newui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
newui.exe
Size 26KB
Sample260705-mhtecabz2z
SHA256 86b734d08fc815c1f34d502b880a05e4c8a7af078eae63fab800ad34ec94c76b
MD5 dc75ced124e10a956be749c0d8eac5dd
SHA1 94c99c2a6f895383e8a43073b28b51c2292c4475
SHA512 25c0adb9213fc42a5201bd7c7b9da9d9ba5e10a381ca71e61a034d2153cb0d629b174196979b91d98d4a9c7d9ab22799c455179c0f29bff876cb6ea723566392
SSDEEP 384:BKb+VbV9d5zxtIQUdI3vw2ouSe4wgMrB0KdwTWB0bF:sCVbPd5zxHUdI3I2oo4vM5dwTo0p
TLSH
T161C24A132B0241ECE60792BE994326569671FD521F21B2CB53D2E35E1F647E0EE3A9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
newui.exe

File Explorer

newui.exe

.exe 26KB

newui.exe

IMPHASH 17403fb699f26a88d69fb4444ce5b9ad
SHA256 86b734d08fc815c1f34d502b880a05e4c8a7af078eae63fab800ad34ec94c76b
MD5 dc75ced124e10a956be749c0d8eac5dd
SHA1 94c99c2a6f895383e8a43073b28b51c2292c4475
SHA512 25c0adb9213fc42a5201bd7c7b9da9d9ba5e10a381ca71e61a034d2153cb0d629b174196979b91d98d4a9c7d9ab22799c455179c0f29bff876cb6ea723566392
SSDEEP 384:BKb+VbV9d5zxtIQUdI3vw2ouSe4wgMrB0KdwTWB0bF:sCVbPd5zxHUdI3I2oo4vM5dwTo0p
TLSH
T161C24A132B0241ECE60792BE994326569671FD521F21B2CB53D2E35E1F647E0EE3A9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uncaught_exceptions@std@@YAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate memcpy memmove memset

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf _set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

876B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

newui.exe

kernel32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic