us0vifc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
us0vifc.exe
Size 5.0MB
Sample261023-1st1hsd16w
SHA256 833942236c5e05c8d4510a0c7ae59c5f38e90fb73231b9a4878a293416421076
MD5 c43542c1df42040c8dea31fb639c95d4
SHA1 c8a02923634d80e9dcef61203fb9821716ead292
SHA512 871598e84940c398c59662eb35a1c892a3daf14a00f4e06f2288924aca25c00e0adfec944424563442c08211d883adb201c4778377b92a5414c1b1d98f9db6c7
SSDEEP 49152:aEV4y3VkT8+HE1uxuMvAKrTZrNyA+2dWhT8p5QE4y3VkT8+HE3uxuMvAKrTZrNyN:ZjVmxdAGTZ3bbjVMxdAGTZ3bvA
TLSH
T13536E149D18B8B28EF622F3848549373C1F17CC987F1D3D3AE9E8D749A678B8596C640
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
us0vifc.exe

File Explorer

us0vifc.exe

.exe 5.0MB

us0vifc.exe

IMPHASH 25b2ef63c05bb489f3ff6c2e1ae92dc2
SHA256 833942236c5e05c8d4510a0c7ae59c5f38e90fb73231b9a4878a293416421076
MD5 c43542c1df42040c8dea31fb639c95d4
SHA1 c8a02923634d80e9dcef61203fb9821716ead292
SHA512 871598e84940c398c59662eb35a1c892a3daf14a00f4e06f2288924aca25c00e0adfec944424563442c08211d883adb201c4778377b92a5414c1b1d98f9db6c7
SSDEEP 49152:aEV4y3VkT8+HE1uxuMvAKrTZrNyA+2dWhT8p5QE4y3VkT8+HE3uxuMvAKrTZrNyN:ZjVmxdAGTZ3bbjVMxdAGTZ3bvA
TLSH
T13536E149D18B8B28EF622F3848549373C1F17CC987F1D3D3AE9E8D749A678B8596C640
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

329456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\South\South\x64\Release\us0vifc.pdb

ntdll

NtQuerySystemInformation NtUnloadDriver NtLoadDriver RtlAdjustPrivilege RtlInitUnicodeString

kernel32

GetCurrentThreadId GetModuleHandleA GetCurrentProcessId GetTempPathW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary GetLastError AreFileApisANSI CreateFile2 SetFileInformationByHandle VirtualAlloc GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable CloseHandle LoadLibraryA CreateFileW DeviceIoControl VirtualFree GetProcAddress CreateProcessA SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetTempPathA WaitForSingleObject GetTickCount Sleep GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive InitializeSListHead

user32

UpdateWindow IsIconic RegisterClassExA PostQuitMessage TranslateMessage GetClientRect GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout IsWindowUnicode SetCursor SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SendMessageA ReleaseCapture SetWindowRgn GetSystemMetrics ShowWindow SetCapture DispatchMessageW PeekMessageW GetForegroundWindow CreateWindowExA DefWindowProcA LoadCursorW MessageBoxA

gdi32

CreateRoundRectRgn

advapi32

RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegOpenKeyW AllocateAndInitializeSid FreeSid CheckTokenMembership RegCloseKey

ole32

CoCreateInstance CoInitialize

msvcp140

_Thrd_yield _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __std_terminate wcsstr strstr memchr __std_exception_destroy __std_exception_copy __current_exception_context __current_exception _CxxThrowException __C_specific_handler memset memmove memcpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _initterm __p___argc _get_initial_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _initialize_narrow_environment _set_app_type _configure_narrow_argv _seh_filter_exe abort _cexit _crt_atexit _beginthreadex __p___argv _register_onexit_function terminate

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-stdio-l1-1-0

ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc _set_fmode setvbuf fgetpos fwrite fgetc fclose fflush fputc fseek __stdio_common_vfprintf _wfopen __stdio_common_vsprintf __stdio_common_vsscanf __p__commode __acrt_iob_func

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _wremove _lock_file

api-ms-win-crt-string-l1-1-0

strcmp strlen strncmp strncpy wcslen _stricmp

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

powf acosf ceilf fmodf cosf sinf __setusermatherr sqrtf