ram_ui[.]exe | Triage™

Resubmissions

20/06/2026, 16:24

260620-twp3eahs313

20/06/2026, 16:22

260620-tvq83sfy8p3

Sharing

Copy URL Twitter E-mail

General

Target
ram_ui.exe
Size 13.1MB
Sample260620-twp3eahs31
SHA256 119236bbf20a77c26ddb4b3e3b721ceb64644ae0ffce68a6b71ab73f04f2186a
MD5 73256a61010bbd125aae9e8ce36569a7
SHA1 ad3d8332dba71ed712f73eafa27420acf3d70974
SHA512 df6545364c403d3a6a33c61a45b10d7cbb10f7dbea3b5576409dd17c4f5d7ef7d20d38af696ac355d53323beb1d36a052521799dea32974a2f7d6f619c64363f
SSDEEP 98304:wn3I4WMF7U5GJqK8i9/q6z3kcDLa/HU+U9uEbrxWwI41sp:ynZLf/V3kcR/uVwI41s
TLSH
T18DD64A12BB8A99ACD05AC47083468A735A3170CB0B35B9FF45D856793F6AAF05F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ram_ui.exe

File Explorer

ram_ui.exe

.exe 13.1MB

ram_ui.exe

IMPHASH 8112f9656edf2e81dd0ebbe59aef4b47
SHA256 119236bbf20a77c26ddb4b3e3b721ceb64644ae0ffce68a6b71ab73f04f2186a
MD5 73256a61010bbd125aae9e8ce36569a7
SHA1 ad3d8332dba71ed712f73eafa27420acf3d70974
SHA512 df6545364c403d3a6a33c61a45b10d7cbb10f7dbea3b5576409dd17c4f5d7ef7d20d38af696ac355d53323beb1d36a052521799dea32974a2f7d6f619c64363f
SSDEEP 98304:wn3I4WMF7U5GJqK8i9/q6z3kcDLa/HU+U9uEbrxWwI41sp:ynZLf/V3kcR/uVwI41s
TLSH
T18DD64A12BB8A99ACD05AC47083468A735A3170CB0B35B9FF45D856793F6AAF05F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8340852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ram_ui.pdb

advapi32

GetLengthSid CopySid OpenProcessToken GetTokenInformation SystemFunction036 RegCloseKey CredDeleteW CredFree CredReadW CredWriteW RegGetValueW RegQueryValueExW RegOpenKeyExW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW IsValidSid EventRegister EventWriteTransfer EventUnregister RevertToSelf ImpersonateAnonymousToken EventSetInformation

ntdll

NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtWriteFile NtQuerySystemInformation RtlGetVersion NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtQueryInformationProcess

kernel32

GetModuleHandleA OpenProcess CreateMutexW CopyFileExW FindFirstFileExW GetCurrentProcessId GetSystemInfo VirtualQueryEx GetProcessTimes RtlCaptureContext LocalFree FindClose ExitProcess SwitchToThread GetExitCodeProcess GetSystemTimes GetProcessIoCounters WaitForSingleObjectEx CreateMutexA CreateEventW WaitForSingleObject ReleaseMutex ReadFileEx SetNamedPipeHandleState CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime DeleteFileW WriteConsoleW GetFileAttributesW GetConsoleOutputCP WaitForMultipleObjects FindNextFileW GetConsoleMode LoadLibraryA CreateFileW SetFileInformationByHandle RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime FreeLibrary LoadLibraryExW HeapFree GetProcessHeap GetModuleFileNameW OutputDebugStringW OutputDebugStringA lstrlenW MoveFileExW GetCommandLineW GetFullPathNameW GetProcAddress LoadLibraryW SleepEx WriteFileEx GetLastError LCIDToLocaleName GetUserDefaultUILanguage GetCurrentProcess DuplicateHandle FreeEnvironmentStringsW CompareStringOrdinal CancelIo GetFileInformationByHandle GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetWaitableTimer CreateWaitableTimerExW SetHandleInformation GetCurrentThread MultiByteToWideChar GlobalFree CreateDirectoryW WideCharToMultiByte GlobalSize GlobalUnlock FormatMessageW GetFinalPathNameByHandleW SetLastError GlobalAlloc SetUnhandledExceptionFilter GlobalLock GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW SetFileCompletionNotificationModes CreateProcessW HeapAlloc GetCurrentThreadId ReleaseSRWLockExclusive SetThreadErrorMode Sleep AcquireSRWLockExclusive WakeAllConditionVariable LoadLibraryExA TerminateProcess SleepConditionVariableSRW GetSystemTimeAsFileTime IsDebuggerPresent GetModuleHandleW IsProcessorFeaturePresent CloseHandle InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind GetEnvironmentVariableW ReadProcessMemory GetStdHandle GetEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

TranslateMessage DestroyCursor GetMessageW DestroyWindow RegisterTouchWindow PostMessageW RemovePropW CallWindowProcW GetSystemMetrics GetPropW DispatchMessageW CloseClipboard PeekMessageW PostThreadMessageW RedrawWindow RegisterClipboardFormatW DefWindowProcW IsWindow SetClipboardData ScreenToClient GetWindowLongW GetClientRect ClientToScreen GetCursorPos GetClipboardData OpenClipboard IsClipboardFormatAvailable MonitorFromWindow MonitorFromRect GetMonitorInfoW CreateWindowExW SystemParametersInfoW TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle EmptyClipboard SetCursor CreateIcon ToUnicodeEx AdjustWindowRectEx FlashWindowEx GetForegroundWindow GetRawInputData GetWindowThreadProcessId SetCursorPos GetKeyboardLayout ValidateRect MapVirtualKeyW GetClassInfoExW GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW SystemParametersInfoA EnumWindows SetWindowLongW EnableMenuItem GetSystemMenu SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow DestroyIcon EnumDisplayMonitors MonitorFromPoint GetMenu ShowCursor GetWindowLongPtrW ClipCursor GetClipCursor GetWindowRect IsWindowVisible GetActiveWindow SetWindowLongPtrW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetClassNameW IsProcessDPIAware GetDC IsIconic RegisterWindowMessageA SendMessageW GetWindow SetFocus ShowWindow FillRect GetUpdateRect ChangeDisplaySettingsExW CreateIconFromResourceEx MessageBoxW SetPropW EnumChildWindows DispatchMessageA GetMessageA RegisterClassExW ReleaseDC LoadCursorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement

gdi32

CreateRectRgn DeleteObject GetDeviceCaps SwapBuffers ChoosePixelFormat DescribePixelFormat SetPixelFormat CreateSolidBrush

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

ole32

RevokeDragDrop CoInitializeEx OleInitialize CoTaskMemFree CoUninitialize CoCreateInstance RegisterDragDrop CoCreateFreeThreadedMarshaler CoTaskMemAlloc

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass

shlwapi

SHCreateMemStream AssocQueryStringW

shell32

CommandLineToArgvW DragQueryFileW DragFinish SHCreateItemFromParsingName SHAppBarMessage

imm32

ImmReleaseContext ImmSetCompositionWindow ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW ImmGetContext

oleaut32

SafeArrayPutElement SafeArrayCreateVector SysFreeString SysAllocStringLen GetErrorInfo SetErrorInfo VariantClear SysStringLen

ws2_32

WSACleanup WSAStartup WSADuplicateSocketW freeaddrinfo shutdown WSAGetLastError listen bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv WSARecv closesocket select getaddrinfo accept getsockopt getsockname getpeername

secur32

ApplyControlToken DecryptMessage AcquireCredentialsHandleA FreeCredentialsHandle EncryptMessage AcceptSecurityContext QueryContextAttributesW DeleteSecurityContext FreeContextBuffer InitializeSecurityContextW

bcrypt

BCryptGenRandom

crypt32

CertDuplicateStore CertFreeCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenStore CertCloseStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertDuplicateCertificateContext

bcryptprimitives

ProcessPrng

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

opengl32

wglShareLists wglCreateContext wglGetProcAddress wglDeleteContext wglGetCurrentDC wglGetCurrentContext wglMakeCurrent

uiautomationcore

UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue

uxtheme

SetWindowTheme

vcruntime140

__current_exception_context __std_exception_copy __std_exception_destroy __current_exception __C_specific_handler _CxxThrowException _purecall wcsrchr memset memmove memcmp __CxxFrameHandler3 memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

cos fmodf ceilf expf round powf sinf pow sin cbrtf floor _hypotf log10 trunc floorf acosf __setusermatherr exp2f atan2f fmod cosf ceil roundf

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen wcscmp strlen

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _set_app_type _crt_atexit _seh_filter_exe _configure_narrow_argv strerror _register_onexit_function _get_initial_narrow_environment _initterm _initterm_e exit terminate _exit _register_thread_local_exe_atexit_callback _c_exit __p___argc __p___argv _cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale