UKVMer.zip
- SHA256 a50581cd1845d7072037b1f42e30139b6a48cdb0b28edd3368d3bb31a31007bc
Behavioral task
behavioral1
Sample
Ars8oOPq.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ars8oOPq.exe
Resource
win11-20250610-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
UKVMer.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
UKVMer.exe
Resource
win11-20250619-en
windows11-21h2-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
XPSPLOG.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
XPSPLOG.dll
Resource
win11-20250619-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target UKVMer.zip
- Size 9.9MB
- Sample250926-e9d5qsdp8x
- SHA256 a50581cd1845d7072037b1f42e30139b6a48cdb0b28edd3368d3bb31a31007bc
- MD5 8ab30d737717734f09bbddd8ad8067c1
- SHA1 fd81a802a1d0c9405e4d3baf149aba9174e09ff0
- SHA512 fc8a937f4d9ada8bae0404cfdd7761fc13520fcf704d407069fce8be7eea344cd0f02657c2b313a0066683c7422a8baf4aa73bef2e4f1ff7a6e6d7d7840a63a4
- SSDEEP 196608:n8VJvPpgAnO6Tlx8PQGlmfXrD2SeuY8JfUnLe+zR7nOhXLdC4WpXZ:nkJJlz3GUfrqLu9JfULJR7nOh7bWpJ
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Ars8oOPq.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ars8oOPq.exe unpack001/UKVMer.exe unpack001/XPSPLOG.dll
File Explorer
-
UKVMer.zip.zip 9.9MB
-
Ars8oOPq.exe.exe 655KB
-
UKVMer.exe.exe 145KB
-
XPSPLOG.dll.dll 4.6MB
-
image.png.png 4.7MB
Ars8oOPq.exe
- SHA256 d983967db817b40b1303f88abde969ebd3d3914c34607c7715992b7aae86d74d
- MD5 fc7198604edbcd1e85037e2fc580ad73
- SHA1 651b1655bfffdcf4002daa00d1f110853e66cc44
- SHA512 17c1df42f5366ec99d4661cd1a44b97ba26513573cac4d9118f8b667e7e1925c03bd0769158c89252f57c75924f5828fb73e2a1cec5faeee595b0f189f2abbb5
- SSDEEP 12288:SKg71yAoHNWR8bTH7MrcuWE/wove/j24yu/ATnZuPESLnV+pFe:1HNJDMor12mquPZjqc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4332944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
653KB
Virtual Size
656KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=12, id=259, version=27412,
count=199, id=261, version=27412,
count=4, id=253, version=28518,
count=18, id=260, version=30034,
count=10, id=259, version=30034,
count=93, id=261, version=30034,
count=24, id=260, version=27412,
count=21, id=257, version=27412,
count=329, id=1, productName=Unmarked objects,
count=48, id=260, version=30148,
count=144, id=265, version=30148,
count=3, id=259, version=30148,
count=1, id=255, version=30148,
count=1, id=258, version=30148,
UKVMer.exe
- IMPHASH 4d2c68e49d83f9b0f6795d686e08c98f
- SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
- MD5 5251b98614acffe5c856f4039ca03da3
- SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
- SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
- SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6090
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
F:\4.7.471.07\Sources\_bin\32\Release\PhilipsSpeechDriverConfiguration.pdb
xpsplog
ord8
ord4
ord7
ord6
ord3
ord2
kernel32
SetFilePointerEx
GetProcAddress
GetCurrentProcess
CreateFileW
CloseHandle
WriteConsoleW
GetModuleHandleW
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
DecodePointer
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
advapi32
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=142, id=261, version=30795,
count=20, id=260, version=30795,
count=38, id=261, version=33218,
count=18, id=260, version=33218,
count=20, id=259, version=33218,
count=4, id=257, version=30795,
count=3, id=257, version=33523,
count=92, id=1, productName=Unmarked objects,
count=2, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=151,
count=1, id=258, version=33523,
XPSPLOG.dll
- IMPHASH b4ca6f0ad0fe5ce382aa3bee0f2fba93
- SHA256 8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e
- MD5 809a3665d1d1b88f42c2f7d14e874a6d
- SHA1 522a15bda8399112017c59bce4bdfb0bbe464529
- SHA512 f9cb0f175de3180cff6339bfad8397d683f55b64edd418d97a1406dfdc0ee1e04246614fc8014dafb54d86fcecab0ee1b1d7a57df85449efd426687346dc9552
- SSDEEP 98304:rAy6vQvedEhfukYe5p1IUDet73oEvws1nweUJ:UvBcb5p1IHtr1nwbJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6762024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
XPSPLOG_1
XPSPLOG_2
XPSPLOG_3
XPSPLOG_4
XPSPLOG_5
XPSPLOG_6
XPSPLOG_7
XPSPLOG_8
Name
.text
Size
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.DC\
Size
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.C8A
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.XDa
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
image.png
- SHA256 1ae60e9704a06ac42097fd6a0bca6aa08797181409d8a27ab4f917256cae7e69
- MD5 a780e0f0124284b41703383c4aa1f6a5
- SHA1 c4e18ece9880cd696a7a65f495b542f295bd7b8d
- SHA512 8812e8746f2c28d07212700ac5952d567ff93dbefe8a28e5ce4340259b3e181a8b690c9cf897682da54f4fb42a71c553c237925d274fa5f841f3d7eef1e988ce
- SSDEEP 98304:iy0NXKHqCHQ6R3d84iGZVRgGNoX/U0QTLhpfdZRI+lC1XZgm20retRg5SwF3Q8:iXaHqCHQ6R3d8VioX8pfdHWiCS2A8
- MD5 SHA1 SHA512 SSDEEP