UI[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UI.exe
Size 16.4MB
Sample260803-vmfytace89
SHA256 f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0
MD5 a2b6b7198b6699f866a745c8ba55c2c1
SHA1 ab063e32b77137604c214916dffce1b5a3871cd5
SHA512 c158333918433e47c3c08901034b85ba99894ee37a719520c358618d74555f0bc19af2c2f274a6f4005a56d42a814ee804d8e684191084c46437e78ec751fff5
SSDEEP 196608:5sC0dlkPaQbao2Faaya8l0S7oo3TwhRCuMqoW:l0d0uFaayFso3TwhRX
TLSH
T1A30706257B5A996DC05AC4B4834B8B72497130DB0B39B9FF449492382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UI.exe

File Explorer

UI.exe

.exe 16.4MB

UI.exe

IMPHASH 6d8160496adc5b509e33111cea34e893
SHA256 f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0
MD5 a2b6b7198b6699f866a745c8ba55c2c1
SHA1 ab063e32b77137604c214916dffce1b5a3871cd5
SHA512 c158333918433e47c3c08901034b85ba99894ee37a719520c358618d74555f0bc19af2c2f274a6f4005a56d42a814ee804d8e684191084c46437e78ec751fff5
SSDEEP 196608:5sC0dlkPaQbao2Faaya8l0S7oo3TwhRCuMqoW:l0d0uFaayFso3TwhRX
TLSH
T1A30706257B5A996DC05AC4B4834B8B72497130DB0B39B9FF449492382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10394636

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ui.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion NtCreateFile NtOpenFile NtCancelIoFileEx NtDeviceIoControlFile NtReadFile RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile

advapi32

RegQueryValueExW RegCloseKey RegGetValueW RegOpenKeyExW SystemFunction036 EventSetInformation EventWriteTransfer EventUnregister EventRegister

kernel32

OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW WaitForSingleObject GetSystemFirmwareTable FreeLibrary GetModuleHandleA Sleep ReadDirectoryChangesW GetProcAddress ReleaseSRWLockExclusive SetHandleInformation GetFileAttributesW AcquireSRWLockExclusive lstrlenW LoadLibraryA GetOverlappedResult PostQueuedCompletionStatus ReadFile LoadLibraryW CancelIoEx WakeAllConditionVariable CreateIoCompletionPort SleepConditionVariableSRW LCIDToLocaleName GetUserDefaultUILanguage GetModuleHandleW GetQueuedCompletionStatusEx GetCurrentThreadId SetFileCompletionNotificationModes GetConsoleMode GetFileInformationByHandle CreateSemaphoreW GetSystemTimeAsFileTime LoadLibraryExA HeapAlloc RtlPcToFileHeader CancelIo RaiseException FlsAlloc WaitForSingleObjectEx FlsGetValue FormatMessageW ReleaseSemaphore CreateFileW WriteFile CreateFileA DeviceIoControl FlsSetValue SetNamedPipeHandleState FlsFree CloseHandle GetLastError EncodePointer SetUnhandledExceptionFilter InitializeSListHead DeleteCriticalSection RtlVirtualUnwind GetEnvironmentVariableW HeapReAlloc GetCurrentProcess WideCharToMultiByte GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW RtlUnwindEx CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW GetFileInformationByHandleEx SwitchToThread CreateEventW DeleteFileW FindFirstFileExW FindClose SetEnvironmentVariableW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceFrequency MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread WaitForMultipleObjects ReadFileEx InitializeCriticalSectionEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW

user32

MonitorFromPoint ShowCursor RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetClipCursor ClipCursor GetSystemMenu SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC EnableMenuItem SetPropW SystemParametersInfoA SetWindowDisplayAffinity IsWindowVisible GetMenu IsProcessDPIAware GetDC DestroyIcon EnableWindow IsWindowEnabled SetForegroundWindow SendInput GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn GetWindowTextLengthW SetWindowTextW GetWindowLongW EnumDisplayMonitors MapVirtualKeyExW GetKeyboardState GetAsyncKeyState GetKeyState ToUnicodeEx DrawTextW GetRawInputData DestroyWindow GetWindowDC TranslateAcceleratorW RegisterWindowMessageA AdjustWindowRect ScreenToClient GetForegroundWindow OffsetRect GetMenuBarInfo DestroyMenu DrawIconEx RegisterTouchWindow IsWindow CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos SetMenu InvalidateRgn GetClientRect ClientToScreen GetCursorPos MonitorFromWindow MonitorFromRect GetMonitorInfoW DrawMenuBar GetSystemMetrics GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW GetMessageW MapVirtualKeyW IsIconic EnumChildWindows SetMenuItemInfoW AppendMenuW DispatchMessageA GetMessageA CreateWindowExW RegisterClassExW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable SetLayeredWindowAttributes SetWindowLongW SetWindowPos PostMessageW LoadCursorW DispatchMessageW TranslateMessage SendMessageW GetUpdateRect PeekMessageW PostThreadMessageW GetMenuItemInfoW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo RedrawWindow TrackMouseEvent SystemParametersInfoW CreateIcon FillRect GetWindowTextW GetKeyboardLayout

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoTaskMemAlloc CoInitialize RegisterDragDrop OleInitialize CoCreateFreeThreadedMarshaler RevokeDragDrop CoUninitialize

comctl32

TaskDialogIndirect DefSubclassProc RemoveWindowSubclass SetWindowSubclass

gdi32

CreateCompatibleDC SelectObject CreateDIBSection DeleteDC GetDeviceCaps SetBkMode CreateRectRgn SetTextColor DeleteObject CombineRgn BitBlt CreateSolidBrush

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

shell32

DragFinish SHGetKnownFolderPath ShellExecuteW SHCreateItemFromParsingName ShellExecuteExW SHOpenFolderAndSelectItems ILCreateFromPathW ILFree DragQueryFileW SHAppBarMessage

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

ws2_32

freeaddrinfo getaddrinfo WSACleanup socket WSAGetLastError shutdown listen bind WSASocketW WSAStartup connect ioctlsocket setsockopt send WSASend recv getsockname getpeername accept getsockopt closesocket WSAIoctl

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

floor roundf round __setusermatherr pow trunc

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit __p___argv __p___argc _seh_filter_exe _register_thread_local_exe_atexit_callback _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _exit abort exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _wassert

api-ms-win-crt-heap-l1-1-0

malloc calloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

strcpy_s strlen wcslen _wcsicmp wcscmp

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale