update[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

update.exe
Size

132.5MB
MD5

56b641e2cf3364a68c9ae68ab733f847
SHA1

c813b8974aefc67edf2c9ed7a93ed7f03d5fc7e3
SHA256

83771cc1f16c2d9f805abbf5f7e6da1413432783f854098e67bc1de9af18643c
SHA512

fa198837afd5b51fdf24b6625df1b0c66733b7d473b84bfd09b143a2825980a2c37c8e8f6553375a7d3da11d36d8a56843ed1922032d4d16483c80bfe787c603
SSDEEP

3145728:SWAeD7tAWa0Ox15I7DZQsNhtPog99IFA7UK8ia+pQp3f899q7xc/vh1e:SWTa1hI/usNH9pn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update.exe

Files

update.exe
.exe windows x86

efc96589240d86dd7f463f8b0724395d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
SetEndOfFile
WriteConsoleW
HeapReAlloc
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
FindClose
FindFirstFileW
FindNextFileW
GetTempPathW
GetLastError
GetTempFileNameW
CreateDirectoryW
CreateFileW
DeleteFileW
FormatMessageW
LocalAlloc
lstrlenW
LocalSize
LocalFree
LoadLibraryW
GetProcAddress
GetCurrentDirectoryW
SetCurrentDirectoryW
GetUserDefaultLangID
CloseHandle
FreeLibrary
GetCurrentProcess
CreateFileA
GetFileType
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryA
DosDateTimeToFileTime
CreateDirectoryA
WriteFile
SetFileTime
CompareStringW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleFileNameW
HeapCreate
HeapSize
Sleep
ExitProcess
SetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
GetStdHandle
SetHandleCount
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
ExitThread
ResumeThread
CreateThread
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
EnterCriticalSection

user32

WaitForInputIdle
SetCursor
PostMessageW
GetMessageW
RegisterClassExW
LoadCursorW
PostQuitMessage
DestroyWindow
DefWindowProcW
EndPaint
DrawIcon
GetClientRect
BeginPaint
MoveWindow
GetSystemMetrics
GetIconInfo
LoadIconW
UpdateWindow
ShowWindow
GetWindowLongW
SetWindowLongW
CreateWindowExW
DispatchMessageW
TranslateMessage
MessageBoxW
wsprintfW
LoadStringW

shell32

ShellExecuteExW
SHFileOperationW

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132.4MB - Virtual size: 132.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

efc96589240d86dd7f463f8b0724395d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 132.4MB - Virtual size: 132.4MB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 132.4MB - Virtual size: 132.4MB

.reloc
Size: 8KB - Virtual size: 7KB