4w0qngos[.]uzm[.]exe

General

Target
4w0qngos.uzm.exe
Size 497KB
Sample260826-bb1pasfp7t
SHA256 54e11a54a043486f84c9ae368181b7b6a5092468f1c298c600eebcdd9ae526cf
MD5 595ebb88e54c241bd229142c81cfed0c
SHA1 92271f783cd5280ff55d4f490bdbbf98f1d9309b
SHA512 b43a24d3dad314f034fd3d40037b36c68f3af4167fe38b480bbd7196921b7d827c7f5918af217551f158aee7f46f1e8367da4809582dbdd48cdec62c58caa15d
SSDEEP 6144:dnJh5OBwtdYzyKIoMC2smTcyQ/N2jsHlDENKw3Q9DBpTBoi6Ta/VkLQ/zbyPE:HvOUebMXTCQQDgMBN6TQKLQny
TLSH
T163B4F16AF7AA03FCD836C1FC89058A41AAF2BC016B5546FF139445471F63BD44E7ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4w0qngos.uzm.exe

File Explorer

4w0qngos.uzm.exe

.exe 497KB

4w0qngos.uzm.exe

IMPHASH bbf11a6d9f7e9f589e4cb7176d8055f0
SHA256 54e11a54a043486f84c9ae368181b7b6a5092468f1c298c600eebcdd9ae526cf
MD5 595ebb88e54c241bd229142c81cfed0c
SHA1 92271f783cd5280ff55d4f490bdbbf98f1d9309b
SHA512 b43a24d3dad314f034fd3d40037b36c68f3af4167fe38b480bbd7196921b7d827c7f5918af217551f158aee7f46f1e8367da4809582dbdd48cdec62c58caa15d
SSDEEP 6144:dnJh5OBwtdYzyKIoMC2smTcyQ/N2jsHlDENKw3Q9DBpTBoi6Ta/VkLQ/zbyPE:HvOUebMXTCQQDgMBN6TQKLQny
TLSH
T163B4F16AF7AA03FCD836C1FC89058A41AAF2BC016B5546FF139445471F63BD44E7ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

48800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

uiengly.pdb

kernel32

WaitForSingleObject GetFullPathNameW GetProcessHeap HeapReAlloc GetStringTypeW CompareStringW SetFilePointerEx LCMapStringW MultiByteToWideChar TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive GetFileInformationByHandle GetFileInformationByHandleEx SetFileInformationByHandle HeapAlloc HeapFree SetLastError IsValidCodePage WriteConsoleW LoadLibraryA GetWindowsDirectoryW GetCurrentDirectoryW FlushFileBuffers GetConsoleCP GetConsoleOutputCP GetFileType GetConsoleWindow GetCurrentThread GetSystemDirectoryW GetTempPathW HeapSize GetSystemWindowsDirectoryW VirtualProtect InitializeCriticalSectionEx FlsFree CloseHandle GetLastError SetFileTime CreateFileW GetModuleHandleA IsDBCSLeadByte GetProcAddress QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlsAlloc FlsGetValue FlsSetValue WriteFile

user32

GetShellWindow GetSysColor GetSystemMetrics GetCaretBlinkTime GetForegroundWindow GetFocus GetDesktopWindow GetMessageExtraInfo

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile RtlGetVersion

winmm

midiInGetNumDevs timeGetTime waveOutGetNumDevs waveInGetNumDevs midiOutGetNumDevs mixerGetNumDevs

Sharing