UCAimColor[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UCAimColor.exe
Size 1.2MB
Sample260623-m1247scs8x
SHA256 972d22adfe83d65318a8c9f10e6fb5fd66987a1527f51a4a6470382e903630c9
MD5 ac261c6fccd3d6e9aeae311c6f584210
SHA1 67038236e52549b0d29edee3c6a976016dcda8b4
SHA512 7afbd18e588b3a11b39b69c3b33f3fb812125abc341b5a5251ac14e18c9ab26f11f51cce43cad2e4e64f7b9451ecfeb98e890076e1c467d7844adc3c7e8bcaed
SSDEEP 24576:x3G5np8VosnKxVdeNFGk078+wnuGKFgbT9LYnG:Ux85n22J0XnG
TLSH
T1DB45E056E35A52ADDB7A90789867A717EAF438041710ABC763DC0E442FE27D01BFE381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UCAimColor.exe

File Explorer

UCAimColor.exe

.exe 1.2MB

UCAimColor.exe

IMPHASH c4d69f3a4a28ef3869b8e949ba324312
SHA256 972d22adfe83d65318a8c9f10e6fb5fd66987a1527f51a4a6470382e903630c9
MD5 ac261c6fccd3d6e9aeae311c6f584210
SHA1 67038236e52549b0d29edee3c6a976016dcda8b4
SHA512 7afbd18e588b3a11b39b69c3b33f3fb812125abc341b5a5251ac14e18c9ab26f11f51cce43cad2e4e64f7b9451ecfeb98e890076e1c467d7844adc3c7e8bcaed
SSDEEP 24576:x3G5np8VosnKxVdeNFGk078+wnuGKFgbT9LYnG:Ux85n22J0XnG
TLSH
T1DB45E056E35A52ADDB7A90789867A717EAF438041710ABC763DC0E442FE27D01BFE381
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

350140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\gbfddfghd\Downloads\UCColor\x64\Release\UCAimColor.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GetConsoleWindow SetConsoleTitleW WritePrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStringA FormatMessageA GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetCurrentThreadId Sleep SleepConditionVariableSRW Beep ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW DeviceIoControl GetCurrentProcess QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar CloseHandle CreateFileA GetLastError GetModuleFileNameA GetLocaleInfoEx LocalFree CreateFileW GetModuleHandleW GetSystemTimeAsFileTime AcquireSRWLockExclusive InitializeSListHead FindClose FindFirstFileW

user32

GetForegroundWindow DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW DispatchMessageW PeekMessageW TranslateMessage LoadIconW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos ReleaseCapture GetClientRect SetCursor SetCapture PostQuitMessage LoadCursorW TrackMouseEvent IsChild ClientToScreen GetCapture ScreenToClient GetDC GetAsyncKeyState ShowWindow GetSystemMetrics UpdateWindow PtInRect

gdi32

DeleteObject BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC GetDIBits DeleteDC

advapi32

OpenServiceA OpenSCManagerW CloseServiceHandle CreateServiceA StartServiceW

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_counter _Xtime_get_ticks ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Query_perf_frequency ?_Random_device@std@@YAIXZ

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception __C_specific_handler memset memcpy memcmp memchr strstr __std_exception_copy __std_terminate memmove __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

abort _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm _get_initial_narrow_environment _initterm_e _set_app_type _seh_filter_exe _cexit terminate _beginthreadex _crt_atexit exit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf fseek __acrt_iob_func __p__commode ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite __stdio_common_vsscanf _wfopen fgetc fclose fflush __stdio_common_vsprintf_s fputc

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-string-l1-1-0

strncpy strcmp strcpy_s

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

cosf sinf modf sqrt __setusermatherr pow ceilf floorf acosf fmodf sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func