4a152e52c54d0e31457a8995b4376054d445f2a2d419ea62a45c698a16df43f6

Sharing

Copy URL Twitter E-mail

General

Target

4a152e52c54d0e31457a8995b4376054d445f2a2d419ea62a45c698a16df43f6
Size

3.7MB
MD5

3ed2a448d12404f37cbb8831c4ac7841
SHA1

c0b8508e9d21dea21c211c4f9171cda4cc7368be
SHA256

4a152e52c54d0e31457a8995b4376054d445f2a2d419ea62a45c698a16df43f6
SHA512

897ecf51198e8ae0a598104c929f3f2ee8cc4f12ed289db6b48e027ff6bd477959b6a4491dda2efdc96ed29b6f930406a9dbc53437c9168381782e16f9334065
SSDEEP

98304:RSK3OiWXlcKLOS+t1b+Fim2n+pHolVWYRFNfS:RSK+iWeKLXO+vNoT9fS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/24372000000189710382-uninstapfd.exe

Files

4a152e52c54d0e31457a8995b4376054d445f2a2d419ea62a45c698a16df43f6
.zip
24372000000189710382-uninstapfd.exe
.exe windows:5 windows x64 arch:x64

c34d051beb59e00464d955fdecf7b181

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DecodePointer
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
DeleteCriticalSection
MulDiv
LocalFree
LocalAlloc
GlobalFree
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
UnmapViewOfFile
MapViewOfFileEx
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
GetSystemDirectoryW
GetTickCount
ExitProcess
CreateFileMappingA
CreateProcessA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
GetProcessId
GetCurrentThreadId
SwitchToThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
CreateEventW
CreateEventA
WaitForSingleObjectEx
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
QueryPerformanceCounter
PeekNamedPipe
GetDriveTypeW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
SetLastError
GetLastError
RaiseException
AreFileApisANSI
GetFileInformationByHandle
GetACP
GetEnvironmentVariableW
GetFileType
GetStdHandle
FindNextFileW
GetSystemTime
FormatMessageA
GetSystemDirectoryA
lstrlenA
GetModuleHandleA
CreateFileA
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
GetFileAttributesW
FindFirstFileW
CreateFileW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTempFileNameW
SearchPathW
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
FindResourceExW
lstrcpyW
GetUserDefaultUILanguage
GetCurrentDirectoryW
GlobalFindAtomW
FreeResource
EncodePointer
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
GlobalDeleteAtom
SetThreadPriority
lstrcmpW
GlobalFlags
lstrcmpiW
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindClose
GlobalAddAtomW
SystemTimeToFileTime
FileTimeToSystemTime
GlobalGetAtomNameW
lstrcmpA
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
GetProcessHeap
HeapDestroy
OutputDebugStringA
CopyFileW
FormatMessageW
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource

user32

DestroyWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
GetSystemMetrics
GetDC
ReleaseDC
AdjustWindowRectEx
MapWindowPoints
GetWindowLongPtrW
SetWindowLongPtrW
GetUserObjectInformationW
GetProcessWindowStation
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
DestroyCursor
GetWindowRgn
GetWindowThreadProcessId
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
LoadImageW
IsClipboardFormatAvailable
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
GetDoubleClickTime
SetMenuDefaultItem
LockWindowUpdate
SetRect
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetComboBoxInfo
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
MonitorFromPoint
UnionRect
DrawIcon
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
IsZoomed
DrawFrameControl
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetParent
SetWindowRgn
SetClassLongPtrW
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
MessageBeep
DrawIconEx
IsRectEmpty
MonitorFromWindow
UpdateLayeredWindow
GetUpdateRect
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
GetMenuDefaultItem
CreatePopupMenu
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
UnhookWindowsHookEx
GetSysColor
GetSysColorBrush
LoadCursorW
EnableWindow
IsWindowEnabled
MessageBoxW
GetWindowLongW
GetParent
GetLastActivePopup
GetWindowTextW
GetWindowTextLengthW
DestroyIcon
CharUpperW
GetDlgCtrlID
GetFocus
SetWindowTextW
GetWindowRect
ClientToScreen
PtInRect
GetDesktopWindow
GetClassNameW
GetWindow
RealChildWindowFromPoint
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
SetFocus
SetScrollPos
GetScrollPos
IsWindow
ShowWindow
MoveWindow
SetWindowPos
GetDlgItem
CheckDlgButton
SetWindowLongW
IsDialogMessageW
IsIconic
SetForegroundWindow
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
RegisterWindowMessageW
GetMessagePos
GetMessageTime
CallWindowProcW
GetClassInfoW
GetClassInfoExW
IsMenu
IsChild
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetCapture
GetMenu
SetMenu
TrackPopupMenu
UpdateWindow
SetActiveWindow
GetForegroundWindow
BeginPaint
EndPaint
RedrawWindow
ScrollWindow
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
GetClientRect
ScreenToClient
CopyRect
EqualRect
GetClassLongPtrW
GetTopWindow
LoadIconW
SetScrollInfo
GetScrollInfo
WinHelpW
GetMonitorInfoW
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
FillRect
CopyImage
ShowOwnedPopups
SetCursor
DeleteMenu
KillTimer
InvalidateRect
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
DestroyMenu
GetMenuItemInfoW
InflateRect
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetAsyncKeyState
MapDialogRect
IntersectRect
TrackMouseEvent
GetIconInfo

gdi32

LineTo
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetTextCharsetInfo
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
GetTextFaceW
GetDeviceCaps
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
DeleteObject
CreateDCW
CopyMetaFileW
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
SetTextAlign
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
GetTextMetricsW
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CombineRgn
GetTextExtentPoint32W
CreateFontIndirectW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx

advapi32

CryptGetProvParam
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptGetUserKey
CryptSignHashW
CryptEnumProvidersW

shell32

SHGetDesktopFolder
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteW
SHGetFileInfoW
SHBrowseForFolderW

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
VariantCopy
VariantChangeType
VarBstrFromDate
SysAllocString
VariantInit
LoadTypeLi
SysFreeString
VariantClear

shlwapi

PathIsUNCW
PathFindFileNameW
PathStripToRootW
StrFormatKBSizeW
PathFindExtensionW
PathRemoveFileSpecW
StrChrA

ws2_32

freeaddrinfo
getaddrinfo
getservbyname
select
gethostbyname
gethostbyaddr
inet_ntoa
__WSAFDIsSet
inet_addr
getservbyport
WSASetLastError
ntohs
WSAGetLastError
closesocket
ioctlsocket
getpeername
getsockname
getsockopt
htonl
htons
send
setsockopt
shutdown
WSAIoctl
WSAStringToAddressA
bind
socket
WSAStartup
WSACleanup
connect
recv
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents

uxtheme

GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
DrawThemeText
GetThemePartSize
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
GetCurrentThemeName
DrawThemeParentBackground

msimg32

TransparentBlt
AlphaBlend

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

gdiplus

GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCloneImage
GdipCreateBitmapFromScan0
GdiplusStartup
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCreateFromHDC
GdipFree
GdiplusShutdown
GdipSetInterpolationMode
GdipDrawImageRectI

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW
timeGetTime
timeEndPeriod
timeGetDevCaps
timeBeginPeriod

msvcrt

strrchr
strchr
strstr
wcsstr
wcschr
_CxxThrowException
__CxxFrameHandler3
memset
__doserrno
_localtime64_s
wcspbrk
memmove
memcpy
memcmp
__C_specific_handler
wcsrchr
memchr
free
malloc
_difftime64
_mktime64
_wcsicmp
_wmakepath_s
_wsplitpath_s
_wcsupr_s
iswspace
wcscoll
iswalnum
iswalpha
iswdigit
iswprint
towupper
towlower
_wtol
abs
_time64
_wcsicoll
calloc
_resetstkoflw
sin
ceil
_localtime64
_wcslwr_s
cos
exp
sqrt
clock
toupper
_beginthread
_endthread
rand_s
_errno
wcscpy_s
wcsncpy_s
wcslen
wcsnlen
strlen
realloc
labs
ldiv
wcscspn
fclose
_clearfp
log10
_strtoui64
_wcstoui64
_isatty
___lc_codepage_func
_wfullpath
_getdrive
_wtoi
_expand
_msize
_beginthreadex
?terminate@@YAXXZ
_commode
?_set_new_mode@@YAHH@Z
_unlock
_lock
_ismbblead
__set_app_type
_XcptFilter
__getmainargs
_iob
_acmdln
wcscmp
feof
floor
wcscat_s
iswctype
wctomb_s
_mbtowc_l
wcstol
___mb_cur_max_func
__pctype_func
isdigit
tolower
signal
fputs
strtol
getenv
raise
fopen
_wfopen
isspace
strcspn
strspn
strncpy
_setmode
setvbuf
strerror_s
strtoul
strncpy_s
strcat_s
strcpy_s
strcmp
qsort
_gmtime64_s
atoi
fgets
strncmp
abort
strnlen
_set_fmode
_initterm_e
_initterm
atan2
ftell
fseek
fread
_fileno
fflush
ferror
wcsncmp
_amsg_exit

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

Exports

Exports

LZ4_attach_dictionary
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_partial_usingDict
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_initStream
LZ4_loadDict
LZ4_loadDictSlow
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
llhttp_errno_name
llhttp_execute
llhttp_finish
llhttp_get_errno
llhttp_get_error_pos
llhttp_get_error_reason
llhttp_get_http_major
llhttp_get_http_minor
llhttp_get_method
llhttp_get_status_code
llhttp_get_type
llhttp_get_upgrade
llhttp_init
llhttp_message_needs_eof
llhttp_method_name
llhttp_pause
llhttp_reset
llhttp_resume
llhttp_resume_after_upgrade
llhttp_set_error_reason
llhttp_set_lenient_chunked_length
llhttp_set_lenient_data_after_close
llhttp_set_lenient_headers
llhttp_set_lenient_keep_alive
llhttp_set_lenient_optional_cr_before_lf
llhttp_set_lenient_optional_crlf_after_chunk
llhttp_set_lenient_optional_lf_after_cr
llhttp_set_lenient_spaces_after_chunk_size
llhttp_set_lenient_transfer_encoding
llhttp_set_lenient_version
llhttp_settings_init
llhttp_should_keep_alive
llhttp_status_name

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textshe
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data
.gehcont
.pdata
.rdata
.reloc
.rsrc/MANIFEST/1
.xml
.text
.textshe

Sharing

General

Malware Config

Signatures

Files

c34d051beb59e00464d955fdecf7b181

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

uxtheme

msimg32

crypt32

oleacc

gdiplus

imm32

winmm

msvcrt

winspool.drv

Exports

Exports

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 53KB - Virtual size: 88KB

.pdata Size: 188KB - Virtual size: 188KB

.gehcont Size: 512B - Virtual size: 4B

.textshe Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 94KB - Virtual size: 94KB

.rsrc Size: 1KB - Virtual size: 4KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 53KB - Virtual size: 88KB

.pdata
Size: 188KB - Virtual size: 188KB

.gehcont
Size: 512B - Virtual size: 4B

.textshe
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 94KB - Virtual size: 94KB

.rsrc
Size: 1KB - Virtual size: 4KB