RevoUninstallerPro5.zip
- SHA256 07620b3898edfc4150c5e1f100eb4d068150fa15045f937568703f3495d84cce
Behavioral task
behavioral1
Sample
RevoUninstallerPro5.zip
Resource
android-x64-20260325-en
android-10-x64
0 signatures
300 seconds
General
- Target RevoUninstallerPro5.zip
- Size 17.5MB
- Sample260804-nvd1vsae29
- SHA256 07620b3898edfc4150c5e1f100eb4d068150fa15045f937568703f3495d84cce
- MD5 faeee12a4d75742a9bd650b5f9e52d68
- SHA1 0a08af7c116a5836c3f0046fdee376a66e1fcd94
- SHA512 9a22b84c728432b672e9d32e0eca8cb9d6cafd3f4e2e7069c81838b5c09dcb2316716a2e344ef9a5c75d0cd768aee25c6e29814c04ba7a269816996d560d1796
- SSDEEP 393216:etklJvizW5FxlNbsqgz4GQ4g0bpmO5ZLZwj6+HvEXXriOapHNyR5:etklQzUx/bs5z4GQ4g0b50CriOa9NyR5
- TLSH T123073347EBC744F6F31B9E38463D42830E35B5E928F5429B2D3AC64E9EB070651313AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/RevoUninProSetup.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/RevoUninProSetup.exe innosetup
File Explorer
-
RevoUninstallerPro5.zip.zip 17.5MB
-
RevoUninProSetup.exe.exe 17.4MB
-
lic-pawel97.rar.rar 64KB
-
readme.txt68B
-
revouninstallerpro5.lic64KB
RevoUninProSetup.exe
- IMPHASH 20dd26497880c05caed9305b3c8b9109
- SHA256 2c05cfcee763b863fc843f703d48083c1ec9299da7e18aab45fe9b019d043538
- MD5 83a15b2dadfa5f7467a17fdac2e615c8
- SHA1 b1850ecffcf2921cb3f225dfda1e58e7790b77ea
- SHA512 c4afa6b3302c30656d3be9476b1431aecf68cb5545f7fac6fb3a03931bab2c984bb35c6b84cc8d4ef30e02bf92f2bc65788b95a91475ddb57e080a4698dec100
- SSDEEP 393216:jklJvizW5FxlNbsqgz4GQ4g0bpmO5ZLZwj6+HvEXXriOapHNyRe:jklQzUx/bs5z4GQ4g0b50CriOa9NyRe
- TLSH T1B3073347EBC754F2F31B9E38463E42830E35B5E968F5429B2D3AC64E9EB074641313A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
PE Signature issue
Digest
f3:13:0c:0a:38:f6:02:90:43:4e:66:fe:5b:6d:a4:76:70:00:9e:ae:e2:ec:32:18:1d:1f:9f:98:a9:60:d2:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247
Chains
Jan 1, 0001
PE Signature issue
Digest
76:78:fa:35:21:80:1a:56:0b:79:57:c6:c7:f2:1f:50:95:8d:5c:b5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247
Chains
Jan 1, 0001
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247
Serial Number
0f:ae:00:14:1b:9f:16:25:f7:80:19:f2:59:ff:fc:df
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 7, 2024 - Aug 13, 2027
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
5
Entry point
71708
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
lic-pawel97.rar
- SHA256 8608b2785f408a8ae29dd45b5881a1e93661f19e62e56dfe52176b379b60f9fa
- MD5 cabbd19a901185f2db051e18cbf59305
- SHA1 cd95d2d969c39e8cdf56c5e910aa0f18bf6ba1c8
- SHA512 6316900bed4dc875e568539abbb5ab7c32ce7fb8a83af12fca5cc5fbce67c0b7f58909fd2ed56f9b9c643d53fcc728e6867e36a81a444059767f4126798bd39b
- SSDEEP 1536:Yg8dvQaFp4zqjLCzkCYlnXMEbnxbiHgsWtXTiKE6AXutI0a:idvPFHLCzYlnXBUg3TibT+I
- TLSH T163530228A9A1864FBE5162777E49B42F49BD108D13186CB1C5333BFFE96012271E673E
- MD5 SHA1 SHA512 SSDEEP TLSH
readme.txt
- SHA256 c17797f50fb9f5d10f950b442e6567864fb5be95ff1ca819dd23e75a0de54b85
- MD5 46884c6375451ba1ffdbd499c0ce5875
- SHA1 48360ae9ed35f33be8b90a756301109abd814b08
- SHA512 3cf0e2e7f0f86f928ac71575202df8b2aee9772cb2118f5d8b57c7be392f97affb4bac8843874ef7392c56a8856cbd04b9664dfd6e21162a9fd90a83e265f51f
- TLSH T1E6A02200002223F02F0A030B0F0880ECFB08A0CC028E003B008E8A0AF280008208E022
- MD5 SHA1 SHA512 TLSH
revouninstallerpro5.lic
- SHA256 fe4bcb4251f77375119a936c80fb36221af0c5105e840e2e115d47f96cb437c8
- MD5 8462a9b69c76a9603a4143d51fbc201e
- SHA1 4473590f93f94f22c340a354516191c3c0ba6532
- SHA512 2f02ecdb06760a093f4d8e6f04c97138695b064db8cb2dcc4af9b47c829852f38b77be9425eb2f3e3e36f85da181c116c829921fa35ae68afc57c728d5393570
- SSDEEP 1536:wg8dvQaFp4zqjLCzkCYlnXMEbnxbiHgsWtXTiKE6AXutI0b:6dvPFHLCzYlnXBUg3TibT+5
- TLSH T170530228A9A1C54FBA5162777E49B42F48BD108D53186CA0C5333BFFE96012272E677E
- MD5 SHA1 SHA512 SSDEEP TLSH