UniteFxUpdate[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
UniteFxUpdate.dll
Size 442KB
Sample260704-fqlk5sbs8v
SHA256 562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96
MD5 0ee743073ee6b68f8222be2661d95315
SHA1 2e642772ec19edf73422fe25a8d45db1a006ff85
SHA512 c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba
SSDEEP 6144:12UHPCFzuxTmVCp41NpA9+2pVbW+i6kdIkl7haKGrgEOHWeohg6yKJIGFEph:12NzSC1Na42ekuMs2eoqO+Dh
TLSH
T15DA45A5AB7A444B5E0A39138C9738A06E3B278491B71D79F13A4937E6F33B90493E731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
UniteFxUpdate.dll

File Explorer

UniteFxUpdate.dll

.dll 442KB

UniteFxUpdate.dll

IMPHASH a7365ab63ec74fb8102f92b17356cf77
SHA256 562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96
MD5 0ee743073ee6b68f8222be2661d95315
SHA1 2e642772ec19edf73422fe25a8d45db1a006ff85
SHA512 c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba
SSDEEP 6144:12UHPCFzuxTmVCp41NpA9+2pVbW+i6kdIkl7haKGrgEOHWeohg6yKJIGFEph:12NzSC1Na42ekuMs2eoqO+Dh
TLSH
T15DA45A5AB7A444B5E0A39138C9738A06E3B278491B71D79F13A4937E6F33B90493E731
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

0f:56:d6:c4:a3:f8:d9:41:0c:ed:2a:b6:5c:b6:7e:ff:a4:2d:3b:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Arthur Lepp,OU=IT,O=Arthur Lepp,POSTALCODE=50825,STREET=Iltisstr. 142,L=Köln,ST=NRW,C=DE,2.5.4.18=#13053530383235

Chains

Jun 12, 2019

CN=Arthur Lepp,OU=IT,O=Arthur Lepp,POSTALCODE=50825,STREET=Iltisstr. 142,L=Köln,ST=NRW,C=DE,2.5.4.18=#13053530383235

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=Arthur Lepp,OU=IT,O=Arthur Lepp,POSTALCODE=50825,STREET=Iltisstr. 142,L=Köln,ST=NRW,C=DE,2.5.4.18=#13053530383235

Serial Number

47:49:34:c0:ab:e3:c1:c9:81:d8:82:d3:44:50:13:52

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2017 - Oct 11, 2019

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

56080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\UniteFx\x64\Release\UniteFx.pdb

kernel32

EnterCriticalSection CloseHandle UnmapViewOfFile CreateEventExW FindNextFileW GetCurrentProcess CreateMutexW FindClose GetFileAttributesW ReleaseMutex OpenFileMappingW Sleep FormatMessageW GetLastError GetFileAttributesExW CreateFileMappingW MapViewOfFile CreateDirectoryW GetCurrentThreadId GetLocalTime MoveFileExW GetCurrentProcessId LocalFree TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread MultiByteToWideChar GetStringTypeW WideCharToMultiByte QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringW GetCPInfo RtlCaptureContext LeaveCriticalSection RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwindEx RtlPcToFileHeader RaiseException ExitThread GetModuleHandleExW ExitProcess GetStdHandle GetFileType ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleCP GetFileSizeEx SetFilePointerEx HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers SetStdHandle CreateFileW HeapSize SetEndOfFile WriteConsoleW InitializeCriticalSection DeleteCriticalSection HeapFree HeapAlloc GetProcessHeap ResetEvent SetEvent RtlLookupFunctionEntry WaitForSingleObject

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor RegNotifyChangeKeyValue RegCloseKey RegDeleteKeyExW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW

ole32

PropVariantClear CoCreateInstance CLSIDFromString StringFromGUID2 CoTaskMemAlloc

Name

.text

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

UniteFxUpdate.dll

kernel32

advapi32

ole32

generic