UUPdownload_v4.4.7z
- SHA256 8937235169a2b59abf400bef995cf1f8eba240b7c529b3f4ac1a6371e7ab5074
Overview
overview
3Static
static
3files/aria2c.exe
windows10-2004-x64
1files/aria2c.exe
windows11-ltsc_2024-x64
1files/lang.cmd
windows10-2004-x64
3files/lang.cmd
windows11-ltsc_2024-x64
3lot_size_f...ay.cmd
windows10-2004-x64
3lot_size_f...ay.cmd
windows11-ltsc_2024-x64
3uupdownload - app.cmd
windows10-2004-x64
3uupdownload - app.cmd
windows11-ltsc_2024-x64
3uupdownloa...cy.cmd
windows10-2004-x64
3uupdownloa...cy.cmd
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
files/aria2c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
files/aria2c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
files/lang.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
files/lang.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
lot_size_files_clear_away.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
lot_size_files_clear_away.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
uupdownload - app.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
uupdownload - app.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
uupdownload - legacy.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
uupdownload - legacy.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target UUPdownload_v4.4.7z
- Size 1.7MB
- Sample261030-2sfcsssvb1
- SHA256 8937235169a2b59abf400bef995cf1f8eba240b7c529b3f4ac1a6371e7ab5074
- MD5 f4fa7181dc26b1ca5e8cb470b15cdc50
- SHA1 d60cc6eed140ba40e208ccfdc3a210de28021791
- SHA512 74c7ee9380c716bad2782101b6ba398b6861757afefc0e8dc568a973682ae3470302e1e5e584a89bb06a97b23eb3f6608a763bb99c3b4f0137e16d2eb14b0d05
- SSDEEP 49152:qJ8aaKRYloIaZLXXctC+zGXILT1Bh5CwdU39:qfaKI4qC34T+wmt
- TLSH T1B385336EA4F54271145F4BBCB4F226EF3CB04BCFC4E96DE8D4D32151F9CA890119698A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/files/aria2c.exe
File Explorer
-
UUPdownload_v4.4.7z.7z 1.7MB
-
ChangeLog.txt13KB
-
ReadMe.txt16KB
-
UUPs/.README134B
-
files/aria2c.exe.exe 5.3MB
-
files/lang.cmd.cmd .vbs 30KB
-
lot_size_files_clear_away.cmd489B
-
uupdownload - app.cmd.cmd .bat 22KB
-
uupdownload - legacy.cmd.cmd .bat 44KB
ChangeLog.txt
- SHA256 a874df0727852026d3eeb12a85835d621632e332c8f62c25a759a9bb11d823b1
- MD5 f0457c8a2bb5674e262c28f38eb6ed2c
- SHA1 ffbd5c4b43ebf69da899a4738495f1a5b26fa3a8
- SHA512 05a8a2ce217b7c595015d8f467ed3be096128679021921e601b2e38f0cc716a08ee3a2737244f7948c0c0eece37bd3f5dfc16971f83c2090ee413f67d8b147d8
- SSDEEP 384:TSD/OIbLnIpp0Jhz/2gU1nvxM5Jz/qIwHfe/WZ:A/xb6prSkQWZ
- TLSH T12F522DBC1A34D88D33F3319603AFA15A7604675B84B1B044D95D4C5F3E80FAF99E6B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
ReadMe.txt
- SHA256 35bd8da96c92c42077781e11f365d1695e494ccbd2dbf14674cc4654d4e8679e
- MD5 6e12e860543482473c39f235fe0f6713
- SHA1 f6bd8500a042956acba479d5914fd2a44e504ce5
- SHA512 8581035cd10b2f2aed400d347caaa5aee971284dcb13642dd7ec91c0fae0e167d9c37b3c5daf2444d314c28446076a9692c8035d11b537184dd020a835f1bd51
- SSDEEP 384:Sa+hLzLqv5ew5M5F5JO5Ww3Lywew5M5r5JJ5Ww3LJmgGeR5xRZJ8Hrh:SpTqv5E2LZCbLbGebxH4h
- TLSH T10972C6F5856618F9238231D523FDA612F26CB3278037B11AE80945993F59F2F45E2E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
files/aria2c.exe
- IMPHASH 8a0d3862e1ea2d35f958e84f4fe6382c
- SHA256 2646c5d3eb8b0fc57e85f30434cef3d3a261d01f065fc4ad23f020c31f1dd6bd
- MD5 53d237cbbdac5ae3dc65c9ee8a51094d
- SHA1 b2aa5c6150f556f3fa6f6904ac57befc07a14b6d
- SHA512 7a29d0fbcca4402c32756ccdf8b8c79a36512d005f695d8eb9b8c88412a57d916e581ae58c55451cf6210cd76d6bdc166121492b1b653719d30a4758a7c3a5cb
- SSDEEP 49152:fcqNj1f/q2nGRqnv9KCnLEVmx6oqgemsheXhWo4liMCgyyOOK8uDjWmLSfPcZv4+:FfS2Kqn4CnLEslfYexusOK8gyo4
- TLSH T102462827E2A350ECC27BC170476BA273B931F81911307A7F7698DB752F21E60566EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptSignHash
BCryptVerifySignature
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptDecodeObjectEx
PFXImportCertStore
PFXIsPFXBlob
iphlpapi
GetAdaptersAddresses
kernel32
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExpandEnvironmentStringsA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentVariableW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReadFile
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_commit
_commode
_difftime64
_endthreadex
_errno
_filelengthi64
_fileno
_fmode
_fstat64
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_setmode
_stricmp
_strnicmp
_time64
_unlock
_wfopen
_wfsopen
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wrmdir
_wsopen
_wstat64
_wunlink
abort
acos
asctime
asin
atan
calloc
cosh
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
ldiv
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
perror
putc
putwc
qsort
raise
rand
realloc
rewind
setlocale
setvbuf
signal
sinh
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strrchr
strstr
strtol
strtoul
strxfrm
tan
tanh
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcstombs
wcsxfrm
_tzname
_write
_tzset
_strnicmp
_strdup
_read
_open
_lseek
_isatty
_fileno
_fdopen
_dup
_close
secur32
AcceptSecurityContext
AcquireCredentialsHandleW
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA
shell32
CommandLineToArgvW
ws2_32
WSASend
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
getservbyname
getservbyport
wsock32
WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
516KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
256KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
files/lang.cmd
- SHA256 c901b4ffeb2a8dad7d6009772525447cecdb8ac4e7df79b163f29b6bd9d20d93
- MD5 2d626f09b20a99d41fa39936ca4e5298
- SHA1 19438e43b0bf6c65f1111290761000f232773618
- SHA512 34bfdf098f01334a448308388dd68efaa2f42dd235c5b822b3adfa606f2718635bf19689c1963f8665c3aa4e7bced18a8aa8d5ff5db3fe215e16d716c3937c05
- SSDEEP 768:uGUJ9T6vKsM1o2dek19eaDV2oXYnNvV7ATv:uhJ9mvKX1o2deseavYNv2j
- TLSH T1F6D2B5173E05412901FAA231918B6A49F72CC4DE9325E9CC342D811F63BFB63D6BE5E6
- MD5 SHA1 SHA512 SSDEEP TLSH
lot_size_files_clear_away.cmd
- SHA256 04b69dd5fbad89004930ecfd2ca7fea596c753206d58f473dec29e2ecf3fb4d2
- MD5 8fae3c8c27a5f9912bab181e62bdd7f1
- SHA1 bebdb46c40c659a0f55ce95012ff1a8f8874af1d
- SHA512 2005e8554a3528470c3d0a83a6c692badb684f652a6e4da93f2b41daaaa362afe2a6958c12dfc066c0256e188a95d80cd4cf51003e29aca6b680b0236d5b44f9
- TLSH T1E2F067E72814662682901BA8CF9C04B6A0CED0E3FD655930E1F70D9AE03BB30465BFC0
- MD5 SHA1 SHA512 TLSH
uupdownload - app.cmd
- SHA256 63d32f7ccb2f53201f2d5a543d7ed355c1426618448b9da0b1f3cd3183bf9e99
- MD5 0436747add2b52f9fd9236600eca4c5a
- SHA1 258443e16c2652cf59c563b49e403827f321ec9c
- SHA512 f97b400d215c9c1976cb3e16b9896b7ea96d05246b1e59578f9d570a73cdc9b07863291d5814e47ddd56391d32aff1085aa6a24045482caedd8a13f57564e0eb
- SSDEEP 192:RfQv6jfEa2llCf42UcGzHeJYE06BThKOGVgIZBi//ZfS63xqLs64QRYOKI0d+qJp:xhI12UyuEhh1GDZB0mMn6BntnIqDMB
- TLSH T1ABA2DD52BE4C605AA2FDEE449E70D839FB39F387446C7D48F26B066E6B43780786D601
- MD5 SHA1 SHA512 SSDEEP TLSH
uupdownload - legacy.cmd
- SHA256 2bec7bba6ba088cb160caedb52065347eb0e74a7a833df04751256d354ad428f
- MD5 cbdacdfc620f1303832473eee4ce9a9d
- SHA1 bec8148076a40556c83f5c588f0c14f30f42415c
- SHA512 d9a3aafa169545d27ba421c30e76b31372d852e607bb089c7d06c3ab37f1d9cff1bb6b67b9b98c3b05acf3b26a0613aacb2697e03cab775c46408f065f316b02
- SSDEEP 768:x532Uyah6VBclM6v6BnbHqEAGS2MI/lH503b+r:vv6N2B+br
- TLSH T17E13223ABD64A056F1F8CE415E30AC35FA3AB383842CEB58F57B0169B75B684397C542
- MD5 SHA1 SHA512 SSDEEP TLSH