Behavioral task
behavioral1
Sample
Windows Update.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Windows Update.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
x.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
x.exe
Resource
win10v2004-20220812-en
General
-
Target
be2408669635a1c98c8b92667ed74ec34f5381ed73d8124c9a41478059a29ed8
-
Size
46KB
-
MD5
d9c562a273a8cafd44841a57cc482ccb
-
SHA1
8e13c008ffe31b6419a1ef591798337a6bd78193
-
SHA256
be2408669635a1c98c8b92667ed74ec34f5381ed73d8124c9a41478059a29ed8
-
SHA512
3a2b90a94460aa8f8b0fbc79968722c9a456b1b80abb64ef2ba11d1ef077ffeea1b86928aebe83a76be4a39e1ffab72a658d32df856de07e67cb93d766f9e193
-
SSDEEP
768:iMBJqFNuPaWydTNwQnicJvlQl7VaQHKg3qDMrzUK+EyFJ3g6pcQYC+dzDDBYE/5i:iMSj4WFNw4/ulRHHKuqUUHV73gYvn+dg
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Windows Update.exe upx
Files
-
be2408669635a1c98c8b92667ed74ec34f5381ed73d8124c9a41478059a29ed8.cab
-
Windows Update.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
x.exe.exe windows x86
d4ff4e9520d2b9d618be12fecec0c0ac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
LoadResource
SizeofResource
FindResourceA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
DeleteFileA
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LockResource
lstrcpyA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetModuleFileNameA
lz32
LZCopy
LZOpenFileA
LZClose
user32
MessageBoxA
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ