bc47dcfe5ada1e63ba094bb3c8a4f9c3
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Dec-23 14:00:38 |
| Detected languages |
English - United States
|
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
ulta_loader.pdb
|
| ProductName | ulta-client |
| ProductVersion | 0.1.0 |
| FileVersion | 0.1.0 |
| FileDescription | ulta-client |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA256
Uses constants related to RC5 or RC6 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: AkhaliNet LLC
Issuer: Certum Code Signing 2021 CA |
| Safe | VirusTotal score: 0/72 (Scanned on 2024-12-31 23:54:56) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2024-Dec-23 14:00:38 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x9a1600 |
| SizeOfInitializedData | 0x4ccc00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000009727A4 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xe72000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xe6ff81 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
.reloc
Imports
| api-ms-win-core-synch-l1-2-0.dll |
WaitOnAddress
WakeByAddressAll WakeByAddressSingle |
|---|---|
| bcryptprimitives.dll |
ProcessPrng
|
| SHELL32.dll |
#190
CommandLineToArgvW DragFinish DragQueryFileW SHCreateItemFromParsingName SHOpenFolderAndSelectItems SHAppBarMessage SHGetKnownFolderPath ShellExecuteExW |
| ole32.dll |
CoTaskMemAlloc
CoInitialize CoTaskMemFree RegisterDragDrop OleInitialize CoCreateInstance CoInitializeEx RevokeDragDrop CoUninitialize |
| kernel32.dll |
IsProcessorFeaturePresent
RtlUnwindEx HeapAlloc GetProcessHeap CloseHandle CreatePipe WaitForSingleObject HeapFree lstrlenW GetCurrentThreadId LCIDToLocaleName GetUserDefaultUILanguage ReleaseMutex RtlPcToFileHeader SetUnhandledExceptionFilter CreateMutexA LoadLibraryW WaitForSingleObjectEx GetModuleHandleW GetTempPathW CreateThread WideCharToMultiByte WriteConsoleW MultiByteToWideChar UpdateProcThreadAttribute InitializeProcThreadAttributeList CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFullPathNameW WaitForMultipleObjects ReadFileEx CreateNamedPipeW ExitProcess SetEnvironmentVariableW CancelIo CopyFileExW GetFinalPathNameByHandleW LoadLibraryA LocalFree FindFirstFileW CreateDirectoryW GetFileInformationByHandleEx FindClose HeapReAlloc GetSystemTimePreciseAsFileTime GetFileAttributesW CreateFileW OutputDebugStringA OutputDebugStringW GetModuleFileNameW EncodePointer DeleteCriticalSection LoadLibraryExW InitializeCriticalSectionAndSpinCount FreeLibrary GetEnvironmentVariableW QueryPerformanceFrequency GetProcessId TerminateProcess SleepEx WriteFileEx GetStdHandle SetFilePointerEx SetFileInformationByHandle GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter SetWaitableTimer GetLastError CreateMutexW CreateWaitableTimerExW SwitchToThread GetCurrentThread LoadLibraryExA CreateEventW SetThreadStackGuarantee AddVectoredExceptionHandler CompareStringOrdinal DeleteProcThreadAttributeList FreeEnvironmentStringsW ReleaseSRWLockExclusive FormatMessageW AcquireSRWLockExclusive TlsAlloc GetFileInformationByHandle GetConsoleMode RegisterWaitForSingleObject UnregisterWaitEx GetCurrentProcess DuplicateHandle GetProcAddress FindNextFileW RaiseException TlsFree ReadProcessMemory TlsGetValue SetHandleInformation TlsSetValue GetProcessIoCounters GetSystemTimes OpenProcess GetExitCodeProcess WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus ReadFile GetOverlappedResult GetSystemInfo SetFileCompletionNotificationModes Sleep GetModuleHandleA GlobalMemoryStatusEx K32GetPerformanceInfo GetCurrentProcessId GetProcessTimes VirtualQueryEx |
| user32.dll |
CreateAcceleratorTableW
MonitorFromWindow CreatePopupMenu CreateMenu DestroyMenu RemoveMenu SetMenu DrawMenuBar AppendMenuW SetCursor ToUnicodeEx SetMenuItemInfoW GetKeyboardLayout GetRawInputData CreateIcon MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SendInput SetForegroundWindow GetWindowTextW GetWindowTextLengthW SetWindowTextW GetCursorPos DestroyIcon GetMonitorInfoW SystemParametersInfoA SetPropW IsWindowVisible GetMenu SetWindowDisplayAffinity ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu MonitorFromPoint EnumDisplayMonitors SystemParametersInfoW ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterRawInputDevices IsProcessDPIAware SetParent GetMenuItemInfoW ValidateRect ShowWindow MapWindowPoints RegisterWindowMessageA DestroyAcceleratorTable PostThreadMessageW CheckMenuItem ReleaseDC DrawIconEx GetDC TrackPopupMenu PostQuitMessage GetMenuBarInfo IsWindowEnabled EnableWindow OffsetRect GetWindowDC DrawTextW FillRect GetParent PeekMessageW SetWindowRgn FindWindowExW CloseTouchInputHandle GetTouchInputInfo RedrawWindow TrackMouseEvent MonitorFromRect GetSystemMetrics ClientToScreen GetWindowLongW ScreenToClient DestroyWindow GetUpdateRect GetWindowLongPtrW SetWindowLongPtrW AdjustWindowRect InsertMenuW GetForegroundWindow RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW GetMessageW MapVirtualKeyW IsIconic EnumChildWindows DispatchMessageA GetMessageA GetWindowRect GetClientRect SetWindowPos LoadCursorW TranslateAcceleratorW PostMessageW CreateWindowExW RegisterClassExW FindWindowW DispatchMessageW TranslateMessage SendMessageW |
| comctl32.dll |
TaskDialogIndirect
DefSubclassProc SetWindowSubclass RemoveWindowSubclass |
| gdi32.dll |
DeleteObject
BitBlt SetBkMode GetDeviceCaps CreateSolidBrush SetTextColor CreateRectRgn CreateCompatibleDC CreateDIBSection SelectObject DeleteDC CombineRgn |
| advapi32.dll |
CopySid
GetLengthSid OpenProcessToken GetTokenInformation SystemFunction036 RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister IsValidSid RegCloseKey RegQueryValueExW RegOpenKeyExW |
| dwmapi.dll |
DwmEnableBlurBehindWindow
DwmGetWindowAttribute DwmSetWindowAttribute |
| shlwapi.dll |
SHCreateMemStream
|
| ws2_32.dll |
getaddrinfo
freeaddrinfo closesocket WSACleanup WSAStartup getsockopt getpeername getsockname WSASocketW bind ioctlsocket shutdown recv send WSASend setsockopt WSAIoctl WSAGetLastError connect |
| secur32.dll |
AcquireCredentialsHandleA
EncryptMessage QueryContextAttributesW FreeCredentialsHandle DecryptMessage AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DeleteSecurityContext FreeContextBuffer |
| crypt32.dll |
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertAddCertificateContextToStore CertOpenStore CertFreeCertificateChain CertCloseStore CertGetCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateStore |
| ntdll.dll |
NtCreateFile
NtWriteFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtQuerySystemInformation NtQueryInformationProcess RtlGetVersion NtReadFile |
| oleaut32.dll |
GetErrorInfo
SetErrorInfo SysFreeString SysStringLen |
| bcrypt.dll |
BCryptGenRandom
|
| pdh.dll |
PdhGetFormattedCounterValue
PdhCloseQuery PdhOpenQueryA PdhRemoveCounter PdhCollectQueryData PdhAddEnglishCounterW |
| powrprof.dll |
CallNtPowerInformation
|
| psapi.dll |
GetModuleFileNameExW
|
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
trunc floor round pow |
| api-ms-win-crt-string-l1-1-0.dll |
wcsncmp
_wcsicmp strlen wcslen strcpy_s wcscmp |
| api-ms-win-crt-convert-l1-1-0.dll |
_wtoi
wcstol _ultow_s |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
calloc malloc free _callnewh |
| api-ms-win-crt-runtime-l1-1-0.dll |
terminate
_crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback exit abort _c_exit _cexit __p___argv __p___argc _exit |
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
__p__commode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
Delayed Imports
1
2
3
4
5
6
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.1.0.0 |
| ProductVersion | 0.1.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| ProductName | ulta-client |
| ProductVersion (#2) | 0.1.0 |
| FileVersion (#2) | 0.1.0 |
| FileDescription | ulta-client |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Dec-23 14:00:38 |
| Version | 0.0 |
| SizeofData | 40 |
| AddressOfRawData | 0xb936f4 |
| PointerToRawData | 0xb920f4 |
| Referenced File | ulta_loader.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Dec-23 14:00:38 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0xb9371c |
| PointerToRawData | 0xb9211c |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Dec-23 14:00:38 |
| Version | 0.0 |
| SizeofData | 1048 |
| AddressOfRawData | 0xb93730 |
| PointerToRawData | 0xb92130 |
TLS Callbacks
| StartAddressOfRawData | 0x140b93b90 |
|---|---|
| EndAddressOfRawData | 0x140b93d64 |
| AddressOfIndex | 0x140dccef8 |
| AddressOfCallbacks | 0x1409a3e08 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001409591A0
|
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140dca640 |
RICH Header
| XOR Key | 0xe75aab55 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 14 |
| ASM objects (34321) | 9 |
| C objects (34321) | 13 |
| C++ objects (34321) | 47 |
| Imports (29395) | 5 |
| Total imports | 553 |
| Unmarked objects (#2) | 799 |
| Resource objects (34435) | 1 |
| Linker (34435) | 1 |