UVKPortable[.]exe | Triage™

Resubmissions

11/10/2026, 11:20

261011-nfenvahw6z6

11/10/2026, 11:17

261011-ndtd8agg436

Sharing

Copy URL Twitter E-mail

General

Target
UVKPortable.exe
Size 27.8MB
Sample261011-ndtd8agg43
SHA256 429a79cf58fc2adf1c6f63c53a544f932f27d33da0ef6564d674a41a1f4aab27
MD5 28d01a0dcad49fba8f2ba04058650ff2
SHA1 ef78750e3ce817eedf0266a40c6c302fd3ab9da0
SHA512 195faaa21a4399f02214263ffd77bcb874b1f8bf5c94712ba0d7610a31d3c8b3d7a908c3b35d17c8d08f9af42baae87864d495b5381b5317c4aca30bafaf55bb
SSDEEP 786432:BL2opczjqcT/VOeYJyYhWi5dFyJbkYLqpDOjjpfRAwZRkL:BL2es/SyYhWi5dFy6YGlEpZng
TLSH
T15C573317B8831562C4B59137D63ABBCA330EA8760F321ACB57D0476B57315D21B3AAB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

UVKPortable.exe

.exe 27.8MB

UVKPortable.exe

IMPHASH a3cb16a6d1ba7808b89eb8d5b048fbc9
SHA256 429a79cf58fc2adf1c6f63c53a544f932f27d33da0ef6564d674a41a1f4aab27
MD5 28d01a0dcad49fba8f2ba04058650ff2
SHA1 ef78750e3ce817eedf0266a40c6c302fd3ab9da0
SHA512 195faaa21a4399f02214263ffd77bcb874b1f8bf5c94712ba0d7610a31d3c8b3d7a908c3b35d17c8d08f9af42baae87864d495b5381b5317c4aca30bafaf55bb
SSDEEP 786432:BL2opczjqcT/VOeYJyYhWi5dFyJbkYLqpDOjjpfRAwZRkL:BL2es/SyYhWi5dFy6YGlEpZng
TLSH
T15C573317B8831562C4B59137D63ABBCA330EA8760F321ACB57D0476B57315D21B3AAB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

4b:30:12:9f:46:5b:00:93:fd:e9:4a:fe:89:44:8b:1b:c0:67:fb:e3:f8:9a:4d:08:80:83:89:9f:ae:17:a5:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=789 849 163,CN=DA SILVA ALFREDO EI,O=DA SILVA ALFREDO EI,STREET=RES LES ANGELIQUES,L=Port-Vendres,ST=Occitanie,C=FR,1.2.840.113549.1.9.1=#0c11667265644063617269667265642e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024652,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 15, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

75:f9:07:29:20:8a:c5:f8:8d:8b:40:a1

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 10, 2025 - Jan 11, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

175913

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\VisualStudio\Projects\UVKPortable\Release\UVKPortable.pdb

kernel32

GetACP IsValidCodePage FindFirstFileExW HeapReAlloc HeapSize GetFileType GetStdHandle GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetProcessHeap HeapFree HeapAlloc EncodePointer OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter GetCPInfo GetCurrentProcessId LocalFileTimeToFileTime GetCurrentDirectoryW GetLongPathNameW EnumResourceNamesW K32GetModuleBaseNameW GetCommandLineW Thread32Next TerminateThread OpenThread Thread32First TerminateProcess K32EnumProcesses CreateToolhelp32Snapshot K32GetModuleFileNameExW GetOEMCP GetCommandLineA VerifyVersionInfoW VerSetConditionMask WritePrivateProfileStringW GetPrivateProfileStringW ExpandEnvironmentStringsW CreateDirectoryW CopyFileW SleepEx Sleep CloseHandle GetProcessId CreateProcessW ExitProcess SetFilePointer WriteFile SetFilePointerEx FileTimeToSystemTime RemoveDirectoryW MoveFileExW GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW SetErrorMode GetPrivateProfileIntW SystemTimeToFileTime QueryPerformanceCounter UnhandledExceptionFilter GetSystemTimeAsFileTime GetFileSizeEx SetFileTime GetFileAttributesW GetTempPathW GetSystemWindowsDirectoryW GlobalUnlock GlobalLock MulDiv lstrcmpW GetCurrentProcess GetCurrentThreadId ReadFile GetFileSize FreeLibrary lstrcmpiW GetModuleFileNameW WaitForSingleObject CreateThread SetFileAttributesW DeleteFileW CreateFileW LoadLibraryW LoadLibraryExW DecodePointer GetProcAddress GetModuleHandleW FindResourceW SizeofResource LockResource LoadResource DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx GetLastError RaiseException WideCharToMultiByte MultiByteToWideChar GlobalAlloc LocalAlloc LocalFree OpenProcess FindNextFileW FindClose FindFirstFileW LoadLibraryExA

user32

DestroyMenu TranslateAcceleratorW SetMenuDefaultItem LoadImageW DefDlgProcW GetMenuItemID FindWindowExW EndDeferWindowPos BeginDeferWindowPos GetSysColorBrush SetCursor SetWindowTextW PostMessageW SendMessageW GetWindowTextW GetWindowTextLengthW DestroyWindow CreateWindowExW GetWindowLongW SetWindowLongW TranslateMessage PeekMessageW UnregisterClassW DispatchMessageW GetMessageW CharNextW LoadStringW GetForegroundWindow RemoveMenu SetMenuItemInfoW GetMenuItemInfoW DeleteMenu MoveWindow SetWindowPos GetWindowRect GetClientRect ClientToScreen ScreenToClient MapWindowPoints BeginPaint EndPaint GetCursorPos WindowFromPoint EnumChildWindows DestroyIcon DrawIconEx GetSystemMetrics GetIconInfo GetDC GetWindowDC ReleaseDC UpdateWindow GetUpdateRect InvalidateRect InvalidateRgn ShowWindow IsWindowVisible GetDCEx RedrawWindow EnableWindow SetCapture SetFocus ChildWindowFromPoint GetWindow IsChild GetParent GetDlgItem IsDialogMessageW AdjustWindowRectEx GetWindowRgn SetWindowRgn DeferWindowPos GetWindowThreadProcessId IsWindow wsprintfW CallWindowProcW GetClassNameW GetSysColor DestroyAcceleratorTable GetFocus FillRect GetDesktopWindow CreateAcceleratorTableW ReleaseCapture DefWindowProcW RegisterWindowMessageW GetClassInfoExW LoadCursorW RegisterClassExW SystemParametersInfoW

gdi32

PatBlt SetBrushOrgEx SelectClipRgn ExcludeClipRect ExtSelectClipRgn OffsetRgn FillRgn CreateRoundRectRgn CombineRgn CreateRectRgn SetTextColor GetBkColor StretchBlt SetStretchBltMode GetDIBits SetBkMode SetBkColor CreateDIBSection CreateFontW CreatePatternBrush GetObjectW GetStockObject DeleteDC BitBlt CreateCompatibleDC CreateCompatibleBitmap CreateSolidBrush DeleteObject SelectObject GetDeviceCaps

advapi32

RegEnumValueW TreeResetNamedSecurityInfoW GetNamedSecurityInfoW CreateWellKnownSid ConvertStringSidToSidW SetNamedSecurityInfoW CryptDecrypt CryptDestroyKey CryptSetKeyParam CryptImportKey CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextW AdjustTokenPrivileges LookupPrivilegeValueW AddAce GetAce IsValidAcl InitializeAcl LookupAccountNameW OpenProcessToken SetSecurityDescriptorDacl SetSecurityDescriptorOwner InitializeSecurityDescriptor GetLengthSid IsValidSid RegQueryInfoKeyW RegSetKeySecurity RegSetValueExW RegQueryValueExW RegEnumKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

shell32

ord6 DragQueryPoint DragFinish Shell_NotifyIconW SHGetDesktopFolder FindExecutableW ExtractAssociatedIconW ord155 SHGetFolderPathW CommandLineToArgvW ord190 DragQueryFileW SHChangeNotify

ole32

CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc StringFromGUID2 OleUninitialize OleInitialize OleLockRunning CoGetClassObject CLSIDFromProgID CreateStreamOnHGlobal CLSIDFromString CoUninitialize CoInitialize

oleaut32

SysAllocString OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr SysAllocStringLen VariantClear VariantInit SysFreeString SysStringLen

shlwapi

PathIsRootW PathIsDirectoryW PathFileExistsW PathParseIconLocationW UrlCreateFromPathW AssocQueryStringW

version

VerQueryValueW GetFileVersionInfoW

gdiplus

GdiplusShutdown GdiplusStartup GdipGetImageWidth GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateFromHWND GdipCreateFromHDC GdipAddPathArc GdipAddPathLine GdipSaveImageToStream GdipSaveImageToFile GdipCloneImage GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipGetRegionHRgn GdipDeleteRegion GdipCreateRegionPath GdipDrawImageRectRectI GdipSetCompositingQuality GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipDrawImageI GdipDrawImageRect GdipCreateBitmapFromStream GdipFillPath GdipFillRectangleI GdipDrawPath GdipBitmapUnlockBits GdipBitmapLockBits GdipClosePathFigure GdipDeletePath GdipCreatePath GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipSetPenDashStyle GdipDeletePen GdipCreatePen1 GdipSetLineColors GdipCreateLineBrushFromRectI GdipDisposeImage GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipFree GdipGetImageEncoders GdipCreateHBITMAPFromBitmap GdipDrawImageRectI GdipDrawRectangleI GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetInterpolationMode GdipCreateBitmapFromFile GdipImageRotateFlip GdipDrawString GdipGetImageHeight GdipStartPathFigure

comctl32

ImageList_Create ord411 ord412 ord410 ord413 ImageList_Destroy ImageList_DrawEx ImageList_ReplaceIcon

wininet

InternetQueryDataAvailable HttpQueryInfoW InternetOpenUrlW InternetCloseHandle InternetConnectW InternetSetOptionW InternetOpenW InternetGetConnectedState InternetReadFile FtpGetFileSize FtpOpenFileW InternetCrackUrlW

Name

.text

Size

375KB

Virtual Size

375KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27.2MB

Virtual Size

27.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

UVKPortable.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

gdiplus

comctl32

wininet

generic