UZPt0hR[.]exe | Triage

Sharing

General

Target

UZPt0hR.exe
Size

1.2MB
MD5

bf6f64455cb1039947a3100e62f96a52
SHA1

28cdd5c2e82d4ad078420dcbf4b32b928861fcb6
SHA256

c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba
SHA512

c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b
SSDEEP

24576:dgnEunWewizz3Q/Nngwxx8T2d920PIGkbQjI/zC5rrpoJNlyZ4:+nEunFxz7Q/Nngp47AGkboF0l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UZPt0hR.exe

Files

UZPt0hR.exe
.exe windows:5 windows x86 arch:x86

55347c971789434361ebf2c1c21a714b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenMutexW

user32

wsprintfW

ole32

CoCreateInstance

oleaut32

VariantClear

Exports

Exports

GetModuleHandle64
GetProcAddress64
GetThreadContext64
ReadProcessMemory64
SetLastErrorFromX64Call
SetThreadContext64
VirtualAllocEx64
VirtualFreeEx64
VirtualProtectEx64
VirtualQueryEx64
WriteProcessMemory64
X64Call

Sections

.text
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

c0
Size: - Virtual size: 795KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

c1
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

c2
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ