uTox_win64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

uTox_win64.exe
Size

7.4MB
MD5

170e3b4ce63340ac6fd3ed37d772808e
SHA1

59d0cfef58b9f6878e255fe5540d441bc4dfe65a
SHA256

8fc66ead26c935f19e1b51d1d2db8b7952f2ff71880cf136c6448cdca05b14e6
SHA512

cf650fe42e487ad91e68dada17690fa2f98e105e3b29be593fb2f09d813cf318aa21075307510c2bfd618986bf929e0ce16697cb4f8ed3e870d3e98500b32633
SSDEEP

98304:g31FQlTK8adc6gY5zXAQ62qQACCB0+KrbJ1WUTfY0MU1vwS8hCafiuK7KNgfrXD0:g3fc5gVofBvKe5CajB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
uTox_win64.exe

Files

uTox_win64.exe
.exe windows:4 windows x64 arch:x64

205d1bace25c745d001d4ac09674adce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegDeleteKeyValueW
RegOpenKeyW
RegSetKeyValueW
SystemFunction036

comdlg32

GetOpenFileNameA
GetSaveFileNameA

dnsapi

DnsQuery_A

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectA
CreateRectRgn
DeleteDC
DeleteObject
GetDIBits
GetObjectA
GetStockObject
GetTextExtentExPointW
GetTextExtentPoint32W
GetTextMetricsA
SelectClipRgn
SelectObject
SetBkMode
SetDCBrushColor
SetDIBitsToDevice
SetStretchBltMode
SetTextColor
StretchBlt
StretchDIBits
TextOutW

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler
CloseHandle
CopyFileA
CreateDirectoryW
CreateEventA
CreateFileW
CreateMutexA
CreateSemaphoreA
CreateThread
DebugBreak
DeleteCriticalSection
DeleteFileA
DuplicateHandle
EnterCriticalSection
ExitThread
FreeLibrary
GetCommandLineA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetUserDefaultUILanguage
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryW
LockFileEx
MoveFileA
MoveFileExA
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFileEx
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
__C_specific_handler
lstrlenW

msimg32

AlphaBlend

msvcrt

__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_aligned_free
_aligned_malloc
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commit
_endthreadex
_errno
_exit
_fdopen
_filelengthi64
_fileno
_fmode
_fpreset
_initterm
_localtime64
_lock
_lseeki64
_onexit
_open_osfhandle
_setjmp
_snwprintf
_strdup
_stricmp
_vsnwprintf
_strnicmp
_time64
_ultoa
_unlock
_vsnprintf
_wfopen
_wgetenv
_write
abort
atoi
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fopen
fprintf
fputc
fread
free
frexp
fseek
fsetpos
ftell
fwprintf
fwrite
getenv
isalnum
isspace
localeconv
log10
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
printf
puts
qsort
raise
rand
realloc
remove
signal
sinh
sprintf
srand
sscanf
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strstr
strtol
strtoul
tolower
vfprintf
wcscmp
wcscpy
wcslen
longjmp
_strdup
_getcwd
_close

ole32

CoCreateInstance
CoInitialize
CoLockObjectExternal
CoTaskMemFree
CoUninitialize
OleInitialize
PropVariantClear
RegisterDragDrop
ReleaseStgMedium
StringFromCLSID

oleaut32

VariantClear
VariantInit

shell32

DragQueryFileA
SHCreateDirectoryExA
SHGetFolderPathA
SHGetKnownFolderPath
SHGetSpecialFolderPathW
ShellExecuteA
Shell_NotifyIconA
Shell_NotifyIconW

user32

AdjustWindowRect
BeginPaint
ClientToScreen
CloseClipboard
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyMenu
DestroyWindow
DispatchMessageA
DrawTextW
EmptyClipboard
EndPaint
FillRect
FindWindowA
FlashWindow
FrameRect
GetAsyncKeyState
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetForegroundWindow
GetKeyState
GetMessageA
GetSystemMetrics
GetWindowRect
InsertMenuA
LoadCursorA
LoadIconA
MessageBoxA
MessageBoxW
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
PostThreadMessageA
RegisterClassW
ReleaseCapture
ReleaseDC
SendMessageA
SetCapture
SetClipboardData
SetCursor
SetForegroundWindow
SetLayeredWindowAttributes
SetWindowPos
ShowWindow
TrackMouseEvent
TrackPopupMenu
TranslateMessage

winmm

waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite

ws2_32

WSAAddressToStringA
WSAStartup
WSAStringToAddressA
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send
sendto
setsockopt
socket

Exports

Exports

alAuxiliaryEffectSlotf
alAuxiliaryEffectSlotfv
alAuxiliaryEffectSloti
alAuxiliaryEffectSlotiv
alBuffer3f
alBuffer3i
alBufferData
alBufferSamplesSOFT
alBufferSubDataSOFT
alBufferSubSamplesSOFT
alBufferf
alBufferfv
alBufferi
alBufferiv
alDeferUpdatesSOFT
alDeleteAuxiliaryEffectSlots
alDeleteBuffers
alDeleteEffects
alDeleteFilters
alDeleteFontsoundsSOFT
alDeletePresetsSOFT
alDeleteSoundfontsSOFT
alDeleteSources
alDisable
alDistanceModel
alDopplerFactor
alDopplerVelocity
alEffectf
alEffectfv
alEffecti
alEffectiv
alEnable
alFilterf
alFilterfv
alFilteri
alFilteriv
alFontsound2iSOFT
alFontsoundModulatoriSOFT
alFontsoundiSOFT
alFontsoundivSOFT
alGenAuxiliaryEffectSlots
alGenBuffers
alGenEffects
alGenFilters
alGenFontsoundsSOFT
alGenPresetsSOFT
alGenSoundfontsSOFT
alGenSources
alGetAuxiliaryEffectSlotf
alGetAuxiliaryEffectSlotfv
alGetAuxiliaryEffectSloti
alGetAuxiliaryEffectSlotiv
alGetBoolean
alGetBooleanv
alGetBuffer3f
alGetBuffer3i
alGetBufferSamplesSOFT
alGetBufferf
alGetBufferfv
alGetBufferi
alGetBufferiv
alGetDouble
alGetDoublev
alGetEffectf
alGetEffectfv
alGetEffecti
alGetEffectiv
alGetEnumValue
alGetError
alGetFilterf
alGetFilterfv
alGetFilteri
alGetFilteriv
alGetFloat
alGetFloatv
alGetFontsoundModulatorivSOFT
alGetFontsoundivSOFT
alGetInteger
alGetInteger64SOFT
alGetInteger64vSOFT
alGetIntegerv
alGetListener3f
alGetListener3i
alGetListenerf
alGetListenerfv
alGetListeneri
alGetListeneriv
alGetPresetivSOFT
alGetProcAddress
alGetSoundfontivSOFT
alGetSource3dSOFT
alGetSource3f
alGetSource3i
alGetSource3i64SOFT
alGetSourcedSOFT
alGetSourcedvSOFT
alGetSourcef
alGetSourcefv
alGetSourcei
alGetSourcei64SOFT
alGetSourcei64vSOFT
alGetSourceiv
alGetString
alIsAuxiliaryEffectSlot
alIsBuffer
alIsBufferFormatSupportedSOFT
alIsEffect
alIsEnabled
alIsExtensionPresent
alIsFilter
alIsFontsoundSOFT
alIsPresetSOFT
alIsSoundfontSOFT
alIsSource
alListener3f
alListener3i
alListenerf
alListenerfv
alListeneri
alListeneriv
alLoadSoundfontSOFT
alMidiEventSOFT
alMidiGainSOFT
alMidiPauseSOFT
alMidiPlaySOFT
alMidiResetSOFT
alMidiSoundfontSOFT
alMidiSoundfontvSOFT
alMidiStopSOFT
alMidiSysExSOFT
alPresetFontsoundsSOFT
alPresetiSOFT
alPresetivSOFT
alProcessUpdatesSOFT
alSoundfontPresetsSOFT
alSource3dSOFT
alSource3f
alSource3i
alSource3i64SOFT
alSourcePause
alSourcePausev
alSourcePlay
alSourcePlayv
alSourceQueueBuffers
alSourceRewind
alSourceRewindv
alSourceStop
alSourceStopv
alSourceUnqueueBuffers
alSourcedSOFT
alSourcedvSOFT
alSourcef
alSourcefv
alSourcei
alSourcei64SOFT
alSourcei64vSOFT
alSourceiv
alSpeedOfSound
alcCaptureCloseDevice
alcCaptureOpenDevice
alcCaptureSamples
alcCaptureSamplesLoopback
alcCaptureStart
alcCaptureStop
alcCloseDevice
alcCreateContext
alcDestroyContext
alcDevicePauseSOFT
alcDeviceResumeSOFT
alcGetContextsDevice
alcGetCurrentContext
alcGetEnumValue
alcGetError
alcGetInteger64vSOFT
alcGetIntegerv
alcGetProcAddress
alcGetString
alcGetThreadContext
alcIsExtensionPresent
alcIsRenderFormatSupportedSOFT
alcLoopbackOpenDeviceSOFT
alcMakeContextCurrent
alcOpenDevice
alcProcessContext
alcRenderSamplesSOFT
alcSetThreadContext
alcSuspendContext

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 402KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

205d1bace25c745d001d4ac09674adce

Headers

File Characteristics

Imports

advapi32

comdlg32

dnsapi

gdi32

iphlpapi

kernel32

msimg32

msvcrt

ole32

oleaut32

shell32

user32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.data Size: 34KB - Virtual size: 33KB

.rdata Size: 402KB - Virtual size: 401KB

.rodata Size: 5KB - Virtual size: 5KB

.pdata Size: 52KB - Virtual size: 52KB

.xdata Size: 59KB - Virtual size: 59KB

.bss Size: - Virtual size: 1.6MB

.edata Size: 5KB - Virtual size: 4KB

.idata Size: 13KB - Virtual size: 12KB

.CRT Size: 512B - Virtual size: 128B

.tls Size: 512B - Virtual size: 104B

.rsrc Size: 42KB - Virtual size: 42KB

.reloc Size: 5KB - Virtual size: 5KB

/4 Size: 13KB - Virtual size: 12KB

/19 Size: 1.4MB - Virtual size: 1.4MB

/31 Size: 106KB - Virtual size: 105KB

/45 Size: 184KB - Virtual size: 183KB

/57 Size: 58KB - Virtual size: 58KB

/70 Size: 13KB - Virtual size: 13KB

/81 Size: 1.4MB - Virtual size: 1.4MB

/92 Size: 138KB - Virtual size: 137KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 34KB - Virtual size: 33KB

.rdata
Size: 402KB - Virtual size: 401KB

.rodata
Size: 5KB - Virtual size: 5KB

.pdata
Size: 52KB - Virtual size: 52KB

.xdata
Size: 59KB - Virtual size: 59KB

.bss
Size: - Virtual size: 1.6MB

.edata
Size: 5KB - Virtual size: 4KB

.idata
Size: 13KB - Virtual size: 12KB

.CRT
Size: 512B - Virtual size: 128B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 42KB - Virtual size: 42KB

.reloc
Size: 5KB - Virtual size: 5KB

/4
Size: 13KB - Virtual size: 12KB

/19
Size: 1.4MB - Virtual size: 1.4MB

/31
Size: 106KB - Virtual size: 105KB

/45
Size: 184KB - Virtual size: 183KB

/57
Size: 58KB - Virtual size: 58KB

/70
Size: 13KB - Virtual size: 13KB

/81
Size: 1.4MB - Virtual size: 1.4MB

/92
Size: 138KB - Virtual size: 137KB