa:c6:bf:8d:46:c8:f8:b4:cd:6a:ca:1eCertificate

Extended Key Usages

Key Usages

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8Certificate

Extended Key Usages

Key Usages

01:1b:95:25:17:c8:de:e2:27:42:79:ec:df:05:5d:81:0b:2e:c3:feCertificate

Extended Key Usages

Key Usages

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4fSigner

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 775KB - Virtual size: 775KB

.rdata Size: 209KB - Virtual size: 208KB

.data Size: 11KB - Virtual size: 17KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 43KB - Virtual size: 43KB

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

05:f9:7d:05:4a:9b:fc:bf:9d:5e:12:f8:d0:ab:be:07
Certificate

33:00:00:00:42:00:ba:5e:23:b0:a1:f3:99:00:00:00:00:00:42
Certificate

06:fa:9c:19:a9:f4:39:a7:aa:c6:bf:8d:46:c8:f8:b4:cd:6a:ca:1e
Certificate

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8
Certificate

01:1b:95:25:17:c8:de:e2:27:42:79:ec:df:05:5d:81:0b:2e:c3:fe
Certificate

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4f
Signer

a1:b0:ef:97:0d:2e:60:b3:36:ea:17:b4:6a:bf:3d:59:d1:b9:8f:2c:47:c9:ea:77:56:81:6b:e0:a8:da:fe:4f
Signer

.text
Size: 775KB - Virtual size: 775KB

.rdata
Size: 209KB - Virtual size: 208KB

.data
Size: 11KB - Virtual size: 17KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 43KB - Virtual size: 43KB