Unishade-Setup-0[.]6[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Unishade-Setup-0.6.1.exe
Size 2.5MB
Sample261004-2ynlcssx7n
SHA256 df9b0867902de51de926454726f8568f30fab4f6bfc45d2d77ad6138438c3154
MD5 7a86f11caad0d295859ebb57849f4dd7
SHA1 e88ae6328b6b13d49195c0a521f04c6576f9ad4d
SHA512 005dd87589f237ec307a90ca81a45b442de2dd3db1aae9038a52d5940e8f895393213a1435412a088ca58836178514c544e3074c6910d0b232d11a625141bb24
SSDEEP 49152:fzCv5KS26P5HQgJKHEn3VXKGGAn8BR9Za6ZKvuDKjc:uhKih6qXZrS
TLSH
T1BFC5AE1AA2A402FCE0B7D1B9CE969907EB72784A07709ADF07D056551F636E09F7E303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Unishade-Setup-0.6.1.exe

File Explorer

Unishade-Setup-0.6.1.exe

.exe 2.5MB

Unishade-Setup-0.6.1.exe

IMPHASH 8927769fa536bfe85cb2fa149c032248
SHA256 df9b0867902de51de926454726f8568f30fab4f6bfc45d2d77ad6138438c3154
MD5 7a86f11caad0d295859ebb57849f4dd7
SHA1 e88ae6328b6b13d49195c0a521f04c6576f9ad4d
SHA512 005dd87589f237ec307a90ca81a45b442de2dd3db1aae9038a52d5940e8f895393213a1435412a088ca58836178514c544e3074c6910d0b232d11a625141bb24
SSDEEP 49152:fzCv5KS26P5HQgJKHEn3VXKGGAn8BR9Za6ZKvuDKjc:uhKih6qXZrS
TLSH
T1BFC5AE1AA2A402FCE0B7D1B9CE969907EB72784A07709ADF07D056551F636E09F7E303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

621560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

kernel32

TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetLocalTime GetTickCount64 GetSystemDirectoryW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW FormatMessageW QueryFullProcessImageNameW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionNamesW MoveFileExW ReadFile OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency GetProcAddress GetLocaleInfoA IsDBCSLeadByte RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount WaitForSingleObject GetLastError CreateDirectoryW SetEnvironmentVariableW WideCharToMultiByte SetLastError RtlUnwindEx RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter MultiByteToWideChar LocalFree SetDefaultDllDirectories LoadLibraryExW GetModuleHandleW GetWindowsDirectoryW GetCurrentProcessId CloseHandle CreateFileW GetCommandLineW GetCurrentProcess WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI CopyFileW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter RtlUnwind

user32

TranslateMessage DispatchMessageW PeekMessageW WaitMessage LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetWindowThreadProcessId FindWindowExW PostMessageW SetProcessDpiAwarenessContext GetDpiForWindow GetMonitorInfoW MonitorFromWindow LoadIconW LoadCursorW MessageBoxW AdjustWindowRectExForDpi MsgWaitForMultipleObjects GetKeyState CharLowerBuffW IsIconic SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW

gdi32

CreateSolidBrush

shell32

ShellExecuteW SHCreateItemFromParsingName SHGetKnownFolderPath CommandLineToArgvW

ole32

CoInitializeEx CoCreateInstance CoTaskMemFree CoUninitialize

advapi32

ConvertSidToStringSidW OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExW RegGetValueW RegDeleteTreeW RegDeleteKeyValueW

Name

.text

Size

793KB

Virtual Size

792KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

207KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Unishade-Setup-0.6.1.exe

imm32

kernel32

user32

gdi32

shell32

ole32

advapi32

generic