Setup.-.UniShade.zip
- SHA256 7ef3622266a02abc66c93f6b801a3376a0711a7619e1fce9a56a3c9e7cf1ad21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Setup.-.UniShade.zip
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
26 signatures
900 seconds
General
- Target Setup.-.UniShade.zip
- Size 116.1MB
- Sample261029-2e7vwsft4y
- SHA256 7ef3622266a02abc66c93f6b801a3376a0711a7619e1fce9a56a3c9e7cf1ad21
- MD5 b976b932a70ce4936986ff644a3fa570
- SHA1 22b859f7cba5071c491730227e96bcafa2814372
- SHA512 f1f82dce9efde5caeee332c88d5d28ac8b04737afb58b25b9ee9d084ae84830fdba86f3161a6047bd184cbb496874bf288ae723b24a9b79f6dc06b23d6aca40d
- SSDEEP 1572864:odMIsSg2GNlLDxnzrFlkM10HkswQq6yw9zlO3L3z1WGOkSeYuKEgD9BFJNXPDk2M:odCjHt/FiLExwoDzErml0DFPghR
- TLSH T1D34833CA2AEEAAAD4E3C0A369F5BFB24938F1741481DF0313D5E8B55DAC6173415E40E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RobloxCrashHandler.exe unpack001/UniShade - Setup.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/RobloxCrashHandler1.exe
File Explorer
-
Setup.-.UniShade.zip.zip 116.1MB
-
RobloxCrashHandler.exe.exe 10KB
-
RobloxCrashHandler1.exe.exe 12.2MB
-
UniShade - Setup.exe.exe 111.3MB
RobloxCrashHandler.exe
- IMPHASH f5f524c7c061d81570ee15b4dbecbb73
- SHA256 7c99b7fa27a246bca904ae27f9fe586f1a7f4256aa335f67ae813b43354e697e
- MD5 c571e527eecb82c1a852b977904d3452
- SHA1 8f6d4f035f242af9e9902f815608c7d4abf8e162
- SHA512 790cb495791de4f5ed64721b71f41faa7c595a8d78f539529df0c9cf03d5dd058f3f5552b1c61b8458593fea7ba4ed2fcefa9634fc13ffdaca2836819fb05858
- SSDEEP 96:mH5lX+vc3QhBlQgGhVjZ5I4g+tQQOpcnI1nrxm7ER5tfPYYw5x:U5ElY3rg+KQmcnI1nwO5tfAY
- TLSH T16222FA4DFEA44DEFE51843BAC83B064DA0B2F7166B5283CB135091162E273E1A5716CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4904
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\yahiya\Desktop\idkkkk\x64\Release\idkkkk.pdb
kernel32
ExpandEnvironmentStringsW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
user32
MessageBoxW
shell32
ShellExecuteW
vcruntime140
__current_exception
memset
__C_specific_handler
__current_exception_context
memcpy
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_initterm_e
_initialize_onexit_table
_c_exit
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35403,
count=3, id=259, version=35403,
count=10, id=260, version=35403,
count=19, id=261, version=35403,
count=7, id=257, version=33145,
count=43, id=1, productName=Unmarked objects,
count=1, id=265, version=35721,
count=1, id=255, version=35721,
count=1, id=258, version=35721,
RobloxCrashHandler1.exe
- IMPHASH a2289e691eab5cbd786e6a52f3129ca0
- SHA256 adb3eb289d5f4362b43f37a536571c8ef0a150aaa316b2e9697ec77e4f419453
- MD5 0e83cb8db8fb11f1d6fb4c8c0d85997e
- SHA1 ecfd9e51c2d7b269df919e85d9e2fec1a3d56b41
- SHA512 e468b3c3613c9778ee2ccddaa7b0d2afd58d87fe993e5582af2bc717a48f5c6754ee9fa28a5c08a2011fcd7fcf1df1ce22a9d385f44969a149f1cf27908ddb94
- SSDEEP 196608:uGTCNoiBH4OmFUOBruPGJau8NmX92tP9x1W:v+NoiBH4OmFUbs98kX9iPY
- TLSH T114D69E6AB2BC00E8D47BD17CC6569617E7B1741513706BDF16A48ABA2F63BE01E3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
6e:ce:0f:9f:fa:69:91:2f:8b:63:29:4a:a9:38:72:fa:5a:9a:f8:02:de:f2:af:f8:13:93:06:d2:b3:5e:66:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 1, 0001
Subject
SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
07:1f:a3:3b:b6:bd:8f:10:10:42:ed:aa:0e:b2:dd:28
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 9, 2025 - Jan 8, 2026
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
8839828
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\buildAgent\work\ci_ninja_client-x64_git\build.ninja\client\vs2019\x64\release\CrashReport\RobloxCrashHandler.pdb
ws2_32
htonl
closesocket
htons
WSAEnumNetworkEvents
getsockopt
send
listen
shutdown
WSAResetEvent
WSAEventSelect
WSASetEvent
socket
ntohl
ntohs
gethostname
getnameinfo
WSACreateEvent
WSACloseEvent
WSASetLastError
WSAGetLastError
select
WSAWaitForMultipleEvents
__WSAFDIsSet
WSAStartup
WSACleanup
setsockopt
recv
WSASocketA
recvfrom
sendto
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
connect
getsockname
getpeername
WSAIoctl
bind
accept
freeaddrinfo
getaddrinfo
inet_ntop
ioctlsocket
advapi32
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
RegQueryValueExW
ImpersonateNamedPipeClient
RevertToSelf
BuildSecurityDescriptorW
BuildExplicitAccessWithNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
crypt32
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertOpenSystemStoreW
CertOpenStore
CertFindCertificateInStore
winhttp
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
shell32
SHGetFolderPathAndSubDirW
iphlpapi
GetAdaptersAddresses
dbghelp
SymFromAddr
kernel32
RtlUnwindEx
InterlockedPushEntrySList
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitThread
FreeLibraryAndExitThread
SetStdHandle
ExitProcess
GetConsoleOutputCP
SetEnvironmentVariableW
GetCommandLineA
GetCommandLineW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
AddVectoredExceptionHandler
ConvertThreadToFiberEx
ConvertFiberToThread
RtlVirtualUnwind
GetACP
GetExitCodeThread
CreateFiberEx
DeleteFiber
SwitchToFiber
AcquireSRWLockShared
ReleaseSRWLockShared
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
RaiseException
WriteConsoleW
GetFileTime
CopyFileW
InitializeSRWLock
GetConsoleScreenBufferInfo
VirtualFree
GetCurrentProcess
GetStdHandle
WriteConsoleA
WriteFile
VirtualAlloc
GetFullPathNameA
GetEnvironmentVariableA
Sleep
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LoadLibraryA
QueryPerformanceFrequency
CloseHandle
GetSystemInfo
GetCurrentProcessorNumber
GetProcAddress
FreeLibrary
QueryPerformanceCounter
VirtualQuery
GetProcessTimes
GetCurrentThreadId
CreateThread
WaitForSingleObject
CreateEventA
SetEvent
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FormatMessageW
SetLastError
SetUnhandledExceptionFilter
SetProcessShutdownParameters
SetConsoleCtrlHandler
VerSetConditionMask
IsWow64Process
GetModuleHandleW
FormatMessageA
VerifyVersionInfoW
SuspendThread
ResumeThread
GetProcessId
GetThreadContext
Wow64GetThreadContext
IsProcessorFeaturePresent
GetTimeZoneInformation
GetThreadLocale
GetSystemDefaultLCID
GetUserDefaultLCID
GetModuleFileNameW
DuplicateHandle
ConnectNamedPipe
DisconnectNamedPipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateEventW
TerminateProcess
OpenProcess
UnregisterWaitEx
RegisterWaitForSingleObject
GetFileInformationByHandleEx
VirtualQueryEx
ReadProcessMemory
GetSystemTimeAsFileTime
LoadLibraryW
FindClose
RemoveVectoredExceptionHandler
LocalFree
CreateFileW
SetNamedPipeHandleState
TransactNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetVersion
ReleaseSemaphore
CreateSemaphoreW
GetFileSizeEx
GetFileType
LockFileEx
ReadFile
SetEndOfFile
SetFilePointerEx
UnlockFileEx
CreateSemaphoreA
WaitForSingleObjectEx
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleHandleA
WaitForMultipleObjectsEx
GetSystemDirectoryA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
MoveFileExA
GetFullPathNameW
MultiByteToWideChar
WideCharToMultiByte
CompareFileTime
GetModuleHandleExW
DebugBreak
GetVersionExA
GetProcessHandleCount
K32GetProcessMemoryInfo
GlobalMemoryStatusEx
OutputDebugStringA
IsDebuggerPresent
ReleaseMutex
OpenSemaphoreW
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetProcessImageFileNameA
CreateProcessW
CreateMutexExW
CreateSemaphoreExW
SwitchToThread
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushViewOfFile
ResetEvent
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetDiskFreeSpaceW
LockFile
InitializeCriticalSection
GetTempPathW
CreateMutexW
GetFileAttributesW
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
CreateFileA
DeleteFileA
DeleteFileW
HeapReAlloc
RtlUnwind
HeapCompact
HeapDestroy
UnlockFile
GetFileSize
SystemTimeToFileTime
GetSystemTime
FlushFileBuffers
FindFirstFileW
FindNextFileW
GetCurrentDirectoryW
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
GetLogicalProcessorInformation
FileTimeToSystemTime
DecodePointer
GetNativeSystemInfo
LoadLibraryExW
GetCurrentThread
SetWaitableTimer
TlsSetValue
TlsAlloc
CreateWaitableTimerA
TlsGetValue
TlsFree
CreateDirectoryW
DeviceIoControl
RemoveDirectoryW
SetFileTime
GetFileInformationByHandle
MoveFileExW
user32
GetWindowLongPtrW
CreateWindowExW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
EnumDisplayDevicesA
DestroyWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
DefWindowProcW
RegisterClassW
UnregisterClassW
SetWindowLongPtrW
ole32
CoCreateInstance
CoUninitialize
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoTaskMemFree
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeAllConditionVariable
WakeByAddressSingle
SleepConditionVariableCS
WaitOnAddress
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-memory-l1-1-3
VirtualProtectFromApp
VirtualAllocFromApp
api-ms-win-power-base-l1-1-0
CallNtPowerInformation
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExA
api-ms-win-mm-time-l1-1-0
timeBeginPeriod
timeGetDevCaps
timeGetTime
api-ms-win-security-cryptoapi-l1-1-0
CryptSignHashW
CryptGetProvParam
CryptSetHashParam
CryptGenRandom
CryptExportKey
CryptDecrypt
CryptDestroyKey
CryptAcquireContextW
CryptEnumProvidersW
CryptGetUserKey
api-ms-win-security-systemfunctions-l1-1-0
SystemFunction036
api-ms-win-eventlog-legacy-l1-1-0
DeregisterEventSource
ReportEventW
RegisterEventSourceW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
api-ms-win-core-localization-l1-2-0
GetCPInfo
LCMapStringEx
GetLocaleInfoEx
api-ms-win-core-string-l1-1-0
CompareStringEx
GetStringTypeW
api-ms-win-core-file-l1-1-0
GetDiskFreeSpaceExW
FindFirstFileExW
GetFinalPathNameByHandleW
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
winmm
timeSetEvent
version
GetFileVersionInfoSizeW
?generic_category@system@boost@@YAAEBVerror_category@12@XZ
?system_category@system@boost@@YAAEBVerror_category@12@XZ
Name
.text
Size
9.0MB
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
229KB
Virtual Size
15.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
373KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=29395,
count=201, id=261, version=29395,
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=260, version=30034,
count=10, id=259, version=30034,
count=98, id=261, version=30034,
count=9, id=253, version=28518,
count=30, id=260, version=29395,
count=1, id=262, version=29395,
count=907, id=260, version=30154,
count=5, id=259, version=30154,
count=134, id=261, version=30154,
count=31, id=257, version=29395,
count=448, id=1, productName=Unmarked objects,
count=590, id=265, version=30154,
count=40, productName=Unmarked objects (old),
count=1, id=256, version=30154,
count=1, id=258, version=30154,
UniShade - Setup.exe
- IMPHASH 0ed51343c1373e81f2aadeeec07fb998
- SHA256 e72a6335ea8e5ba0710c9c0f86cf150f378a1cc68ca92dcf64e4cb5a8dd630bc
- MD5 bdd8b28fa17eb2fa5bacaac300ba4a25
- SHA1 4818f1ed0913c7995396d7c3e8b1d11df996c954
- SHA512 151c1ab7ff361275c0a4e48957e6dc251802c1176d7e5f7a86e75690a56354d72faf17955861ff674670b3b50596455669e20a1aeee52b909f618a2ec8c3d190
- SSDEEP 1572864:kw2wYWui8LzBQ/r3xlwA4w2wYWui8LzBQ/r3xlwA4w2wYWui8LzBQ/r3xlwA:kaPgirxmhaPgirxmhaPgirxm
- TLSH T1B54833C63AEE96FCC93D453A9F47FB19E7AB36010624A0333A9D48559FC71B2427E109
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
379240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\yahiya\Desktop\UniShade Basic installer\x64\Release\UniShade Basic installer.pdb
kernel32
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
SizeofResource
GetTempPathW
GetTickCount64
LockResource
GetWindowsDirectoryA
LoadResource
FindResourceW
GetModuleHandleW
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
HeapReAlloc
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
OutputDebugStringA
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
LoadLibraryExW
VirtualProtect
HeapFree
HeapAlloc
GetFileType
ReadConsoleW
GetConsoleMode
SetFilePointerEx
UnhandledExceptionFilter
QueryPerformanceCounter
FreeLibrary
GetProcAddress
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
IsDBCSLeadByte
QueryPerformanceFrequency
TerminateProcess
ExitProcess
GetCurrentProcess
ReadFile
FlsFree
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
EnumSystemLocalesW
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
CreateFile2
AreFileApisANSI
CloseHandle
GetLastError
CopyFile2
GetFileInformationByHandleEx
GetSystemTimePreciseAsFileTime
TryAcquireSRWLockExclusive
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlUnwind
user32
SetCapture
LoadCursorW
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
GetClientRect
GetMessageExtraInfo
GetKeyState
IsWindowUnicode
ReleaseCapture
SetCursorPos
DefWindowProcW
SetClipboardData
GetClipboardData
EmptyClipboard
SetCursor
GetCursorPos
ScreenToClient
CloseClipboard
DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
PeekMessageW
MessageBoxA
TranslateMessage
PostQuitMessage
UpdateWindow
OpenClipboard
shell32
ShellExecuteA
SHGetFolderPathW
ShellExecuteW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
VariantInit
SysAllocString
SysFreeString
d3dcompiler_47
D3DCompile
dwmapi
DwmSetWindowAttribute
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3d11
D3D11CreateDeviceAndSwapChain
urlmon
URLDownloadToFileW
gdiplus
GdipCloneImage
GdipGetImageHeight
GdiplusStartup
GdiplusShutdown
GdipBitmapUnlockBits
GdipDisposeImage
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipBitmapLockBits
GdipFree
GdipAlloc
Name
.text
Size
547KB
Virtual Size
547KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
143KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
110.6MB
Virtual Size
110.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=180, id=261, version=33145,
count=15, id=259, version=33145,
count=10, id=259, version=35403,
count=17, id=260, version=35403,
count=94, id=261, version=35403,
count=25, id=260, version=33145,
count=25, id=257, version=33145,
count=225, id=1, productName=Unmarked objects,
count=8, id=265, version=35723,
count=1, id=255, version=35723,
count=2, id=151,
count=1, id=258, version=35723,