GatewayUncertainty[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GatewayUncertainty.exe
Size 2.2MB
Sample260730-vmnnnacf48
SHA256 9d0690fac5168a38b4dfc77289e53ffbb1b87219b27390a5d4a11e303c307823
MD5 60c79d4f5eb60869d75d32c576428b01
SHA1 8192b2198ef75b2ce870538d085edf408300cff1
SHA512 c3f7ed5859c9a56be930a610c6f51f92d8455772640fc551ace15b92482cc7602b5fffdb6f4d39d3c4e0ba69c933d33eeb64859aab83fad0fbdef5aaf722e4b5
SSDEEP 49152:7FfIv2fN7VahjsEIe7SM9INwkGYWO9h8N6SLLZBs+w:7FwvgNshjaenNLoWpLLZd
TLSH
T1F0B523413AC884DBF9652F7485B1C59AC6B03C755F691A9FB1AAF75E0A31342033FB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GatewayUncertainty.exe

File Explorer

GatewayUncertainty.exe

.exe 2.2MB

GatewayUncertainty.exe

IMPHASH 013c74198fc6e42dcf33737d6c40c012
SHA256 9d0690fac5168a38b4dfc77289e53ffbb1b87219b27390a5d4a11e303c307823
MD5 60c79d4f5eb60869d75d32c576428b01
SHA1 8192b2198ef75b2ce870538d085edf408300cff1
SHA512 c3f7ed5859c9a56be930a610c6f51f92d8455772640fc551ace15b92482cc7602b5fffdb6f4d39d3c4e0ba69c933d33eeb64859aab83fad0fbdef5aaf722e4b5
SSDEEP 49152:7FfIv2fN7VahjsEIe7SM9INwkGYWO9h8N6SLLZBs+w:7FwvgNshjaenNLoWpLLZd
TLSH
T1F0B523413AC884DBF9652F7485B1C59AC6B03C755F691A9FB1AAF75E0A31342033FB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA SetFilePointer GlobalAlloc ExpandEnvironmentStringsA WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA ReadFile SetCurrentDirectoryA _llseek ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime Sleep FreeResource GetWindowsDirectoryA lstrcmpA _lclose GlobalLock GetCurrentProcess LoadResource FreeLibrary GetStartupInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess OutputDebugStringA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA GetTempFileNameA

gdi32

GetDeviceCaps

user32

SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowLongPtrA GetWindowRect GetDC MessageBoxA PeekMessageA ReleaseDC GetDlgItem SetWindowPos ShowWindow SetWindowLongPtrA DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA SendMessageA GetSystemMetrics

msvcrt

?terminate@@YAXXZ _fmode _acmdln __C_specific_handler _initterm __setusermatherr _ismbblead _cexit memset memcpy _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter _errno _vsnprintf _commode

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA