06b9b869e899dd749c772ad42c99b1d612a9f25b3dc6b4f9d14bdf47b7c1fe2a

Sharing

Copy URL Twitter E-mail

General

Target
06b9b869e899dd749c772ad42c99b1d612a9f25b3dc6b4f9d14bdf47b7c1fe2a
Size 2.4MB
Sample260702-ymactaav4j
SHA256 06b9b869e899dd749c772ad42c99b1d612a9f25b3dc6b4f9d14bdf47b7c1fe2a
MD5 870074ff7ef22b7752dff51a6f5ba7f2
SHA1 78b5afc63f50a9f84392681e8ba35f90b16b9de8
SHA512 3a8f0b5cbcb286f2990679c39d6d1f8ea3c7a32a41d785f639dcdf18b0f99d076e04b74a8433d0fb48df3bfcdf35f7cc2114434bf7ef43d7ab9188630682831c
SSDEEP 49152:yAquOEXqD/dmNKII3nBOZyQXs+6scmzcs:Bqs8dmNVku58s
TLSH
T149B5BF02BE81C072E6930130C92DBBBA45B9F7246B3451DBA7D40A2D9E315D26B3776F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06b9b869e899dd749c772ad42c99b1d612a9f25b3dc6b4f9d14bdf47b7c1fe2a

File Explorer

06b9b869e899dd749c772ad42c99b1d612a9f25b3dc6b4f9d14bdf47b7c1fe2a

.exe 2.4MB

06b9b869e899dd749c772ad42c99b1d612a9f25b3dc6b4f9d14bdf47b7c1fe2a

IMPHASH 872c371fe3c3fbefb3a8825d96b2607f
SHA256 06b9b869e899dd749c772ad42c99b1d612a9f25b3dc6b4f9d14bdf47b7c1fe2a
MD5 870074ff7ef22b7752dff51a6f5ba7f2
SHA1 78b5afc63f50a9f84392681e8ba35f90b16b9de8
SHA512 3a8f0b5cbcb286f2990679c39d6d1f8ea3c7a32a41d785f639dcdf18b0f99d076e04b74a8433d0fb48df3bfcdf35f7cc2114434bf7ef43d7ab9188630682831c
SSDEEP 49152:yAquOEXqD/dmNKII3nBOZyQXs+6scmzcs:Bqs8dmNVku58s
TLSH
T149B5BF02BE81C072E6930130C92DBBBA45B9F7246B3451DBA7D40A2D9E315D26B3776F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1617251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Develop\2026\winToolBoxSetup\temp\Link\UIDownloader\Release\setup.pdb

ws2_32

gethostbyname gethostname ioctlsocket sendto recvfrom listen htonl setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup freeaddrinfo getaddrinfo WSASetLastError select __WSAFDIsSet getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError htons socket ntohs

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

secur32

InitSecurityInterfaceW

kernel32

QueryPerformanceFrequency GetFullPathNameW GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GlobalLock GlobalUnlock SystemTimeToFileTime GlobalAlloc GetLocalTime lstrcmpiW lstrcpyW FlushFileBuffers IsValidLocale GetModuleFileNameA SetFilePointerEx GetConsoleCP ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetFullPathNameA GetModuleHandleExW ExitThread QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetProcessAffinityMask ChangeTimerQueueTimer SetThreadPriority SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThread TryEnterCriticalSection InitializeCriticalSection GetFileAttributesExW GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeFormatW GetDateFormatW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject GetTempPathW SetFilePointer SetEndOfFile ReadFile MulDiv WriteFile GetThreadPriority GetFileSize FileTimeToLocalFileTime SetThreadAffinityMask LocalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer UnregisterWaitEx UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime SetFileTime InterlockedDecrement InterlockedIncrement FormatMessageW ExitProcess OpenMutexW DeleteCriticalSection GetEnvironmentVariableW GetModuleHandleA DeleteFileA IsBadWritePtr SetCurrentDirectoryW MoveFileExW MoveFileW OutputDebugStringA lstrcpynW OutputDebugStringW GetACP Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateDirectoryW CopyFileW GetFileAttributesW lstrlenW RemoveDirectoryW FindClose FindNextFileW DeleteFileW SetFileAttributesW GetShortPathNameW LockResource SizeofResource FreeResource LoadResource FindResourceW EnumSystemLocalesW GetUserDefaultLCID IsProcessorFeaturePresent GetThreadTimes CreateProcessW GetExitCodeThread GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateSemaphoreW WaitForMultipleObjects Sleep CreateEventW CreateMutexW WaitForSingleObjectEx SleepEx WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI GetFileInformationByHandle FindFirstFileW FindFirstFileA CreateFileW GetCurrentDirectoryW ExpandEnvironmentStringsW SetStdHandle WriteConsoleW FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap RtlUnwind

user32

EndPaint GetUpdateRect InvalidateRect GetCursorPos GetSysColor IntersectRect RegisterClassW DispatchMessageW PostQuitMessage PostMessageW OffsetRect IsRectEmpty PtInRect DefWindowProcW BeginPaint MapVirtualKeyExW GetKeyNameTextW GetKeyboardLayout GetGUIThreadInfo InvalidateRgn CreateAcceleratorTableW DrawTextA wsprintfA GetWindowTextLengthW GetWindowTextW SetWindowTextW EqualRect UpdateWindow ClientToScreen GetCaretPos SetCaretPos ShowCaret HideCaret GetCaretBlinkTime CreateCaret TrackPopupMenu AppendMenuW EnableMenuItem DestroyMenu CreatePopupMenu SetRect FillRect DrawTextW CharPrevW GetPropW SetPropW EnableWindow GetClassInfoExW InflateRect SetCursor LoadCursorW GetWindowRgn IsWindowEnabled MoveWindow RegisterClassExW SendMessageW GetMessageW TranslateMessage ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetFocus CallWindowProcW GetWindow GetParent CreateWindowExW DestroyWindow UpdateLayeredWindow SetTimer GetDC ReleaseDC GetWindowRect MapWindowPoints GetWindowLongW SetWindowLongW LoadImageW MonitorFromWindow GetMonitorInfoW CharNextW SetWindowPos wsprintfW GetDesktopWindow MessageBoxW IsIconic ScreenToClient GetClientRect SetWindowRgn ShowWindow GetWindowPlacement SetWindowPlacement KillTimer SetForegroundWindow CharUpperW CharPrevExA IsWindow IsWindowVisible UnionRect

gdi32

GetBitmapBits GetTextExtentPointA CreatePatternBrush GdiFlush TextOutW MoveToEx GetObjectA SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateDIBSection PtInRegion CreateRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader CreateEnhMetaFileW CloseEnhMetaFile SelectObject SaveDC RestoreDC Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetStockObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject CreateRoundRectRgn GetDeviceCaps SetBitmapBits

advapi32

CryptCreateHash RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptGetHashParam CryptImportKey CryptEncrypt CryptHashData CryptDestroyHash RegQueryInfoKeyW RegEnumKeyExW RegFlushKey

shell32

SHGetSpecialFolderLocation SHGetMalloc ShellExecuteW SHGetPathFromIDListW SHChangeNotify SHBrowseForFolderW DragQueryFileW SHCreateDirectoryExW SHFileOperationW SHGetSpecialFolderPathW

ole32

OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal CoTaskMemFree CoInitialize CoCreateInstance OleInitialize CLSIDFromString OleLockRunning CLSIDFromProgID DoDragDrop

oleaut32

VariantInit SysAllocStringLen VariantCopy VariantClear SysAllocString SysFreeString

shlwapi

SHGetValueW SHCreateStreamOnFileEx SHSetValueW PathFileExistsW PathRemoveBackslashW PathFileExistsA PathStripPathW PathIsDirectoryW PathAddBackslashW StrCmpIW PathAppendW PathFindExtensionW

iphlpapi

GetAdaptersInfo GetIfEntry

winhttp

WinHttpCrackUrl

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

gdiplus

GdipSetPenEndCap GdipSetPenStartCap GdipCreatePen2 GdipRotateWorldTransform GdipTranslateWorldTransform GdipDrawImageRectI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipSetStringFormatHotkeyPrefix GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectRect GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipCreateBitmapFromScan0 GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipReleaseDC GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetPenDashStyle GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipRotateMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix ord1 GdipAddPathLine GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdiplusShutdown GdipDrawLine GdipGetImageGraphicsContext GdipResetWorldTransform GdipDrawImageI GdiplusStartup

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

crypt32

CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CertFreeCertificateChainEngine CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain PFXImportCertStore

generic

count=27, id=241, version=40116,

count=191, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=132, id=261, version=26706,

count=40, id=260, version=26706,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=53, id=261, version=27054,

count=22, id=261, version=27051,

count=137, id=260, version=27051,

count=6, id=260, version=27054,

count=34, id=260, version=27048,

count=105, id=261, version=27048,

count=2, id=259, version=27048,

count=763, id=1, productName=Unmarked objects,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=261, version=34808,

count=17, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,