UUPdownload_v4.5.7z
- SHA256 d335636f0c81e4bc14ab15ec711ef5e8b7798cc706370fb95b9eb4a17e21f00d
Overview
overview
3Static
static
3files/aria2c.exe
windows10-2004-x64
1files/aria2c.exe
windows11-ltsc_2024-x64
1files/lang.cmd
windows10-2004-x64
3files/lang.cmd
windows11-ltsc_2024-x64
3lot_size_f...ay.cmd
windows10-2004-x64
3lot_size_f...ay.cmd
windows11-ltsc_2024-x64
3uupdownload - app.cmd
windows10-2004-x64
3uupdownload - app.cmd
windows11-ltsc_2024-x64
3uupdownloa...cy.cmd
windows10-2004-x64
3uupdownloa...cy.cmd
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
files/aria2c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
files/aria2c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
files/lang.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
files/lang.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
lot_size_files_clear_away.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
lot_size_files_clear_away.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
uupdownload - app.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
uupdownload - app.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
uupdownload - legacy.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
uupdownload - legacy.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target UUPdownload_v4.5.7z
- Size 1.7MB
- Sample261030-2sc8fasvbx
- SHA256 d335636f0c81e4bc14ab15ec711ef5e8b7798cc706370fb95b9eb4a17e21f00d
- MD5 0da9fe5b9c3472d5ca1b14732ba80fb8
- SHA1 abb195e0293ddc78b6b3232a4a55e2575710e265
- SHA512 0ea0b8c71a682d88556bf780e4b587f849a4bee51854e2e70cfdd27c9b84005b0a71fea46e6396c6bcacafc9a48736623552a21503b807e5a277a54a10e1ae13
- SSDEEP 49152:HJ8aaKRYloIaZLXXctC+zGXILT1Bh5CwdU3d:HfaKI4qC34T+wmt
- TLSH T1CC85336EA4F14271141F9EBCB4F266EF3CB047CFC4E96DE8D4D32192F9CA490159688A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/files/aria2c.exe
File Explorer
-
UUPdownload_v4.5.7z.7z 1.7MB
-
ChangeLog.txt13KB
-
ReadMe.txt16KB
-
UUPs/.README134B
-
files/aria2c.exe.exe 5.3MB
-
files/lang.cmd.cmd .vbs 30KB
-
lot_size_files_clear_away.cmd489B
-
uupdownload - app.cmd.cmd .bat 22KB
-
uupdownload - legacy.cmd.cmd .bat 44KB
ChangeLog.txt
- SHA256 d69bb40cfad3bab1af63d269377b3a1b39217f6219d38e897cdb9139de1441f8
- MD5 8b0d07278b0b056687dfce3592e5098c
- SHA1 34c5a3a101becb9dd31461573d287a51c2e1d4e3
- SHA512 3977cafdf5863841f68fea5f09bdf6d99cab45f5ac76d3db760a0518021a3acd332d9de8d0713736939e13d5c9cda1fcfc05fbf9c5d7e8dff7b4ece1152f0b66
- SSDEEP 384:n1jSD/OIbLnIpp0Jhz/2gU1nvxM5Jz/qIwHfe/WZ:nG/xb6prSkQWZ
- TLSH T12B522DAC1A74D88C33F3319603AFA15A7608674B84B1B144D95D4C5F3E80FAF99E7B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
ReadMe.txt
- SHA256 35bd8da96c92c42077781e11f365d1695e494ccbd2dbf14674cc4654d4e8679e
- MD5 6e12e860543482473c39f235fe0f6713
- SHA1 f6bd8500a042956acba479d5914fd2a44e504ce5
- SHA512 8581035cd10b2f2aed400d347caaa5aee971284dcb13642dd7ec91c0fae0e167d9c37b3c5daf2444d314c28446076a9692c8035d11b537184dd020a835f1bd51
- SSDEEP 384:Sa+hLzLqv5ew5M5F5JO5Ww3Lywew5M5r5JJ5Ww3LJmgGeR5xRZJ8Hrh:SpTqv5E2LZCbLbGebxH4h
- TLSH T10972C6F5856618F9238231D523FDA612F26CB3278037B11AE80945993F59F2F45E2E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
files/aria2c.exe
- IMPHASH 8a0d3862e1ea2d35f958e84f4fe6382c
- SHA256 2646c5d3eb8b0fc57e85f30434cef3d3a261d01f065fc4ad23f020c31f1dd6bd
- MD5 53d237cbbdac5ae3dc65c9ee8a51094d
- SHA1 b2aa5c6150f556f3fa6f6904ac57befc07a14b6d
- SHA512 7a29d0fbcca4402c32756ccdf8b8c79a36512d005f695d8eb9b8c88412a57d916e581ae58c55451cf6210cd76d6bdc166121492b1b653719d30a4758a7c3a5cb
- SSDEEP 49152:fcqNj1f/q2nGRqnv9KCnLEVmx6oqgemsheXhWo4liMCgyyOOK8uDjWmLSfPcZv4+:FfS2Kqn4CnLEslfYexusOK8gyo4
- TLSH T102462827E2A350ECC27BC170476BA273B931F81911307A7F7698DB752F21E60566EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptSignHash
BCryptVerifySignature
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptDecodeObjectEx
PFXImportCertStore
PFXIsPFXBlob
iphlpapi
GetAdaptersAddresses
kernel32
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExpandEnvironmentStringsA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentVariableW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReadFile
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_commit
_commode
_difftime64
_endthreadex
_errno
_filelengthi64
_fileno
_fmode
_fstat64
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_setmode
_stricmp
_strnicmp
_time64
_unlock
_wfopen
_wfsopen
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wrmdir
_wsopen
_wstat64
_wunlink
abort
acos
asctime
asin
atan
calloc
cosh
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
ldiv
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
perror
putc
putwc
qsort
raise
rand
realloc
rewind
setlocale
setvbuf
signal
sinh
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strrchr
strstr
strtol
strtoul
strxfrm
tan
tanh
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcstombs
wcsxfrm
_tzname
_write
_tzset
_strnicmp
_strdup
_read
_open
_lseek
_isatty
_fileno
_fdopen
_dup
_close
secur32
AcceptSecurityContext
AcquireCredentialsHandleW
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA
shell32
CommandLineToArgvW
ws2_32
WSASend
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
getservbyname
getservbyport
wsock32
WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
516KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
256KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
files/lang.cmd
- SHA256 c901b4ffeb2a8dad7d6009772525447cecdb8ac4e7df79b163f29b6bd9d20d93
- MD5 2d626f09b20a99d41fa39936ca4e5298
- SHA1 19438e43b0bf6c65f1111290761000f232773618
- SHA512 34bfdf098f01334a448308388dd68efaa2f42dd235c5b822b3adfa606f2718635bf19689c1963f8665c3aa4e7bced18a8aa8d5ff5db3fe215e16d716c3937c05
- SSDEEP 768:uGUJ9T6vKsM1o2dek19eaDV2oXYnNvV7ATv:uhJ9mvKX1o2deseavYNv2j
- TLSH T1F6D2B5173E05412901FAA231918B6A49F72CC4DE9325E9CC342D811F63BFB63D6BE5E6
- MD5 SHA1 SHA512 SSDEEP TLSH
lot_size_files_clear_away.cmd
- SHA256 04b69dd5fbad89004930ecfd2ca7fea596c753206d58f473dec29e2ecf3fb4d2
- MD5 8fae3c8c27a5f9912bab181e62bdd7f1
- SHA1 bebdb46c40c659a0f55ce95012ff1a8f8874af1d
- SHA512 2005e8554a3528470c3d0a83a6c692badb684f652a6e4da93f2b41daaaa362afe2a6958c12dfc066c0256e188a95d80cd4cf51003e29aca6b680b0236d5b44f9
- TLSH T1E2F067E72814662682901BA8CF9C04B6A0CED0E3FD655930E1F70D9AE03BB30465BFC0
- MD5 SHA1 SHA512 TLSH
uupdownload - app.cmd
- SHA256 758748188e9aead9c4ad7bde11bcf62f7c1d7236dd02736c5b3afc877a3796fe
- MD5 e2e3aecb6c78241be803d172ae47a996
- SHA1 cc0fd2a1e4ab96eb477d8ca36dd9d418390b7f3c
- SHA512 f7276a97f8a17092d973cf4df4f0dc885dc7ccaac08e1a9967b0c58771d44428de53440af027f0d307c38221c7ff071e566a64c8ba7bfec0a5f913988022a2e2
- SSDEEP 192:RXQvOjFoaWllCfsUcGzHFYE06BThKOxgIZBiwZfS63xqLswQRYOKI0d+BzCPXwU7:txgpUOEhh1PZBJtgx
- TLSH T1AFA2CD12BE4C605AA2FDEE459E70D839FB39F387446C7D48F26B066E6B43780786D601
- MD5 SHA1 SHA512 SSDEEP TLSH
uupdownload - legacy.cmd
- SHA256 2074937708a9d9c7e5d89efa03c0ccbef4ea3af51289183c0cc71ac3802a4a71
- MD5 26d62da2fb312b6351e0066591033dd0
- SHA1 8b3728ebcde7bf3c1291384c890c16ed1e45415b
- SHA512 dd0f0f6382211eb111c2d569ac1842733026b359ae9ac907cd066c5648faa47a31d49b05cae58d5d1453c1481cb6e0577383239202bb02dcc44502d5440dabcf
- SSDEEP 192:RXQvOjPaWllCfYUcGzHdYE0M4ThKO/QIZBi4KCTce2UN2msgQRYOKI0d+rvSpD0P:tHTUOayh15ZBStlwaN0vsPHSd09
- TLSH T15613223ABD64A056F1F8CE415E30AC35FA3AB383842CEB58F57B0169B75B684397C542
- MD5 SHA1 SHA512 SSDEEP TLSH