Uoqxo6r[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Uoqxo6r.exe
Size

37.4MB
MD5

7f132b9180c067056013c4f1130037fb
SHA1

51655b86e5c8aed74c1c706ee5ccd299044647bf
SHA256

b324422b016eb8f3ff126a84e89935c6c1310df4da15ae3736a97390eb9198a2
SHA512

410595979d41f05303d5ca5badb43188ae868f859acf7482f1f89fc416c63dda0033019f0be85baad0642d0e9b83ef9abb464aee292100a09d6217140e2db007
SSDEEP

786432:yndisk3D/yUDc5lbUo5nVBAi+WfwTJEpCr4cVZ5a18FP2PsCn1GB:yndif3zyrn5VBbITJEkrJVZ572PD4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Uoqxo6r.exe

Files

Uoqxo6r.exe
.exe windows:6 windows x64 arch:x64

6c73423c2bb35ce6dd1e15bbd7733e84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSASendTo

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpGetIEProxyConfigForCurrentUser

crypt32

CryptEncodeObject

secur32

InitSecurityInterfaceW

bcrypt

BCryptEncrypt

ncrypt

NCryptExportKey

imm32

ImmGetVirtualKey

oleaut32

SafeArrayCreateVector

setupapi

SetupDiGetDeviceInterfaceDetailW

shlwapi

AssocQueryStringW

wtsapi32

WTSFreeMemory

comdlg32

GetOpenFileNameW

uxtheme

GetThemeInt

dwmapi

DwmEnableBlurBehindWindow

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3d12

ord102

gdi32

GetCharABCWidthsW

api-ms-win-core-synch-l1-2-0

WaitOnAddress

userenv

GetUserProfileDirectoryW

advapi32

QueryServiceConfigW

authz

AuthzInitializeResourceManager

kernel32

GetConsoleMode

netapi32

NetLocalGroupAddMembers

ole32

OleUninitialize

shell32

Shell_NotifyIconW

user32

EnumWindows

version

GetFileVersionInfoW

winmm

timeKillEvent

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ntdll

NtFreeVirtualMemory

dwrite

DWriteCreateFactory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

d3d9

Direct3DCreate9

wintrust

WinVerifyTrust

Exports

Exports

qt_qmlDebugClearBuffer
qt_qmlDebugConnectionBlocker
qt_qmlDebugConnectorOpen
qt_qmlDebugDisableService
qt_qmlDebugEnableService
qt_qmlDebugMessageAvailable
qt_qmlDebugMessageBuffer
qt_qmlDebugMessageLength
qt_qmlDebugObjectAvailable
qt_qmlDebugSendDataToService
qt_qmlDebugSetStreamVersion
qt_startup_hook

Sections

.text
Size: - Virtual size: 22.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 695B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 12.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 691KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: - Virtual size: 330KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eac0
Size: - Virtual size: 17.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eac1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eac2
Size: 37.4MB - Virtual size: 37.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c73423c2bb35ce6dd1e15bbd7733e84

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

winhttp

crypt32

secur32

bcrypt

ncrypt

imm32

oleaut32

setupapi

shlwapi

wtsapi32

comdlg32

uxtheme

dwmapi

d3d11

dxgi

d3d12

gdi32

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

kernel32

netapi32

ole32

shell32

user32

version

winmm

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

ntdll

dwrite

api-ms-win-shcore-scaling-l1-1-1

d3d9

wintrust

Exports

Exports

Sections

.text Size: - Virtual size: 22.6MB

INIT Size: - Virtual size: 695B

.rdata Size: - Virtual size: 12.1MB

.data Size: - Virtual size: 7.6MB

.pdata Size: - Virtual size: 691KB

.qtmimed Size: - Virtual size: 330KB

.eac0 Size: - Virtual size: 17.4MB

.eac1 Size: 1KB - Virtual size: 1KB

.eac2 Size: 37.4MB - Virtual size: 37.4MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 22.6MB

INIT
Size: - Virtual size: 695B

.rdata
Size: - Virtual size: 12.1MB

.data
Size: - Virtual size: 7.6MB

.pdata
Size: - Virtual size: 691KB

.qtmimed
Size: - Virtual size: 330KB

.eac0
Size: - Virtual size: 17.4MB

.eac1
Size: 1KB - Virtual size: 1KB

.eac2
Size: 37.4MB - Virtual size: 37.4MB

.rsrc
Size: 512B - Virtual size: 480B