unins000[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
unins000.exe
Size 1.4MB
Sample260919-j3gdqsyscx
SHA256 2c50af4953cc33d3531b401e4c741bf8772dafbfdc67a36f2e69abdbd6d23f35
MD5 82c124955425da533efe53bc8c229d74
SHA1 b2ed55f840465c99af02b59b134ad0568145a38d
SHA512 a71a473a7dd461b3ab71808087268269df3a48ceecf2f20002d59e8a73607cb11558202bb9a3c75b3354b454b5e835ec6fe78e9ae83c66eb674d47d606293564
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKoexLxd:cIEJxCWluyZ8UbMlf
TLSH
T171654A12A2E24837E1733F359D2B82946D367D642E74988B3FB44E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unins000.exe

File Explorer

unins000.exe

.exe 1.4MB

unins000.exe

IMPHASH ab2499e0e72dfad09db9c131cd20670f
SHA256 2c50af4953cc33d3531b401e4c741bf8772dafbfdc67a36f2e69abdbd6d23f35
MD5 82c124955425da533efe53bc8c229d74
SHA1 b2ed55f840465c99af02b59b134ad0568145a38d
SHA512 a71a473a7dd461b3ab71808087268269df3a48ceecf2f20002d59e8a73607cb11558202bb9a3c75b3354b454b5e835ec6fe78e9ae83c66eb674d47d606293564
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKoexLxd:cIEJxCWluyZ8UbMlf
TLSH
T171654A12A2E24837E1733F359D2B82946D367D642E74988B3FB44E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1360020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen GetErrorInfo GetActiveObject RegisterTypeLib LoadTypeLib SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit SysFreeString

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey OpenThreadToken OpenProcessToken LookupPrivilegeValueW GetUserNameW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid AdjustTokenPrivileges

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage WaitForInputIdle UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRectEmpty SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClassLongW SetCapture SetActiveWindow SendNotifyMessageW SendMessageTimeoutW SendMessageA SendMessageW ScrollWindowEx ScrollWindow ScreenToClient ReplyMessage RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageA PeekMessageW OffsetRect OemToCharBuffA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MoveWindow MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDlgItem GetDlgCtrlID GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClientRect GetClassNameW GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect ExitWindowsEx EnumWindows EnumThreadWindows EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CreateAcceleratorTableW CopyIcon ClientToScreen ChildWindowFromPoint CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BringWindowToTop BeginPaint AppendMenuW CharToOemBuffA AdjustWindowRectEx ActivateKeyboardLayout

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte SetCurrentDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetCurrentDirectoryW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW lstrcmpW WriteProfileStringW WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualFree VirtualAlloc TransactNamedPipe TerminateProcess SwitchToThread SizeofResource SignalObjectAndWait SetThreadLocale SetNamedPipeHandleState SetLastError SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile SetCurrentDirectoryW ResumeThread ResetEvent RemoveDirectoryW ReleaseMutex ReadFile QueryPerformanceCounter OpenProcess OpenMutexW MultiByteToWideChar MulDiv MoveFileExW MoveFileW LockResource LocalFree LocalFileTimeToFileTime LoadResource LoadLibraryExW LoadLibraryW LeaveCriticalSection IsDBCSLeadByte IsBadWritePtr InitializeCriticalSection GlobalUnlock GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetWindowsDirectoryW GetVersionExW GetVersion GetUserDefaultLangID GetTickCount GetThreadLocale GetSystemTimeAsFileTime GetSystemInfo GetSystemDirectoryW GetStdHandle GetShortPathNameW GetProfileStringW GetProcAddress GetPrivateProfileStringW GetOverlappedResult GetModuleHandleW GetModuleFileNameW GetLogicalDrives GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileSize GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryW GetComputerNameW GetCommandLineW GetCPInfo FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushFileBuffers FindResourceW FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime EnumCalendarInfoW EnterCriticalSection DeviceIoControl DeleteFileW DeleteCriticalSection CreateThread CreateProcessW CreateNamedPipeW CreateMutexW CreateFileW CreateEventW CreateDirectoryW CopyFileW CompareStringW CompareFileTime CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetViewportOrgEx SetTextColor SetTextAlign SetStretchBltMode SetROP2 SetPixel SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC RemoveFontResourceW Rectangle RectVisible RealizePalette Polyline Pie PatBlt MoveToEx MaskBlt LineTo LineDDA IntersectClipRect GetWindowOrgEx GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontsW EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap Chord BitBlt Arc AddFontResourceW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

mpr

WNetOpenEnumW WNetGetUniversalNameW WNetGetConnectionW WNetEnumResourceW WNetCloseEnum

ole32

OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CLSIDFromString StringFromCLSID CoCreateInstance CoFreeUnusedLibraries CoUninitialize CoInitialize IsEqualGUID CoDisconnectObject

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_GetImageInfo ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Copy ImageList_LoadImageW ImageList_GetIcon ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_SetOverlayImage ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

shell32

ShellExecuteExW ShellExecuteW SHGetFileInfoW ExtractIconW SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHBrowseForFolderW

comdlg32

GetSaveFileNameW GetOpenFileNameW

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

unins000.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

mpr

ole32

comctl32

winspool.drv

shell32

comdlg32

generic