_Update[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

_Update.exe
Size

1.9MB
MD5

46c3e19dd65857a6947c28b86df3f0bb
SHA1

0cb17861f3741f10d9af502cc6fbed1a1d12b407
SHA256

72349cf4971607c1bc66314069f0c864e8aa4336a663f2afbc2cb7e852465430
SHA512

f78ba047182bc3440be905c6474ea9edc87203e7f011db4d3dda5951d86ec2c3e8c2304d56b9da13dacffd3418ad232dceab7325599e085e7e001ce2608803fe
SSDEEP

24576:gE056N9GVAKRZAD9PR9g+3TFqXg3w1uUEO7SwAyKwZ:Pw9AD9PXTvU/7

Score

1^/10

Malware Config

Signatures

Files

_Update.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1b:66:11:df:9c:9a:4d:6e:cc:8e:d5:0c:9b:91:78:73
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/11/2020, 00:00

Not After

02/11/2023, 23:59

Subject

CN=3CX Ltd,O=3CX Ltd,POSTALCODE=2409,STREET=4\, Markou Drakou,L=Egkomi,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:e7:53:6e:ea:79:3e:7e:e9:1c:74:5b:72:7e:a7:a3:a8:7c:4b:41
Signer

Actual PE Digest

8e:e7:53:6e:ea:79:3e:7e:e9:1c:74:5b:72:7e:a7:a3:a8:7c:4b:41

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=3CX Ltd,O=3CX Ltd,POSTALCODE=2409,STREET=4\, Markou Drakou,L=Egkomi,C=CY

05/11/2021, 13:22
Valid: true

Chain 1

CN=3CX Ltd,O=3CX Ltd,POSTALCODE=2409,STREET=4\, Markou Drakou,L=Egkomi,C=CY

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

1b:66:11:df:9c:9a:4d:6e:cc:8e:d5:0c:9b:91:78:73Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8e:e7:53:6e:ea:79:3e:7e:e9:1c:74:5b:72:7e:a7:a3:a8:7c:4b:41Signer

Signature Validations

Verification

05/11/2021, 13:22 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 12B

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

1b:66:11:df:9c:9a:4d:6e:cc:8e:d5:0c:9b:91:78:73
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8e:e7:53:6e:ea:79:3e:7e:e9:1c:74:5b:72:7e:a7:a3:a8:7c:4b:41
Signer

05/11/2021, 13:22
Valid: true

.text
Size: 1.9MB - Virtual size: 1.9MB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 12B