MUICacheView_1.01.lks
- SHA256 3ee15136369b41304063d4e3f06e0a8d5519b57dae41fc1582fdaeaf56fb1953
Behavioral task
behavioral1
Sample
MUICacheView/App/MUICacheView/MUICacheView.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
MUICacheView/App/MUICacheView/MUICacheView.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
MUICacheView/App/MUICacheView/MUICacheView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
MUICacheView/App/MUICacheView/MUICacheView.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
MUICacheView/MUICacheViewLKL.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
MUICacheView/MUICacheViewLKL.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target MUICacheView_1.01.lks
- Size 59KB
- Sample260809-ajjkbaxane
- SHA256 3ee15136369b41304063d4e3f06e0a8d5519b57dae41fc1582fdaeaf56fb1953
- MD5 3085139dd67d11fc92972a4612161ffa
- SHA1 057889b80ca7dd21391b71dc8428daf47775d752
- SHA512 4e8e07777cbeb6cbf7524a1207b051d10a8b4067dbc526bc409a65d0566bfa288ec5ff17f4e74202d49fc78627e74bb678d8c5d538f5b103e23b75cfebded845
- SSDEEP 1536:Z2Gjl3p5XUyHn7fWOOx0ZbFv53Br5DPK9T:Z2GFXznKyZv5RrFe
- TLSH T10C53028273614EEE4ACE813601265C267226FE4E1990D875FF6F957C2B25272B0B43FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack002/out.upx Nirsoft -
resource yara_rule static1/unpack001/MUICacheView/App/MUICacheView/MUICacheView.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/MUICacheView/App/MUICacheView/MUICacheView.exe unpack002/out.upx unpack001/MUICacheView/MUICacheViewLKL.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/MUICacheView/MUICacheViewLKL.exe nsis_installer_1 static1/unpack001/MUICacheView/MUICacheViewLKL.exe nsis_installer_2
File Explorer
-
MUICacheView_1.01.lks.7z 59KB
-
MUICacheView/App/MUICacheView/MUICacheView.cfg263B
-
MUICacheView/App/MUICacheView/MUICacheView.chm.chm 14KB
-
MUICacheView/App/MUICacheView/MUICacheView.exe.exe 29KB
-
out.upx.exe 68KB
-
MUICacheView/App/MUICacheView/readme.txt5KB
-
MUICacheView/MUICacheView - license.txt78B
-
MUICacheView/MUICacheViewLKL.dat280B
-
MUICacheView/MUICacheViewLKL.exe.exe 34KB
-
MUICacheView_FR/App/MUICacheView/MUICacheView_lng.ini1KB
-
MUICacheView_FR/MUICacheView - license.txt89B
-
app_logo.bmp3KB
-
package.lbk6KB
MUICacheView/App/MUICacheView/MUICacheView.cfg
- SHA256 1277834a891c81d6521b0f4133641f838f725e4ea0cfe9cc3618f2f3aac680f5
- MD5 c1552b8c38fb399c7fb03320098e64d9
- SHA1 1488c989f7f3218477e9fe7260f03afac3450fc8
- SHA512 3bfa35bb06f9d4b94a8b07550dbf2d2914880ec29e62c0485c2e653019b24ed1c2442b89acef7f9ef9dfccaf901ed89297afe29f3416d0ee2e16adc037191364
- TLSH T119D0C9474403141DC0E31F5C60E0766444B05D53BDD024F45BBFAB48EFD8D1E5945640
- MD5 SHA1 SHA512 TLSH
MUICacheView/App/MUICacheView/MUICacheView.chm
- SHA256 6aae0bf35ffd9c9e3eef6f656cab72d808ca8cf9ba09a52d673a247241147f6d
- MD5 7a51cedfb7b7d8a58e863d58b012d307
- SHA1 f9244de017e1fa90e0f13de755a6a709cf9735ec
- SHA512 7480a24bfbd21a9cd223bf512ee9a4b168b2da94d58e3aa1f8636f14ad2afa14a4941c931447acf4d015b20f2f5c1b6a72d3020f2e814d206cabc25fb82305e6
- SSDEEP 96:rwJiYiqywtBiyWWzoF26CEsMRfXzQVqtptPQ5Epf+Pr2wd9m:rwJi0Oy9Q26CELRLQVgzKEV+PZd9m
- TLSH T1F9527CDA3710006DC07AA730BEDEA05BB8053D97BCF01852B10B1A7CD8B3A0D9B2459E
- MD5 SHA1 SHA512 SSDEEP TLSH
MUICacheView/App/MUICacheView/MUICacheView.exe
- SHA256 02e28fa849121a1ffce2cccdfaed4974636253c3a8d5f16207d0fd13c0ea72d5
- MD5 e999c811b919c420d5657a484cecdd61
- SHA1 a61ab3db7d9aa92c309956c8a033a7c5ce4edeb9
- SHA512 caeb0693a02154195d2421786a7b39559ac605c06371a8f7ed95535f75296e7f3a99de0a72d9ff7570d4b7d0bd3a2c2bb7ff37813f1fefbc4be1ad792ba41d8a
- SSDEEP 768:Xm/LKD7CbEQJHUDPk77BJKdupd8vl7PbT6z204wwwggAGyN1RGz:qLKD7CQYHUD8hJh6l7X104wwwggAG21E
- TLSH T1C1D2CF03EBA59068CBBDA4B710638F701B16FC3019680F9A36B5769FEC303656D51BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
77888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
24KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=14, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=243, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=20, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 0e7702b09d00f01a52a9a5de8c79afd8d1fbcbe171419cc16f7cd20bf85a03fe
- MD5 e674f615803469f77d9cac3a639e25ac
- SHA1 f72bcbed823ca4cdcf7767d8525457e53c06a3f4
- SHA512 3dd5a5c3952387c83cd43e321fe22c37042cf1722cc2e6e7f7bbbd46a21568d7714ba7f5821ed929785db75848112ccc1da0e0c18a6071f5b1069d759065303b
- SSDEEP 1536:Y5+SoAcpQ+YJ4fhk04wwwggAG21RGz57S:rrpQ+s4uo7
- TLSH T12763291376E58071EDB71A702E776A228AFB7D205578CB0F8B949C0E6CF1281ED25366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=243, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=20, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
MUICacheView/App/MUICacheView/readme.txt
- SHA256 8e336ab1ddd11dc1fa67ed88885f21accc385fcb2ca983ce1b3815f669226606
- MD5 e2d94d637e2b1201d4bfdb62389485b6
- SHA1 f58c68390fa9f4bcf9f004ea1f5f47e1bfb44ae4
- SHA512 e0627e150d3696b0a3ab71bc3a1c1d34fddff96aeb0da5853f2e2f1acf5255c7e9bf9a10fad0c5a1dab41c96fcba8a2cc98f01853607537e9610879c85ed4919
- SSDEEP 96:glE1vAAS52HM+w1LgyMFlXREX/coVF3XNUashFUr3OC:glE171sH1LGiUNI+C
- TLSH T174B1965F235B037121E32173324D7AA3F216816E9A6659E2F44E621C2A3375AD3FB0DC
- MD5 SHA1 SHA512 SSDEEP TLSH
MUICacheView/MUICacheView - license.txt
- SHA256 ad244ecbeb4ab79d1b72239b2a183afc0f259d9992fddda078c7fcf557b6753d
- MD5 17a29e04ec78c8d02a4f89037a6dfb7b
- SHA1 e17508274a8cae1bcf1760dbf69f70e53be22cad
- SHA512 54254e56036aeaac4bf727f82add379167eb453bcfda0b5726a48cefaed2938f53a33cca4038ce49422731e65c2506fea81757fd7edeeb22a836399c5f0f0c4c
- TLSH T197A012C02B61041A109250784622361BF345A05F48992112D021554428348002084820
- MD5 SHA1 SHA512 TLSH
MUICacheView/MUICacheViewLKL.dat
- SHA256 37e4212d93af3bf9b126ffa2945c40840e6a244c73d7874c101973c35c454e92
- MD5 b29ce29d8f111609b96bfd2adba9cb5f
- SHA1 12e2d9ca401ff147dd7aae52a9903e6251f94a81
- SHA512 c0346436f3d10b5b9cf30b2713c31bd3a4e5ba9f20968ce603456b907e9588eb80eec964ab058c797a1cbac23250b89e65c1621b3c15465352f5c5674e67652d
- TLSH T109D0EBFE1C381F003010C8A04B2DEEA283269B3420AF4F10E85B3E826304F58FA13030
- MD5 SHA1 SHA512 TLSH
MUICacheView/MUICacheViewLKL.exe
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 0c446f37828a3b791f51894473f9382a1f406f9c28c0fb7188f077d81282623b
- MD5 ee9e437946665d066fa7f449b6c98f39
- SHA1 c7f5836c93889f859c6e1b54d667fef7374d1d70
- SHA512 45b2f38a66dc7351af7898e45a11e4d3b797d112c1f29d5792a51e442d544152cd78c34c014924ffc2f5345eab8246ccce6dfc45b0b82402a317b7e8ee26311b
- SSDEEP 768:G1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJM4wwwggAGImPmZyG0m7c:kQpQ5EP0ijnRTXJM4wwwggAGIGQyG0Cc
- TLSH T1BAF28C1632D5C4B7E8AB0B3119B7EB7AD7B6FB001660061F6B702FBE29311839905387
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
MUICacheView_FR/App/MUICacheView/MUICacheView_lng.ini
- SHA256 98f9fa8cd1cc4f241ca93fa84ac23523891b6278ffe346b620d876706be11a5b
- MD5 887d89c55930a6a8c470ba5d48dd552d
- SHA1 a1f9dd56095f85ee30539ab69f5cd0d5bc197b85
- SHA512 f51bdea09544eaba90727fc855355b0f34d5672383cc9005fa29a19fed45dddbd5dd08b84c3a8d5adca6b9210c89b16a1f08b0fc44f0b7dd66d462f46b7b4cd9
- TLSH T1FF31F167F21936D38A43A2DB7A83FDCE28B3F768E11DB084F555051E2961E7D54C2205
- MD5 SHA1 SHA512 TLSH
MUICacheView_FR/MUICacheView - license.txt
- SHA256 934c529ef15cfd2d935f6423efe35714715768bf7cb91324521fe7d1291022d1
- MD5 3518f2097eb8bd2b237d401cb76d9323
- SHA1 0b0c9584bb09a7c32a4254176b45f8d410c540dd
- SHA512 737e4f20232e18b2a84a8227189b41dd3f09527d7613f2343b65859be83cf8204d04fa898953556791a61e669338bf24eda4c84bf692b70ea99d3d36f8409d70
- TLSH T1B9B012501B191009216215315B22333FF00A715B48CE7212D0732088547C8346098060
- MD5 SHA1 SHA512 TLSH
app_logo.bmp
- SHA256 a014839d0155d5d430007cca810c1d237d2d45ce1d067dc5feca7626993a0917
- MD5 99cffb14bd18df9d8473d888ada2b48d
- SHA1 a9193200e5a00c8b26e05ac790aec59ab7d2c328
- SHA512 3baa08ed5a3a8236f31167f767853cad9e88f23380943fc3a684bac1bb746a1833b32dd41614bc7fee0c0b71cdb807f8df1623aaf6c9739dc0e84cea7847795c
- TLSH T11D5105C31D2ED9A4D00445398C5F4EB80A62CEC7B854A1168363FEECEDF8716B64B359
- MD5 SHA1 SHA512 TLSH
package.lbk
- SHA256 de27c8530942b9d4ffc3b365c809e3f142058b3a610702eaf1d935b4adb8331b
- MD5 fd2cd7bad0894b6bcd725f960f4d5fc9
- SHA1 7f62bea333df4ea4dc41fd403725e6c4a3732ffe
- SHA512 2567942d89c12ec596ca015985a9d73df7126845788e58b5fa7657c703cac2b661808249025b0cac75e171f4d4fa8e558294ea918cd5e37efd010bc505dfb109
- SSDEEP 192:xLHJxEufbzId24EfY7QKgoEfslhfGRsTrGS:xvVfvId28vLTueiS
- TLSH T15ED19E757AEE636BB31F6564A25EA69DB06670380C98453AC84CF24ECC51A5FB313680
- MD5 SHA1 SHA512 SSDEEP TLSH