uv-x86_64-pc-windows-msvc.zip
- SHA256 bb6d2987906b27d3031640c4a909b6f7c134cd29674c41ef545c6e7d57dd6700
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
uv.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
uv.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
uvw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
uvw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
uvx.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
uvx.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target uv-x86_64-pc-windows-msvc.zip
- Size 20.6MB
- Sample260805-wsn22sshjf
- SHA256 bb6d2987906b27d3031640c4a909b6f7c134cd29674c41ef545c6e7d57dd6700
- MD5 954c0fd581176a069ef376d83066291e
- SHA1 87c318869611ac2b2cef91fbeb8fb01edaf4e9a3
- SHA512 2579f6dc272fda78fee793b072d31fb5d4aea3c5812a507705d5a4ebea6eb68ca215c5d5071e8a39c53b3f27819be80395660ad95abe053fc5d4737a2f49d0a1
- SSDEEP 393216:iIO6FZosE7bONqNr8kXWlvy2G7mo/CPGwpG2dTmmA:ix6FZ8bOU8lx9G7moX2diz
- TLSH T13427334D72733E335B31DD21A915FA6B9A4D0AA1BF3E811BC695095C5E2B6F088F0BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/uv.exe unpack001/uvw.exe unpack001/uvx.exe
File Explorer
-
uv-x86_64-pc-windows-msvc.zip.zip 20.6MB
-
uv.exe.exe 60.1MB
-
uvw.exe.exe 325KB
-
uvx.exe.exe 325KB
uv.exe
- IMPHASH de36f85d1ac9c1add0701e2bf16b5d8e
- SHA256 bd67e89a6787daa858c38221bcce36f9da2959b09848f1918095d66bb5ebbdb7
- MD5 72fd84a27a22370ae6a76b931b5a68be
- SHA1 52cda1ff37cd2d57c4d8e6ffa90a9607b8b3951d
- SHA512 8d13d095832e4d29230842652665a08deb3c5401faffd518efb5a1f166850c2aaa4d307ee97d2aed8de2271d4f9e85ff4e359dbe5247601b8e43ac68c7570bac
- SSDEEP 196608:sMT+hufWgZ/V8djQ99jtd4r20rfTVXSYZj1B3BXjcdLPx8SI+78vozJx:sMUYaAUrhrrZS61kLPab+78vo
- TLSH T1D3D718167AAE696DD29AC870C34B4B635E2530CB0636B9FF44D456313F6EAB42B3C305
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
46938940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
uv.pdb
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32
GetFileInformationByHandleEx
CreateWaitableTimerExW
Sleep
SetWaitableTimer
FormatMessageW
FlsAlloc
SleepEx
GetStdHandle
GetConsoleMode
SetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorPosition
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetConsoleCursorInfo
SetConsoleCursorInfo
WaitForSingleObject
ReleaseSemaphore
SwitchToThread
FindNextFileW
FindClose
SetFileTime
SetFilePointerEx
GetCurrentProcess
SetLastError
TlsFree
TlsSetValue
GetStringTypeW
SetStdHandle
GetCPInfo
GetConsoleOutputCP
TlsGetValue
MultiByteToWideChar
WriteConsoleW
lstrlenW
WideCharToMultiByte
GetOEMCP
GetACP
IsValidCodePage
TlsAlloc
ReadConsoleW
GetStartupInfoW
CompareStringOrdinal
SetConsoleCtrlHandler
LCMapStringW
GetDynamicTimeZoneInformation
CompareStringW
WriteFileEx
GlobalFree
FreeLibrary
EncodePointer
FlushFileBuffers
GetFileSizeEx
GetBinaryTypeW
UnlockFile
CreateSemaphoreA
UnregisterWaitEx
RegisterWaitForSingleObject
GetFileAttributesW
CreateProcessW
TerminateProcess
ReadFile
CancelIo
WaitForMultipleObjects
GetExitCodeProcess
ReadFileEx
GetCurrentThread
SetThreadStackGuarantee
CreateThread
GetFileType
CreateHardLinkW
IsProcessorFeaturePresent
MoveFileExW
CopyFileExW
SetFileAttributesW
GetFinalPathNameByHandleW
RemoveDirectoryW
GetTempPathW
FlsFree
GetOverlappedResult
LockFileEx
CreateEventW
GetFileInformationByHandle
SetFileInformationByHandle
FindFirstFileExW
CreateDirectoryW
ReleaseMutex
CreateMutexA
GetCurrentProcessId
WaitForSingleObjectEx
GetCurrentThreadId
SetHandleInformation
DuplicateHandle
CreateFileW
ExitProcess
CreateProcessA
LocalFree
DeleteFileW
FlsSetValue
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetQueuedCompletionStatusEx
DeviceIoControl
GetFullPathNameW
HeapAlloc
GetLastError
HeapFree
GetProcessHeap
LoadLibraryExA
GetProcAddress
CloseHandle
CreateSymbolicLinkW
FlsGetValue
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleExW
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
OutputDebugStringW
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
UnhandledExceptionFilter
WriteConsoleA
VirtualQuery
VirtualFree
VirtualAlloc
GetCurrentProcessorNumber
GetProcessTimes
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
WriteFile
GetEnvironmentVariableA
GetVersionExA
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceW
LoadLibraryExW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
GetWindowsDirectoryW
GetSystemDirectoryW
SetEnvironmentVariableW
GetModuleHandleW
GetEnvironmentVariableW
LoadLibraryA
GetCurrentDirectoryW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCommandLineW
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleHandleA
VirtualProtect
MapViewOfFile
CreateFileMappingW
QueryPerformanceFrequency
QueryPerformanceCounter
SetCurrentDirectoryW
UnmapViewOfFile
GetSystemInfo
GetSystemTimePreciseAsFileTime
shell32
SHGetKnownFolderPath
CommandLineToArgvW
ole32
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
advapi32
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteTreeW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyTransactedW
RegCreateKeyExW
RegCreateKeyTransactedW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
CredWriteW
CredFree
CredReadW
CredDeleteW
SystemFunction036
LookupPrivilegeValueA
ntdll
NtOpenFile
NtCreateNamedPipeFile
NtWriteFile
NtCancelIoFileEx
NtDeviceIoControlFile
NtReadFile
NtCreateFile
RtlNtStatusToDosError
userenv
GetUserProfileDirectoryW
oleaut32
SafeArrayAccessData
SysFreeString
SysAllocStringLen
SafeArrayUnaccessData
GetErrorInfo
SysStringLen
VariantClear
bcryptprimitives
ProcessPrng
ws2_32
connect
WSAGetLastError
getpeername
closesocket
getsockopt
getaddrinfo
bind
WSAIoctl
setsockopt
ioctlsocket
WSASocketW
WSAStartup
WSACleanup
freeaddrinfo
recv
send
shutdown
WSASend
getsockname
bcrypt
BCryptGenRandom
crypt32
CertGetEnhancedKeyUsage
CertVerifyTimeValidity
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertOpenStore
Name
.text
Size
45.8MB
Virtual Size
45.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12.3MB
Virtual Size
12.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
61KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
139KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=149, id=261, version=33145,
count=26, id=260, version=33145,
count=13, id=259, version=33145,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=41, id=261, version=35207,
count=7, id=257, version=33145,
count=272, id=1, productName=Unmarked objects,
count=101, id=260, version=35222,
count=53, productName=Unmarked objects (old),
count=1, id=255, version=35222,
count=1, id=258, version=35222,
uvw.exe
- IMPHASH 92990dcad3ada96fb623471d4d95d00e
- SHA256 e27c89f0b3281427c0fbf528deb07dcca81ef74a4c83e58b0afe1a38a4a4da97
- MD5 093e36636bb4cd15ec617e1e8b0c9c3c
- SHA1 a1622454a00d45ccc6f2950ff487a724b0a14292
- SHA512 daee4ed2491cfe642468a10ffffff534fb2298bb57ac1bd7dc4e9f4244e6f37841abf2d4a18ff8467764be470121456fda5bdec97ece2757ef5a6c76684a1b34
- SSDEEP 6144:LopgEmtErQDA4jz5iuxpM2yYk0cFNtiMY6wqcUbjM7AP:s03Djz5iWDk0TnUbZ
- TLSH T170644C21BBA658FCE556C078C2468A735A337C860B61B9FF129441353F2BAE16F3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
168752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
uvw.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
kernel32
QueryPerformanceCounter
SetFilePointerEx
GetProcessHeap
HeapFree
GetCommandLineW
CloseHandle
WaitForSingleObject
GetLastError
GetExitCodeProcess
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
HeapReAlloc
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
MultiByteToWideChar
WriteConsoleW
GetCurrentThreadId
SetLastError
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetProcAddress
GetCurrentProcess
lstrlenW
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
WideCharToMultiByte
GetEnvironmentVariableW
HeapAlloc
GetFullPathNameW
CreateFileW
SetFileInformationByHandle
GetModuleHandleW
FormatMessageW
GetModuleHandleA
GetModuleFileNameW
WriteFileEx
SleepEx
ReadFileEx
ExitProcess
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
DuplicateHandle
CreateThread
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
ntdll
RtlNtStatusToDosError
NtOpenFile
NtCreateNamedPipeFile
NtWriteFile
Name
.text
Size
221KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=141, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=5, id=257, version=33145,
count=124, id=1, productName=Unmarked objects,
count=4, productName=Unmarked objects (old),
count=1, id=255, version=35222,
count=1, id=258, version=35222,
uvx.exe
- IMPHASH 154f53355e67e76a71301295066ecfa1
- SHA256 0b479d8776a5b1e0f15be73d26babd7bebf47b58eaa38177ed0641a6d192efab
- MD5 1f1de136bc2bdbcbf0f6c0395de551d7
- SHA1 12e119650f3563a2168ef67f00a5e3b1096aa936
- SHA512 68927336d2cef97e70c405a65f5e824beb917f359160760f2c9d3816c4dfb759b9223891ee4edf8d5329bf71ae5808417108410123af74deee57b12fa647d779
- SSDEEP 6144:LYgOqTSHu0GANQ1ycujzifs4ymGpRApnph6vFCvs:3LSfNNQoA3ySWCU
- TLSH T199644B21BAA558FDE556C078C3428A735A337C861B22B9FF129541353F2BAE16F3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
168828
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
uvx.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
kernel32
QueryPerformanceCounter
SetFilePointerEx
GetProcessHeap
HeapFree
HeapReAlloc
GetLastError
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
WaitForSingleObject
CloseHandle
MultiByteToWideChar
WriteConsoleW
GetCurrentThreadId
SetLastError
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetProcAddress
GetCurrentProcess
lstrlenW
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
WideCharToMultiByte
GetEnvironmentVariableW
HeapAlloc
GetFullPathNameW
CreateFileW
SetFileInformationByHandle
GetModuleHandleW
FormatMessageW
GetModuleHandleA
GetModuleFileNameW
SetThreadStackGuarantee
WriteFileEx
SleepEx
ReadFileEx
ExitProcess
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
DuplicateHandle
CreateThread
GetCurrentThread
GetCommandLineW
GetExitCodeProcess
AddVectoredExceptionHandler
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
ntdll
RtlNtStatusToDosError
NtOpenFile
NtCreateNamedPipeFile
NtWriteFile
Name
.text
Size
221KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=141, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=5, id=257, version=33145,
count=124, id=1, productName=Unmarked objects,
count=4, productName=Unmarked objects (old),
count=1, id=255, version=35222,
count=1, id=258, version=35222,