The uniws exe File Malware Analysis

Technical Analysis

File Name	uniws.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.214.174
Database Version	2025-04-21 22:00:24 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	cb5131426cc3945f6a9fa10d4e638f9a
SHA1	6611f22cb605613c442fc3769fd9a2a31c8079d1
SHA256	c0cecad9532690e093cdbaf23ad930e43b075f809db8c9d158caa0c3e1a730ed
SHA512	42577796e72c0ff9c5640167e2453846dbc148380305cf4a79414dd281963ab4ba23b5643a2335f6f4312a97ed5123be42ed6b4ed1f7ac1fa6217097beaae4e6
ImpHash	bee828364a62fbca3fb50d74d35dcc5c

PE Analysis

Basic Information

▼

Icon	Hash: 241441eedb6fbcd51435c06ad02b91f1 Fuzzy: 0e4257198d879fd4729c8cb52b977f3e dHash: 017864e6e6607020
Image Base	`0x00400000`
Entry Point	`0x0047d600`
Compilation Time	1992-06-19 22:22:17
Checksum	0x00000000 (Actual: 0x000952f6)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	9 libraries kernel32, user32, advapi32, oleaut32, version, gdi32, ole32, comctl32, shell32
Exports	0 functions
Resources	49 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`CODE`	`0x00001000`	509,564 bytes	509,952 bytes	6.52 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`FF65CD610F1CBD1E90E3386A1A35AC0F`
`DATA`	`0x0007e000`	6,684 bytes	7,168 bytes	4.73 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`9674389A185355AD3EFF8781734F7840`
`BSS`	`0x00080000`	3,181 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00081000`	9,804 bytes	10,240 bytes	4.91 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`C0BC8D08CB4C3121917E87025A1CE826`
`.tls`	`0x00084000`	16 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00085000`	24 bytes	512 bytes	0.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`BD32171A85900C7289A94112A9035789`
`.reloc`	`0x00086000`	35,768 bytes	35,840 bytes	6.65 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`8C03D33A321C6AEFBAB6C3FC47182C7A`
`.rsrc`	`0x0008f000`	29,696 bytes	29,696 bytes	4.59 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`B7BB1CED41150E61656C8DDC64CBAAA8`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 49 (26,386 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	7	2,156 bytes	8.2%
RT_BITMAP	11	4,892 bytes	18.5%
RT_ICON	1	4,264 bytes	16.2%
RT_DIALOG	1	82 bytes	0.3%
RT_STRING	18	11,136 bytes	42.2%
RT_RCDATA	3	3,696 bytes	14%
RT_GROUP_CURSOR	7	140 bytes	0.5%
RT_GROUP_ICON	1	20 bytes	0.1%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The uniws.exe File Analysis