UR3[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UR3.exe
Size 3.2MB
Sample260924-da3hlsybje
SHA256 f902b2672a05e01a910ffe9f76a20ed87eb009c2655dc685ee6608bb56d321e9
MD5 c7eb503a8f555149d67cac3b03609da8
SHA1 6f0e8d7729961efe19f19a9b74b35ff6e44a4f18
SHA512 25eb5f93c1cf6a1404467e5c094c1bf98dd752366e441e04cdc0e8425103142e1bb02e6c557b8bb62df0fb31bf173543b47cf88bd9f0c8df5c4b9dd13ea88a50
SSDEEP 49152:6Bq+p99rLq7x9StOB8OFx/3dDKQ83/EndpKjT:6X3hmvvdDKQ83/mC3
TLSH
T107F58E13B384657EE05F1A361963B6649C3B7650662A9D0FE7F10D8C8F253803E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UR3.exe

File Explorer

UR3.exe

.exe 3.2MB

UR3.exe

IMPHASH cd0ef78c99733c5ed97ed0f267505821
SHA256 f902b2672a05e01a910ffe9f76a20ed87eb009c2655dc685ee6608bb56d321e9
MD5 c7eb503a8f555149d67cac3b03609da8
SHA1 6f0e8d7729961efe19f19a9b74b35ff6e44a4f18
SHA512 25eb5f93c1cf6a1404467e5c094c1bf98dd752366e441e04cdc0e8425103142e1bb02e6c557b8bb62df0fb31bf173543b47cf88bd9f0c8df5c4b9dd13ea88a50
SSDEEP 49152:6Bq+p99rLq7x9StOB8OFx/3dDKQ83/EndpKjT:6X3hmvvdDKQ83/mC3
TLSH
T107F58E13B384657EE05F1A361963B6649C3B7650662A9D0FE7F10D8C8F253803E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2638848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

GetSaveFileNameW GetOpenFileNameW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

Shell_NotifyIconW SHAppBarMessage

user32

MoveWindow CopyImage SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA EnumWindows ShowOwnedPopups GetClassInfoExW GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild IsIconic CallNextHookEx ShowWindow GetWindowTextW SetForegroundWindow GetAsyncKeyState IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC mouse_event GetClassLongW SetScrollRange DrawTextW PeekMessageA MessageBeep SetClassLongW RemovePropW GetSubMenu DestroyIcon IsWindowVisible PtInRect DispatchMessageA UnregisterClassW GetTopWindow SendMessageW GetComboBoxInfo LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState IsRectEmpty ValidateRect GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement GetMenuItemRect CreateIconIndirect CreateWindowExW GetDCEx PeekMessageW MonitorFromWindow GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW SetClipboardData GetClipboardData ClientToScreen SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW EmptyClipboard GetDlgItem AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect GetKeyboardState ScreenToClient DrawFrameControl SetCursor CreateIcon RemoveMenu GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CloseClipboard DestroyCursor CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect GetWindowLongW InsertMenuW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SysFreeString VariantClear VariantInit GetErrorInfo SysReAllocStringLen SafeArrayCreate SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy VariantChangeType

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

msvcrt

memcpy memset

kernel32

GetACP CloseHandle LocalFree GetCurrentProcessId SizeofResource QueryPerformanceFrequency IsDebuggerPresent VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent MulDiv FreeResource GetVersion RaiseException GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount WritePrivateProfileStringW GetStartupInfoW GlobalDeleteAtom GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock VirtualAlloc GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW EnumResourceNamesW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx SetThreadLocale GetThreadLocale

ole32

IsEqualGUID OleInitialize OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

gdi32

Pie SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader RectVisible AngleArc ResizePalette SetAbortProc SetTextColor GetTextColor StretchBlt RoundRect SelectClipRgn RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette CreateDCW PolyBezierTo CreateICW GetStockObject CreateSolidBrush GetBkMode Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits GetEnhMetaFilePaletteEntries CreatePenIndirect CreateFontIndirectW PolyBezier EndDoc GetObjectW GetCurrentObject GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo Arc SelectPalette SetGraphicsMode ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits GetViewportOrgEx SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits Rectangle SaveDC DeleteDC BitBlt SetWorldTransform FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap CombineRgn SetWinMetaFileBits GetStretchBltMode CreateDIBitmap SetStretchBltMode GetDIBits CreateDIBSection ExtCreateRegion LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx SetDCPenColor GetNearestPaletteIndex CreateRoundRectRgn GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

106KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

84B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

419KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

UR3.exe

winspool.drv

comdlg32

comctl32

shell32

user32

version

oleaut32

advapi32

msvcrt

kernel32

ole32

gdi32

generic