Uninstaller[.]exe | Triage™

General

Target
Uninstaller.exe
Size 162KB
Sample260808-vmxlka1dmc
SHA256 080b45708098a05d20b8f4e5b28934b7766700510baa63075409dc9ced9cf5c6
MD5 1f82f5227131b684f99e34c9c98eb334
SHA1 5cf1f0ca3439b23493c5b563013d1f22137621a7
SHA512 1799e55941daff0fbc2d2767ee165c3f9e1d40b1943948074c33a27a7e543966ea39bde9d13cbfafeedea166a0f0e290f8682d19c103c9c54611c8b65e18d132
SSDEEP 3072:qfw1RPESBQC2mC920ZfpFTQjouzaFuXMwozH5cycI/w0:qfw1zGfLTQsCA8W9cLI/
TLSH
T1A2F37C21B5C1C032E1F71A7028F5DBB15A7CBA301F7589DFA3941B3A6E701E21635E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Uninstaller.exe

File Explorer

Uninstaller.exe

.exe 162KB

Uninstaller.exe

IMPHASH f604a8670c499a744c6830d595b3ee2c
SHA256 080b45708098a05d20b8f4e5b28934b7766700510baa63075409dc9ced9cf5c6
MD5 1f82f5227131b684f99e34c9c98eb334
SHA1 5cf1f0ca3439b23493c5b563013d1f22137621a7
SHA512 1799e55941daff0fbc2d2767ee165c3f9e1d40b1943948074c33a27a7e543966ea39bde9d13cbfafeedea166a0f0e290f8682d19c103c9c54611c8b65e18d132
SSDEEP 3072:qfw1RPESBQC2mC920ZfpFTQjouzaFuXMwozH5cycI/w0:qfw1zGfLTQsCA8W9cLI/
TLSH
T1A2F37C21B5C1C032E1F71A7028F5DBB15A7CBA301F7589DFA3941B3A6E701E21635E6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43023

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA FindFirstFileA FindNextFileA FindClose Sleep RemoveDirectoryA DecodePointer WriteConsoleW SetFilePointerEx GetModuleFileNameA GetFileSize CloseHandle CreateFileA WriteFile ReadFile GetTickCount DeleteFileA CopyFileA GetConsoleCP FlushFileBuffers GetConsoleMode UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW EncodePointer RaiseException GetLastError SetLastError RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetStringTypeW GetFileType FindFirstFileExA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetProcessHeap HeapSize HeapReAlloc CreateFileW

user32

MessageBoxA LoadStringA

advapi32

RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA RegDeleteValueA RegEnumKeyExA RegCloseKey

shell32

SHGetSpecialFolderPathA ShellExecuteA

Sharing