3uTools_v9[.]12[.]005_Setup_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3uTools_v9.12.005_Setup_x64.exe
Size 194.7MB
Sample261026-w15d1agw2m
SHA256 540caa5892e3302f38983d979bf95ec617a10cb838337bcd3f95b8fba4baaba0
MD5 00ec1f1bde64a555f88aadb30aa7ed43
SHA1 ef17c2cc1e350fe7bff2d87cabcf6dc378c48eff
SHA512 280f02af677a4bb83ee10cbd26459f7073db054a11598c0c15f10a7abc9decff229dc5ce77c8039abce9819f0671c7c30bb1b2f2ec2fd199717552dd7cfde7fd
SSDEEP 6291456:ZWtOofOVsAxYC5G21r1UsTA70MHoS1C86F:Zklh85G291LhMI586F
TLSH
T1B0A83313FF9650B5D4A2033253AB47BB0D3AEA214335F0D7AAD43E255D206D17A3A3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

3uTools_v9.12.005_Setup_x64.exe

.exe 194.7MB

3uTools_v9.12.005_Setup_x64.exe

IMPHASH c0f1e2e9b1706fc487fb310d00bed7d3
SHA256 540caa5892e3302f38983d979bf95ec617a10cb838337bcd3f95b8fba4baaba0
MD5 00ec1f1bde64a555f88aadb30aa7ed43
SHA1 ef17c2cc1e350fe7bff2d87cabcf6dc378c48eff
SHA512 280f02af677a4bb83ee10cbd26459f7073db054a11598c0c15f10a7abc9decff229dc5ce77c8039abce9819f0671c7c30bb1b2f2ec2fd199717552dd7cfde7fd
SSDEEP 6291456:ZWtOofOVsAxYC5G21r1UsTA70MHoS1C86F:Zklh85G291LhMI586F
TLSH
T1B0A83313FF9650B5D4A2033253AB47BB0D3AEA214335F0D7AAD43E255D206D17A3A3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

00:be:f4:1d:97:ae:fb:22:b7:af:5a:48:33:22:da:52:d8:97:72:50:c8:cd:3f:83:bb:60:f4:cd:69:56:c7:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Chains

Oct 23, 2026

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Digest

5b:09:0c:5c:db:dc:03:63:c2:46:32:25:3f:3c:58:4e:ba:5c:0b:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Chains

Oct 23, 2026

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=Shenzhen Aidapu Network Technology Co.\, Ltd.,O=Shenzhen Aidapu Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

31:1a:48:d9:7a:dc:17:ea:09:3c:e5:3d

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2025 - Dec 24, 2028

Minor OS version

Major OS version

Entry point

2312728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\pc\i4tools80\trunkcp\tools\setup\bin_3u\Installer.pdb

kernel32

DeleteFileA CreateSymbolicLinkW Module32FirstW GetTempPathW WritePrivateProfileStringW CopyFileW Sleep OutputDebugStringW CreateMutexW GetCommandLineW DeleteFileW RemoveDirectoryW GetPrivateProfileStringW GetEnvironmentVariableW FreeResource FindNextFileW FindClose FindFirstFileW GetTickCount CloseHandle GetDiskFreeSpaceExW CreateToolhelp32Snapshot Process32NextW GetSystemInfo DeviceIoControl LockResource Process32FirstW GetProcAddress SetLastError GetLastError lstrlenW MultiByteToWideChar CreateFileW GetModuleFileNameW TerminateProcess GetVersionExW SizeofResource WideCharToMultiByte OpenProcess WriteFile GetModuleHandleW WaitForSingleObject CreateDirectoryW GetLogicalDriveStringsW GetCurrentProcess LoadResource FindResourceW FindResourceExW GetDriveTypeW GetFullPathNameW SetEnvironmentVariableA CompareStringW SetEndOfFile WriteConsoleW CreateFileA GetFullPathNameA FlushFileBuffers SetStdHandle GetTimeZoneInformation IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetConsoleCP GetLocaleInfoW HeapCreate IsProcessorFeaturePresent SetHandleCount InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalFree FormatMessageW CompareFileTime SetFileAttributesW SetFileTime GetFileAttributesW MoveFileExW LocalFileTimeToFileTime VirtualAlloc VirtualFree DosDateTimeToFileTime FileTimeToDosDateTime GetSystemTimeAsFileTime FileTimeToLocalFileTime CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId WaitForMultipleObjects GetACP GlobalUnlock GlobalLock GlobalAlloc ReadFile GetFileSize GetCurrentDirectoryW LoadLibraryW ExitProcess MulDiv VerifyVersionInfoW VerSetConditionMask SetFilePointer SystemTimeToFileTime lstrcpyW lstrcmpiW lstrcpynW GetLocalTime FreeLibrary SleepEx PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA GetSystemTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedExchangeAdd DeleteFiber SwitchToFiber CreateFiber GetModuleHandleExW GetVersion ConvertFiberToThread ConvertThreadToFiber LoadLibraryA ExitThread CreateThread FindFirstFileExW FileTimeToSystemTime FindFirstFileExA GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo RtlUnwind LCMapStringW GetTimeFormatW GetDateFormatW GetFileInformationByHandle GetDriveTypeA GetFileAttributesA SetConsoleCtrlHandler UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetOEMCP IsValidCodePage

user32

SetRect CharNextW PtInRect IsRectEmpty DrawTextW GetKeyState SetWindowLongW GetWindowLongW InvalidateRect IsWindow SetCapture ReleaseCapture ScreenToClient GetWindowRect PostMessageW LoadImageW ReleaseDC GetDC GetCursorPos DestroyWindow IsZoomed SetFocus GetFocus CreateWindowExW MapWindowPoints GetSysColor GetMonitorInfoW MonitorFromWindow IsWindowVisible GetUpdateRect EndPaint BeginPaint GetWindow GetActiveWindow IsIconic GetParent DispatchMessageW TranslateMessage GetMessageW DefWindowProcW EnableWindow GetSystemMetrics CharPrevExA GetPropW SetPropW AdjustWindowRectEx GetMenu CharPrevW RegisterClassExW GetClassInfoExW SetWindowRgn GetWindowTextW GetWindowTextLengthW SetWindowTextW MonitorFromPoint GetWindowRgn UpdateLayeredWindow MessageBoxW CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos DestroyMenu TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime InvalidateRgn GetGUIThreadInfo CreateAcceleratorTableW UpdateWindow GetKeyNameTextW MapVirtualKeyExW GetKeyboardLayout SetForegroundWindow DrawTextA wsprintfA EqualRect GetUserObjectInformationW GetProcessWindowStation SendMessageW SetWindowPos MoveWindow wsprintfW GetClientRect KillTimer PostQuitMessage SetTimer ClientToScreen ShowWindow CharLowerBuffW FillRect IntersectRect LoadCursorW SetCursor UnionRect InflateRect RegisterClassW OffsetRect CallWindowProcW IsWindowEnabled

gdi32

GetStockObject GetObjectW CreateFontIndirectW PlayEnhMetaFile GdiFlush GetDeviceCaps GetTextExtentPointA SetBitmapBits GetBitmapBits CreateRectRgn PtInRegion CreatePatternBrush SaveDC RemoveFontMemResourceEx RestoreDC Rectangle DeleteObject CreateEnhMetaFileW CloseEnhMetaFile GetTextMetricsW GetObjectA SetBkMode SetTextColor SetBkColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW CreatePenIndirect MoveToEx SelectClipRgn LineTo CreateCompatibleBitmap CreateSolidBrush SetStretchBltMode CreateCompatibleDC CreateDIBSection SelectObject StretchBlt BitBlt DeleteDC CreateRoundRectRgn AddFontMemResourceEx CreatePen CreateDIBitmap SetWindowOrgEx CombineRgn GetClipBox CreateRectRgnIndirect ExtSelectClipRgn GetEnhMetaFileHeader

advapi32

OpenProcessToken CryptSignHashW CryptSetHashParam CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptDestroyKey RegCreateKeyW AdjustTokenPrivileges LookupPrivilegeValueW RegSetValueExW RegCloseKey ControlService RegOpenKeyExW RegQueryValueExW RegCreateKeyExW OpenServiceW OpenSCManagerW CloseServiceHandle CryptEnumProvidersW RegisterEventSourceW ReportEventW DeregisterEventSource CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptDestroyHash

shell32

DragQueryFileW CommandLineToArgvW SHGetSpecialFolderPathW ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW SHFileOperationW

ole32

CLSIDFromString CLSIDFromProgID ReleaseStgMedium OleDuplicateData DoDragDrop CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoUninitialize CoInitializeEx CoInitialize CoTaskMemFree OleInitialize OleUninitialize OleLockRunning

oleaut32

VariantClear SysFreeString SysStringLen SysAllocString VariantCopy SysAllocStringLen VariantInit

shlwapi

SHCreateStreamOnFileEx PathRemoveFileSpecW PathAddBackslashW PathCombineW SHDeleteKeyW PathFindFileNameW PathFileExistsW

wininet

InternetConnectW HttpSendRequestW HttpOpenRequestW InternetOpenW

ws2_32

gethostbyname gethostname WSAStartup closesocket getnameinfo shutdown ioctlsocket htonl getaddrinfo freeaddrinfo __WSAFDIsSet select send WSAGetLastError WSACleanup listen accept WSACreateEvent WSAEventSelect WSACloseEvent WSAEnumNetworkEvents recvfrom sendto WSASetLastError recv WSAIoctl setsockopt ntohs bind htons getsockopt getpeername socket connect getsockname

wldap32

ord14 ord219 ord145 ord133 ord127 ord147 ord208 ord26 ord117 ord142 ord79 ord167 ord216 ord46 ord41 ord27 ord301

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

gdiplus

GdipDeleteBrush GdipCreatePen1 GdipDeletePen GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCreatePath GdipDeletePath GdipDeleteGraphics GdipDeleteFont GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipDisposeImage GdipCreateSolidFill GdipSetPenMode GdipSetStringFormatFlags GdipAlloc GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipAddPathLine ord1 GdipCreateFromHDC GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetSmoothingMode GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipFillPath GdipDrawString GdipMeasureString GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipCloneBrush GdipCloneImage GdiplusStartup GdiplusShutdown GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawImageRectI GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipFree GdipSetStringFormatAlign

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

crypt32

CertCloseStore CertFreeCertificateContext CertGetIntendedKeyUsage CertEnumCertificatesInStore CertOpenSystemStoreW CertGetCertificateContextProperty CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetEnhancedKeyUsage

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

611KB

Virtual Size

611KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

17B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

191.1MB

Virtual Size

191.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3uTools_v9.12.005_Setup_x64.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

ws2_32

wldap32

comctl32

gdiplus

imm32

crypt32

generic