e0544e28ba3d163444e727bbc9fb4b717a2f0caf1f8c8097294a983d4b2977a2

Sharing

Copy URL

Twitter E-mail

General

Target

e0544e28ba3d163444e727bbc9fb4b717a2f0caf1f8c8097294a983d4b2977a2
Size

2.7MB
MD5

1f8e7c6b36e845056b180e0aee9e5d46
SHA1

abe89e7d5bfdfeda03b358f26d76e36159aed4dd
SHA256

e0544e28ba3d163444e727bbc9fb4b717a2f0caf1f8c8097294a983d4b2977a2
SHA512

62e7887153ca5d1b1f3c440bd670a50e1b7b238bd17cd20661048993dd843e5962d8a770ab3bce943a2b7bb6b0120339329826e042356a9786b23b621a3cf6d7
SSDEEP

49152:F6n7a1dvXnE7J9XZ1gmwxWEOKnJOEMdcDTv4sjhZqlLut7a/HPZhoG:F67kdE7J7FwxbnJOEM2DT9jWQt7aHPZT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1020412420uninstall.exe

Files

e0544e28ba3d163444e727bbc9fb4b717a2f0caf1f8c8097294a983d4b2977a2
.zip .ps1 polyglot
1020412420uninstall.exe
.exe windows:5 windows x64 arch:x64

a2a9372e640f2383f86050edda415f69

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetTickCount64
GetSystemDirectoryW
VirtualAlloc
VirtualProtect
VirtualQuery
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
GetModuleFileNameA
VirtualFree
ExitProcess
CreateProcessA
SwitchToThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
AcquireSRWLockShared
AcquireSRWLockExclusive
GetDriveTypeW
ReleaseSRWLockShared
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
ReadConsoleW
ReadConsoleA
ReleaseSRWLockExclusive
HeapFree
HeapReAlloc
HeapAlloc
QueryPerformanceCounter
SetLastError
SetConsoleMode
GetConsoleMode
GetACP
GetEnvironmentVariableW
WriteFile
GetFileType
GetStdHandle
FindNextFileW
FindClose
SystemTimeToFileTime
GetSystemTime
FormatMessageA
GetSystemDirectoryA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionEx
CreateFileMappingA
lstrlenA
GetModuleHandleA
MapViewOfFileEx
PeekNamedPipe
GetFileSize
CreateFileA
WideCharToMultiByte
CreateEventA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
GetProcessHeap
HeapSize
HeapDestroy
GetLastError
CreateFileW
WaitForSingleObjectEx
AreFileApisANSI
GetFileInformationByHandle
GetFileAttributesW
FindFirstFileW
GetModuleHandleExW

user32

DefWindowProcW
PostQuitMessage
CreateWindowExW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
LoadCursorW
LoadIconW
MoveWindow
RegisterClassExW
DispatchMessageA

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

CryptSignHashW
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptEnumProvidersW
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CryptDestroyHash
ReportEventW
DeregisterEventSource
RegisterEventSourceW

bcrypt

BCryptGenRandom

ws2_32

getaddrinfo
freeaddrinfo
inet_ntop
bind
socket
WSAStartup
WSACleanup
getservbyname
getservbyport
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
recv
connect
WSAStringToAddressA
ntohs
WSAGetLastError
__WSAFDIsSet
closesocket
ioctlsocket
getpeername
getsockname
getsockopt
htonl
htons
select
send
setsockopt
shutdown
WSASetLastError
WSAIoctl

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

shlwapi

StrChrA

winmm

timeGetDevCaps
timeEndPeriod
timeGetTime
timeBeginPeriod

msvcrt

?terminate@@YAXXZ
mbtowc
_isatty
_strtoui64
_sys_errlist
_sys_nerr
ceil
log10
_clearfp
__set_app_type
_XcptFilter
_msize
__wgetmainargs
___lc_codepage_func
_wfullpath
_wcsicmp
wcspbrk
__doserrno
_getdrive
_iob
_unlock
_lock
_gmtime64
?_set_new_mode@@YAHH@Z
wcstol
_commode
___lc_handle_func
_fmode
___mb_cur_max_func
__pctype_func
_callnewh
_initterm
isdigit
tolower
signal
fputs
strtol
getenv
raise
fopen
_wfopen
isspace
strcspn
strspn
strncpy
_setmode
setvbuf
ftell
fseek
fread
_fileno
fflush
ferror
strtoul
strcmp
qsort
wcsrchr
atoi
fgets
feof
fclose
strncmp
abort
_beginthreadex
realloc
_errno
calloc
_localtime64
_time64
_mktime64
malloc
free
__CxxFrameHandler
wcsstr
memchr
strrchr
strchr
strstr
_CxxThrowException
memset
memmove
memcpy
memcmp
__C_specific_handler
_wcmdln
_amsg_exit

Exports

Exports

LZ4_attach_dictionary
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_partial_usingDict
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_initStream
LZ4_loadDict
LZ4_loadDictSlow
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
llhttp_errno_name
llhttp_execute
llhttp_finish
llhttp_get_errno
llhttp_get_error_pos
llhttp_get_error_reason
llhttp_get_http_major
llhttp_get_http_minor
llhttp_get_method
llhttp_get_status_code
llhttp_get_type
llhttp_get_upgrade
llhttp_init
llhttp_message_needs_eof
llhttp_method_name
llhttp_pause
llhttp_reset
llhttp_resume
llhttp_resume_after_upgrade
llhttp_set_error_reason
llhttp_set_lenient_chunked_length
llhttp_set_lenient_data_after_close
llhttp_set_lenient_headers
llhttp_set_lenient_keep_alive
llhttp_set_lenient_optional_cr_before_lf
llhttp_set_lenient_optional_crlf_after_chunk
llhttp_set_lenient_optional_lf_after_cr
llhttp_set_lenient_spaces_after_chunk_size
llhttp_set_lenient_transfer_encoding
llhttp_set_lenient_version
llhttp_settings_init
llhttp_should_keep_alive
llhttp_status_name

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textshe
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2a9372e640f2383f86050edda415f69

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comdlg32

advapi32

bcrypt

ws2_32

crypt32

shlwapi

winmm

msvcrt

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 30KB - Virtual size: 39KB

.pdata Size: 114KB - Virtual size: 114KB

.gehcont Size: 512B - Virtual size: 4B

.textshe Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 39KB - Virtual size: 39KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 30KB - Virtual size: 39KB

.pdata
Size: 114KB - Virtual size: 114KB

.gehcont
Size: 512B - Virtual size: 4B

.textshe
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 39KB - Virtual size: 39KB