hwid_ui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hwid_ui.exe
Size 531KB
Sample261027-24ekmsgw6t
SHA256 fa47f2c0612d0c05db6b599211b3e1c9d6ffcad4111d6da3f85800a4ef9fca7a
MD5 918fc646181658f5293564e98fe18597
SHA1 20395eec109d0a5be9b8524a85fb8cca07eba5b5
SHA512 2489fb433809d4a7935d678fc366d5831de16ac31a510c26ee73d510ecfe6ef1f62fc09d967011530ee2ee3f5e4fe837526af08517578a7d88449db26b7cdb44
SSDEEP 6144:DVUQbSlMpOTakBjtE0mO3ml4Lr52YMdRzH1kUpJhx9Hkx1WlDYiRdP05gu:WLBKuVUh1RJzRawtYiRdP
TLSH
T14FC47D66A7A403F8E1B7D178CEA24902E771784A07B19ADF03A049765F277E14E3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hwid_ui.exe

File Explorer

hwid_ui.exe

.exe 531KB

hwid_ui.exe

IMPHASH 3597ae61bdddd6e70c34996e7759e81a
SHA256 fa47f2c0612d0c05db6b599211b3e1c9d6ffcad4111d6da3f85800a4ef9fca7a
MD5 918fc646181658f5293564e98fe18597
SHA1 20395eec109d0a5be9b8524a85fb8cca07eba5b5
SHA512 2489fb433809d4a7935d678fc366d5831de16ac31a510c26ee73d510ecfe6ef1f62fc09d967011530ee2ee3f5e4fe837526af08517578a7d88449db26b7cdb44
SSDEEP 6144:DVUQbSlMpOTakBjtE0mO3ml4Lr52YMdRzH1kUpJhx9Hkx1WlDYiRdP05gu:WLBKuVUh1RJzRawtYiRdP
TLSH
T14FC47D66A7A403F8E1B7D178CEA24902E771784A07B19ADF03A049765F277E14E3F712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

173096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA CryptAcquireContextA CryptReleaseContext CryptGenRandom RegCreateKeyW RegOpenKeyW RegSetKeyValueW RegDeleteTreeW

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

shlwapi

PathFileExistsA

user32

GetMessageA TranslateMessage DispatchMessageA LoadCursorA FrameRect FillRect DrawFocusRect SetCursor MessageBoxA GetWindowTextA SendMessageA UpdateWindow DrawTextA GetDlgCtrlID MoveWindow ShowWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA SetWindowTextA

gdi32

CreateSolidBrush DeleteObject SetTextColor SetBkMode SetBkColor GetTextExtentPoint32A CreateFontA

comctl32

InitCommonControlsEx

iphlpapi

GetAdaptersInfo

ntdll

NtQuerySystemInformation RtlAdjustPrivilege RtlInitUnicodeString NtLoadDriver NtUnloadDriver RtlPcToFileHeader RtlUnwindEx RtlUnwind

oleaut32

SysFreeString VariantClear VariantInit SysAllocString

kernel32

GetACP IsValidCodePage GetOEMCP FindFirstFileExW FindClose HeapReAlloc CreatePipe GetFileAttributesExW GetExitCodeProcess WaitForSingleObject ReadConsoleW GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile FindNextFileW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree CreateDirectoryA CreateFileA SetFilePointerEx WriteFile GetVolumeInformationA CloseHandle GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource FindResourceA WideCharToMultiByte CreateFileW DeviceIoControl GetCurrentProcessId GetCurrentThreadId VirtualAlloc VirtualFree GetTempPathW GetModuleFileNameW GetLastError MultiByteToWideChar LocalFree GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetStdHandle GetModuleHandleExW ExitProcess RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW DuplicateHandle CreateProcessW DeleteFileW

Name

.text

Size

344KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hwid_ui.exe

advapi32

ole32

rpcrt4

shlwapi

user32

gdi32

comctl32

iphlpapi

ntdll

oleaut32

kernel32

generic