UNINSTALL[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UNINSTALL.exe
Size 450KB
Sample260814-w74faazvbx
SHA256 00ecf1661146d040dfe3348934e4eb557c333491b0ed68116d099fad585d5987
MD5 05f6a019fa155215e335bc66bf945d4b
SHA1 fc5d18728f354f79e855c263f292bd95f240c892
SHA512 5c566f7954f0ebf86daa1cf2a8e83929a103254856731e4620764568493e34eedbc2ce6276bdf90ccfa5e11d75473cf22e8b28352196c891489ce0a8c3e306dd
SSDEEP 6144:dN2pkbnH7MuaW2q2qaghYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1lt3:2pkbi5qjhZ3CmW9lsq+eYR
TLSH
T12EA46B1177C2C496F9791570C88A81F40155FC6CEBA156AFB1823F6E7AF23D2182BE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UNINSTALL.exe

File Explorer

UNINSTALL.exe

.exe 450KB

UNINSTALL.exe

IMPHASH 3cbd26f7129b578c97ad3b7168086223
SHA256 00ecf1661146d040dfe3348934e4eb557c333491b0ed68116d099fad585d5987
MD5 05f6a019fa155215e335bc66bf945d4b
SHA1 fc5d18728f354f79e855c263f292bd95f240c892
SHA512 5c566f7954f0ebf86daa1cf2a8e83929a103254856731e4620764568493e34eedbc2ce6276bdf90ccfa5e11d75473cf22e8b28352196c891489ce0a8c3e306dd
SSDEEP 6144:dN2pkbnH7MuaW2q2qaghYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1lt3:2pkbi5qjhZ3CmW9lsq+eYR
TLSH
T12EA46B1177C2C496F9791570C88A81F40155FC6CEBA156AFB1823F6E7AF23D2182BE4E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27677

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnterCriticalSection FindNextFileW GetCurrentProcess WriteFile TerminateProcess RemoveDirectoryW GetModuleFileNameW SetThreadUILanguage InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetTempPathW FindClose CreateFileW GetFileAttributesW SetFileAttributesW MultiByteToWideChar GetLastError DeleteFileW CloseHandle CreateThread GetProcAddress SetFilePointerEx GetFileSize DeleteCriticalSection GetModuleHandleW WideCharToMultiByte DecodePointer HeapReAlloc HeapSize FlushFileBuffers GetConsoleOutputCP GetStringTypeW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW WriteConsoleW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetThreadLocale FindFirstFileW ReadFile SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW GetStdHandle GetConsoleMode HeapAlloc HeapFree LCMapStringW

user32

GetMessageW DefWindowProcW DestroyWindow MessageBoxExW SendMessageW GetSystemMetrics RegisterClassExW ShowWindow DispatchMessageW TranslateMessage LoadIconW PostQuitMessage EnableWindow CreateWindowExW

gdi32

CreateSolidBrush CreateFontW

advapi32

RegDeleteKeyW

shell32

ShellExecuteW SHGetSpecialFolderPathW