update[.]zip | Triage™

General

Target
update.zip
Size 2.4MB
Sample230501-k92tpagh4x
SHA256 6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0
MD5 c96277417b22b02300f8573a2ee5cddd
SHA1 c3afa5ff29b260f4e8eea5f35e1ec39309bd5421
SHA512 3de831ad79ddc2d122dde52f60cd7eac27b83cbf688f85b74d37eb3a636b98b3cf151b02bc107d50ba36be13fe455ac1a89e2fe0183e7be386673f9a7a90366f
SSDEEP 12288:NTYV+u9dWbjVpGNGpKaj8qjhTcDxzV7jqlfhf6yz9OeNi:CVCfVeyjJhmNV6lFLz9OeNi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/update.exe

File Explorer

update.zip

.zip 2.4MB
update.exe

.exe 1024.0MB

update.zip

SHA256 6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0
MD5 c96277417b22b02300f8573a2ee5cddd
SHA1 c3afa5ff29b260f4e8eea5f35e1ec39309bd5421
SHA512 3de831ad79ddc2d122dde52f60cd7eac27b83cbf688f85b74d37eb3a636b98b3cf151b02bc107d50ba36be13fe455ac1a89e2fe0183e7be386673f9a7a90366f
SSDEEP 12288:NTYV+u9dWbjVpGNGpKaj8qjhTcDxzV7jqlfhf6yz9OeNi:CVCfVeyjJhmNV6lFLz9OeNi
MD5 SHA1 SHA512 SSDEEP

update.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 4f67eda04defdf40355ab17ff4d72f0270f6265ad39f918ecab8a11727832e22
MD5 266a9e038cfb90db7fa5d45282dac72d
SHA1 6bf5ebe90c764e7d82c6c8e75c2ce3418dd923e0
SHA512 1358982cb90e763c88338c1a90c24e2b46ea7f521e4023a9a02ef5d9d1b802035808d9d055e9c0f297f33d7c099fd4e8b6fe1b5be9e0d38919a680262f8227ae
SSDEEP 12288:84mT/RcXtvyJdBQhXVQpPDv4aloZqby13caYgd2DBAm:84C/6XtvWBmQpPTXgcaYgdCA
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368896

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

403KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

459KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

97KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

update.zip

update.exe

kernel32