UEPrereqSetup_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
UEPrereqSetup_x64.exe
Size 48.3MB
Sample260730-p8c66asthy
SHA256 ef1ac9b2347702667e6a2a280bf2bcd55462882444a7c6981be74ac34df971f0
MD5 f6f6011b663b2ffbf174d050bdbb7790
SHA1 a3324e86d96e5781dbfea5ce30600d7e6f41cc0c
SHA512 8f85738ed22ad4b1ac9bdf22d51a283ff44ddbfb5156f815d866e09dfc2392a8ed9851b973d7d660fd3ee1f721b32fe341bac3463aaf6ae40f7829472a559fd2
SSDEEP 1572864:eK+vvj4Atyu1D654FTg3+tQ2I9X5VDSyPtb6HtcA2:9Uvsu5654NnHAX5VTPutcA2
TLSH
T1ABB73373A68C873ECBA21837958AF9141F2E7129311484F7E79CCC691A3615323FAF56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UEPrereqSetup_x64.exe

File Explorer

UEPrereqSetup_x64.exe

.exe 48.3MB

UEPrereqSetup_x64.exe

IMPHASH 67715e556e3a78ea78c756db800102a3
SHA256 ef1ac9b2347702667e6a2a280bf2bcd55462882444a7c6981be74ac34df971f0
MD5 f6f6011b663b2ffbf174d050bdbb7790
SHA1 a3324e86d96e5781dbfea5ce30600d7e6f41cc0c
SHA512 8f85738ed22ad4b1ac9bdf22d51a283ff44ddbfb5156f815d866e09dfc2392a8ed9851b973d7d660fd3ee1f721b32fe341bac3463aaf6ae40f7829472a559fd2
SSDEEP 1572864:eK+vvj4Atyu1D654FTg3+tQ2I9X5VDSyPtb6HtcA2:9Uvsu5654NnHAX5VTPutcA2
TLSH
T1ABB73373A68C873ECBA21837958AF9141F2E7129311484F7E79CCC691A3615323FAF56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

157605

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\src\wix38\build\ship\x86\burn.pdb

advapi32

OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegCloseKey RegQueryValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation RegOpenKeyExW QueryServiceConfigW

user32

GetMessageW PeekMessageW PostMessageW SetWindowLongW PostQuitMessage DispatchMessageW DefWindowProcW RegisterClassW UnregisterClassW CreateWindowExW LoadCursorW MessageBoxW LoadBitmapW TranslateMessage GetWindowLongW IsWindow MsgWaitForMultipleObjects WaitForInputIdle PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW GetCursorPos

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdi32

GetObjectW StretchBlt SelectObject DeleteObject CreateCompatibleDC DeleteDC

shell32

ShellExecuteExW SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree CoInitializeSecurity CLSIDFromProgID CoCreateInstance StringFromGUID2 CoInitialize CoInitializeEx CoUninitialize

kernel32

GetVersionExW CompareStringW VerSetConditionMask FreeLibrary GetProcAddress EnterCriticalSection LeaveCriticalSection GetSystemTime lstrlenW GetModuleHandleExW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW GetSystemWow64DirectoryW GetComputerNameW VerifyVersionInfoW GetVolumePathNameW GetDateFormatW GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ExpandEnvironmentStringsW GetFileAttributesW ReadFile SetFilePointerEx CreateFileW InterlockedExchange InterlockedCompareExchange LoadLibraryW lstrlenA RemoveDirectoryW CreateEventW OutputDebugStringW ProcessIdToSessionId OpenProcess GetProcessId WaitForSingleObject WriteFile ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread FindClose SetFileAttributesW FindFirstFileW FindNextFileW GetModuleHandleW WaitForMultipleObjects InterlockedIncrement InterlockedDecrement DuplicateHandle CreateProcessW SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess SetThreadExecutionState CopyFileExW ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA CompareStringA MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW VirtualAlloc VirtualFree GetSystemTimeAsFileTime DeleteFileW GetThreadLocale TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle Sleep ReleaseMutex DeleteCriticalSection InitializeCriticalSection GetLastError GetTimeZoneInformation GetCPInfo GetOEMCP GetACP IsValidCodePage HeapFree RaiseException HeapAlloc IsProcessorFeaturePresent IsDebuggerPresent TerminateProcess SystemTimeToTzSpecificLocalTime SystemTimeToFileTime MoveFileExW CopyFileW RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode GetCurrentThreadId GetCurrentProcess LocalFree HeapSetInformation LoadLibraryExW SetEvent HeapReAlloc HeapSize LCMapStringW SetStdHandle WriteConsoleW FlushFileBuffers SetFilePointer GetLocalTime FormatMessageW GetTempFileNameW CreateDirectoryW GetFullPathNameW GetModuleHandleA GlobalAlloc GetCurrentProcessId SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStartupInfoW InitializeCriticalSectionAndSpinCount GetFileType GetProcessHeap GetModuleFileNameW GetStdHandle GetFileSizeEx MultiByteToWideChar ExitProcess DecodePointer GetCommandLineW SetLastError EncodePointer GlobalFree

cabinet

ord20 ord22 ord23

crypt32

CertGetCertificateContextProperty CryptHashPublicKeyInfo

msi

ord118 ord115 ord171 ord125 ord17 ord8 ord116 ord111 ord173 ord45 ord205 ord90 ord141 ord137 ord169 ord70 ord88 ord190 ord238

rpcrt4

UuidCreate

wininet

HttpQueryInfoW InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetErrorDlg InternetCrackUrlW

wintrust

WTHelperGetProvSignerFromChain CryptCATAdminCalcHashFromFileHandle WTHelperProvDataFromStateData WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

UEPrereqSetup_x64.exe

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

cabinet

crypt32

msi

rpcrt4

wininet

wintrust

version

generic