uuprog_13014r2.zip
- SHA256 b1abab4bbc3ca36704f44ffdaf3859d7d510f7fdbda243c4e21cc62d50902311
Behavioral task
behavioral1
Sample
uuprog_13014r2.zip
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
900 seconds
General
- Target uuprog_13014r2.zip
- Size 23.1MB
- Sample260705-hxdj8aev9j
- SHA256 b1abab4bbc3ca36704f44ffdaf3859d7d510f7fdbda243c4e21cc62d50902311
- MD5 87cf58d52221b2a33dd01a7408b95db9
- SHA1 467c0c1bee8b4242555f976252c43b17bfb0dcfc
- SHA512 7511186a496e170651557dd0a26309fb48919518fd3390abe074c1e444ec2f6b6500d8755854625efbb1f6b4bd875c2375bf94b81543cd085d9b90f2cec38c37
- SSDEEP 393216:NJ9QBr8Ejlo9Q+r8Ejq9QFaxdpDNXc/xuFGbY4Od7PwMknG67Z+HMRxkizGEMIj:T9WrW9Jrq9rngJuH4OWMGG6V+K7zhj
- TLSH T16F3733A3A3F60278E4F27F389A7551186E36BC66A9F5E60E1C35D88C5D72E40CC71362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/uuprog_13014r2/setup.exe unpack001/uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.dll - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/uuprog_13014r2/setup.exe innosetup
File Explorer
-
uuprog_13014r2.zip.zip 23.1MB
-
uuprog_13014r2/readme.txt2KB
-
uuprog_13014r2/setup.exe.exe 19.3MB
-
uuprog_13014r2/破解 复制到C盘的安装目录下/ATT00003.txt25B
-
uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.dll.exe 3.7MB
-
uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.exe.exe 28KB
-
uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.lic110B
uuprog_13014r2/readme.txt
- SHA256 f97dba1a4db2aba3299bf92148c0d3c458e9fe4a31b8efc0893ab36b536d8575
- MD5 909b812c7ce5f9c4efe5f2887c27ef53
- SHA1 dbeb8ee1480310afdd7e8bb137a67f2c398c4b8e
- SHA512 367727eb9709c80dc8c58ada01085bc6fd102be53e0094b300f1fd48a63c431fdb9b19c2a4b2c4ba9d5e2e7d34b52583548d31d628e7fa48dda10dc888e5c906
- TLSH T16241954892A0F6352473035F250BA963FF56A1D9D1F49491799E811CF2C3EAE433BC86
- MD5 SHA1 SHA512 TLSH
uuprog_13014r2/setup.exe
- IMPHASH 48aa5c8931746a9655524f67b25a47ef
- SHA256 331acc2815a910d042e7ff31979859ce65cd2713bb7059d8c96e95d3e8519554
- MD5 bf8dcfc778a317730003c122845e5d32
- SHA1 bfe7fc8727683bbd103945e8b538333c9614f973
- SHA512 a126c3a8c4bbc1730544796941e79eb4472fb5439ba971be8d91012f09fb5924ca2e41cd44dc27396802fc9d1b87127c9b0e29449d2a6277520b1a81f392811b
- SSDEEP 393216:BJ9QBr8Ejlo9Q+r8Ejq9QFaxdpDNXc/xuFGbY4Od7PwMknG67Z+H0:39WrW9Jrq9rngJuH4OWMGG6V+0
- TLSH T1631733FBF19303F8C8A96F3CC125A5083D09899B95EB7A4E1D39ED8C5E75D46C872281
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
PE Signature issue
Digest
82:aa:68:38:dd:eb:d4:55:8e:af:10:50:7c:6a:9b:cb:3a:77:db:0a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ELRASOFT EOOD,O=ELRASOFT EOOD,L=LOVECH,ST=LOVECH,C=BG,1.2.840.113549.1.9.1=#0c14737570706f727440656c7261736f66742e636f6d
Chains
May 6, 2013
CN=ELRASOFT EOOD,O=ELRASOFT EOOD,L=LOVECH,ST=LOVECH,C=BG,1.2.840.113549.1.9.1=#0c14737570706f727440656c7261736f66742e636f6d
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=ELRASOFT EOOD,O=ELRASOFT EOOD,L=LOVECH,ST=LOVECH,C=BG,1.2.840.113549.1.9.1=#0c14737570706f727440656c7261736f66742e636f6d
Serial Number
11:21:0f:74:89:b5:28:93:08:88:1e:03:c2:eb:ff:0b:d7:10
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 5, 2013 - May 19, 2014
Minor OS version
0
Major OS version
5
Entry point
62396
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
uuprog_13014r2/破解 复制到C盘的安装目录下/ATT00003.txt
- SHA256 6845799a95619e241ab988b4f707f52ffbb782e53957504810828550015e8235
- MD5 73935019819bebfb39966013f83225a8
- SHA1 255c02e74578b9042c79ad81e9c7f490223c9ad7
- SHA512 de667558baf28ae5519c8abe11f1408831a2fec1c2ba1a71daee321a5396848c16d8cfab266712bad4b5b3c92fe7dbd7a0b2dd39be631a1ac9cf571a52880b79
- MD5 SHA1 SHA512
uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.dll
- SHA256 0c3107c7b6074ae679ead57e17ee399b25ab94f4483f7cbd776c5393738a7b69
- MD5 c29f18a0336440fbe529f7ee3f9d6ea1
- SHA1 39cc2a96d28bc90066b8e752f6207ba6360b33a3
- SHA512 937570ebca7d5d3c657d0fcbc509ad6cfe932c1c99570aeb6b75a93c329474e54e506cb84d4b3ab75dd961e4b6d58fc4f2d2bb7ef67f54bdafb7b0917cc1e345
- SSDEEP 98304:myKpfIRumuTkkH2jAbAaLf2BGtUwBi9hupYyMqdstgISpq:mPpfIsJkH4nfDi+GhupYyMhCO
- TLSH T1D1061292A7F90108F5F37F74AEBA91A45A36FC66BE74D21E1106448E5DB2E40CD60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
32:12:60:b0:35:03:c4:68:08:f6:44:b0:99:7d:2c:20:c0:77:17:c2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ELRASOFT EOOD,O=ELRASOFT EOOD,L=LOVECH,ST=LOVECH,C=BG,1.2.840.113549.1.9.1=#0c14737570706f727440656c7261736f66742e636f6d
Chains
Apr 18, 2013
CN=ELRASOFT EOOD,O=ELRASOFT EOOD,L=LOVECH,ST=LOVECH,C=BG,1.2.840.113549.1.9.1=#0c14737570706f727440656c7261736f66742e636f6d
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=ELRASOFT EOOD,O=ELRASOFT EOOD,L=LOVECH,ST=LOVECH,C=BG,1.2.840.113549.1.9.1=#0c14737570706f727440656c7261736f66742e636f6d
Serial Number
11:21:0f:74:89:b5:28:93:08:88:1e:03:c2:eb:ff:0b:d7:10
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 5, 2013 - May 19, 2014
Minor OS version
0
Major OS version
5
Entry point
2438082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
Size
2.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
16KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
114KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
90KB
Virtual Size
636KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
870KB
Virtual Size
872KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.exe
- IMPHASH ebc0ed068918bd1c2f0d70d99d5ef6a5
- SHA256 1dfa84cc7fdbf1c205a21c52907d1640f1d7ae2864095d3e14c9f3e74de053ab
- MD5 b09bdbfb60fbfbad6625341b1e099c05
- SHA1 76325536568c9f730b9181472f82fe11f2efe115
- SHA512 908416941232c4f5dd1da734244df6bacfda5db5e691dfab82a85efa9cf53f8c99f032f1757323b1df2b830313a911f29b5c10f76603ee1b3915c6173436ea99
- SSDEEP 192:Dr52L0YivX1Fx2mShqrCBJ4dj3urQXZLxNJ9uUmZBdZDpruICwgbKnbvNU1ryyf3:D4+FqhOuUmlHOQuyyfr7pGeh6oUhAB
- TLSH T18DD2E8B27CA54A27C88175F1DDF9BACDB72B6C131D6C0B53B2507E4E1A352C0683A316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
WriteProcessMemory
ReadProcessMemory
SuspendThread
Sleep
ResumeThread
ExitProcess
CreateProcessA
GetStartupInfoA
GetModuleHandleA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=22, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=9, id=14, version=7299,
count=3, id=19, version=8034,
count=44, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
uuprog_13014r2/破解 复制到C盘的安装目录下/uuprog.lic
- SHA256 6492075bb50269593b74e4118dd3ab8ee40f9f5b46aae7bb4cd4243d958dff38
- MD5 4648116658d5dcf40334b06527bd19a5
- SHA1 51cc61eba9a511e99d11d3308bdc65d386903566
- SHA512 3b14368f36d7bdd6c88f591accd8c3a571e6365ffe5bf581d04ec4a68b6a81f49fa11028bcc908fb841459413f841e187c0ce81209d9d9b140c1c20719ff9bdb
- TLSH T151B0125894143CF55418F58E39CDA57BC08CC2F75B1E1A95BE43A10563FB966AC8F300
- MD5 SHA1 SHA512 TLSH