uacbypass_x86[.]exe

General

Target
uacbypass_x86.exe
Size 183KB
Sample261107-pxwt5ads7l
SHA256 f7f085e5cf1912ca14514dd7813b01b7f48d9ff4fe730381fe54080a99193258
MD5 0bdc940450ff74152d8ebdc6eaa60008
SHA1 fa317d49686eebea266e6400242e4a296205731f
SHA512 f814c672d8f62f054a68b7cfb90b4ef013481f52f9649c5e5246ed069bbfb49398d2cb9aea09a2c99c29406010629b2f874d4603e5bd2a58fbf9be7ce58f286f
SSDEEP 3072:tOVyFuhocLtQmdY4FckaXcKEmlyjdCegcvd3dtVtS3mOn9x2q4bCYWfBCn/Ap05X:EVfhocTRc9XcUOdFTvFVtSWGz/C4pqXn
TLSH
T1D5046C11F882C033C666097059E5DFB59E7EBD701F74A8CBA3C41FBA5A206D09736B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
uacbypass_x86.exe

File Explorer

uacbypass_x86.exe

.exe 183KB

uacbypass_x86.exe

IMPHASH ab32812c1a97550042ba0649231155c9
SHA256 f7f085e5cf1912ca14514dd7813b01b7f48d9ff4fe730381fe54080a99193258
MD5 0bdc940450ff74152d8ebdc6eaa60008
SHA1 fa317d49686eebea266e6400242e4a296205731f
SHA512 f814c672d8f62f054a68b7cfb90b4ef013481f52f9649c5e5246ed069bbfb49398d2cb9aea09a2c99c29406010629b2f874d4603e5bd2a58fbf9be7ce58f286f
SSDEEP 3072:tOVyFuhocLtQmdY4FckaXcKEmlyjdCegcvd3dtVtS3mOn9x2q4bCYWfBCn/Ap05X:EVfhocTRc9XcUOdFTvFVtSWGz/C4pqXn
TLSH
T1D5046C11F882C033C666097059E5DFB59E7EBD701F74A8CBA3C41FBA5A206D09736B26
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

37656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoGetObject CoInitializeEx CoUninitialize

advapi32

RegQueryValueExW StartServiceW QueryServiceConfigW OpenServiceW OpenProcessToken GetTokenInformation LookupPrivilegeNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW EnumServicesStatusExW RegSetValueExW RegDeleteTreeW CloseServiceHandle CreateServiceW DeleteService OpenSCManagerW

user32

SendMessageTimeoutW

kernel32

SetEndOfFile WriteConsoleW SetLastError HeapReAlloc HeapSize CreateFileW CreateDirectoryW DeleteFileW GetFileAttributesW GetShortPathNameW GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId CreateProcessW GetTickCount GetTickCount64 GetSystemDirectoryW GetModuleFileNameW CopyFileW MultiByteToWideChar WideCharToMultiByte SetConsoleOutputCP ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FlushFileBuffers RaiseException RtlUnwind DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType ReadFile GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

uacbypass_x86.exe

ole32

advapi32

user32

kernel32

generic