uninstaller[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
uninstaller.exe
Size 515KB
Sample261026-vxb3lsvs8n
SHA256 70e04b72dd8ebd15f8225d48a431556adf522dac433a173b170aa9d671e8c536
MD5 7ff8bd5e26ad37ab386910bb00420933
SHA1 e6418705b887f7298d3d2d2e91845cdda085d596
SHA512 eb0d3d805ec9e0395615266217f8c0ed3dddb695f39b750aef9931dc7719fe0306b0a8c0581ee727037e066ee4e121aec23f4adb841df1c54f8b1c04abb87a77
SSDEEP 6144:QsYxx0nC+GYDXRoNF/6IRcV0BG9wL5u1/jrURjhIr3hqmPPDPJHT04nnBwtTTfAa:Qg9GY1oNF5m7rUZhIrhi
TLSH
T13DB42A0277E89DE6DC62613C919BA319AB36BCB0579797CB431006216E07BE8CD6FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
uninstaller.exe

File Explorer

uninstaller.exe

.exe 515KB

uninstaller.exe

IMPHASH d1f37e9451f414418a1ab33bd7264233
SHA256 70e04b72dd8ebd15f8225d48a431556adf522dac433a173b170aa9d671e8c536
MD5 7ff8bd5e26ad37ab386910bb00420933
SHA1 e6418705b887f7298d3d2d2e91845cdda085d596
SHA512 eb0d3d805ec9e0395615266217f8c0ed3dddb695f39b750aef9931dc7719fe0306b0a8c0581ee727037e066ee4e121aec23f4adb841df1c54f8b1c04abb87a77
SSDEEP 6144:QsYxx0nC+GYDXRoNF/6IRcV0BG9wL5u1/jrURjhIr3hqmPPDPJHT04nnBwtTTfAa:Qg9GY1oNF5m7rUZhIrhi
TLSH
T13DB42A0277E89DE6DC62613C919BA319AB36BCB0579797CB431006216E07BE8CD6FF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership CloseServiceHandle CreateProcessWithTokenW DuplicateTokenEx FreeSid ImpersonateLoggedOnUser LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegSetValueExW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW StartServiceW

shell32

CommandLineToArgvW ShellExecuteExW

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket IIDFromString

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove wcsstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fflush fputc fwrite

api-ms-win-crt-string-l1-1-0

_wcsicmp memset strcmp strlen strncmp wcscmp wcslen wcsncpy

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-convert-l1-1-0

atoi strtof

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW CreatePipe CreateProcessW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW FreeConsole FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableW GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemDirectoryW GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW RaiseException ReadFile ReadProcessMemory ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileAttributesW SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

Name

.text

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/30

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/42

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/53

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

uninstaller.exe

advapi32

shell32

ole32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic