General

  • Target
    utweb_installer.exe
  • Size 20.6MB
  • Sample261002-n2dzfazdrc
  • SHA256 15b2122dd721d0a8e9056ed6d5c8ba88a5d15703caf6a273608e22e8568a5b72
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 3 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • utweb_installer.exe
    .exe 20.6MB
  • $PLUGINSDIR/FindProcDLL.dll
    .dll 3KB
  • $PLUGINSDIR/INetC.dll
    .dll 24KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/UAC.dll
    .dll 14KB
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $PLUGINSDIR/nsisFirewall.dll
    .dll 8KB
  • $TEMP/ut_web_redist/vcredist_x86.exe
    .exe 13.1MB
  • Uninstall.exe
    .exe 258KB
  • avcodec-58.dll
    .dll 1.4MB
  • avfilter-7.dll
    .dll 150KB
  • avformat-58.dll
    .dll 927KB
  • avutil-56.dll
    .dll 620KB
  • crashpad_handler.exe
    .exe 874KB
  • libcrypto-1_1.dll
    .dll 2.4MB
  • libssl-1_1.dll
    .dll 525KB
  • localization/de.lang
    1KB
  • localization/es-la.lang
    1KB
  • localization/fr.lang
    1KB
  • localization/it.lang
    1KB
  • localization/ja.lang
    1KB
  • localization/ko.lang
    1KB
  • localization/nl.lang
    1KB
  • localization/pl.lang
    1KB
  • localization/pt-br.lang
    1KB
  • localization/pt.lang
    1KB
  • localization/ru.lang
    1KB
  • localization/tr.lang
    1KB
  • localization/zh-cn.lang
    897B
  • localization/zh-tw.lang
    931B
  • main.ico
    43KB
  • swresample-3.dll
    .dll 149KB
  • swscale-5.dll
    .dll 597KB
  • uninstall.ico
    39KB
  • utweb.exe
    .exe 9.1MB
  • webui.zip
    .zip 4.1MB
  • bundle.js
    .js 13.0MB
  • fonts/LibreFranklin-Bold.ttf
    75KB
  • fonts/LibreFranklin-Light.ttf
    71KB
  • fonts/LibreFranklin-Regular.ttf
    73KB
  • fonts/LibreFranklin-SemiBold.ttf
    74KB
  • index.html
    .html .js 2KB
  • noauth.html
    .html 29KB
  • old-version.html
    .html .js 12KB
  • search_redirect.html
    .html .js 12KB
  • share.html
    .html .js 22KB
  • static/imgs/browser/chrome.png
    .png 11KB
  • static/imgs/browser/edge.png
    .png 11KB
  • static/imgs/browser/firefox.png
    .png 14KB
  • static/imgs/browser/opera.png
    .png 5KB
  • static/imgs/bt-favicon.ico
    4KB
  • static/imgs/fallback-image.png
    .png 38KB
  • static/imgs/local/beginner.png
    .png 62KB
  • static/imgs/local/step1.png
    .png 137KB
  • static/imgs/local/step2.png
    .png 303KB
  • static/imgs/local/step3.png
    .png 38KB
  • static/imgs/local/step4.png
    .png 92KB
  • static/imgs/local/ut-beginner.png
    .png 100KB
  • static/imgs/local/ut-step3.png
    .png 55KB
  • static/imgs/ut-favicon.ico
    4KB
  • static/js/_g_a_.min.js
    .js 29KB
  • static/js/_gtag.min.js
    .js 204KB
  • static/js/base64.js
    .js 3KB
  • static/js/start.js
    .js 11KB
  • styles.css
    813KB
  • unsupported-browser.html
    .html 11KB
  • webui/version.txt
    35B

utweb_installer.exe

  • IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
  • SHA256 15b2122dd721d0a8e9056ed6d5c8ba88a5d15703caf6a273608e22e8568a5b72
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest
5c:66:ba:a2:8b:68:f9:52:56:4f:a6:04:c7:57:07:dc:32:32:f4:8c:63:d9:b0:c1:f6:6b:d5:26:5f:a3:ba:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=74291421,CN=RainCo HK Limited,O=RainCo HK Limited,L=Kwun Tong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b
Chains

Jan 1, 0001

Minor OS version
0
Major OS version
4
Entry point
13559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths