Static task
static1
Behavioral task
behavioral1
Sample
update_2_10.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
update_2_10.exe
Resource
win10v2004-20230220-en
General
-
Target
update_2_10.exe
-
Size
4.4MB
-
MD5
6e67091dba01147806494e1f98b79995
-
SHA1
713ad8bf41fbb5d5ee03f93eb886f94961ba662f
-
SHA256
f3faa02ed586e66d8491ac474eef110558784376b71328d0f3440167b81cdb1f
-
SHA512
442b8624c8e1403c997d1f4c8eb64e6632a9c39ba8d251f33ef89ca5c0fd346f7ed6e854d1341ec6a7128b0f80580f8c4f6a07095d44ea1c10d851f0bda9f885
-
SSDEEP
98304:dOe1q7m/rUdEu5R3ZTAyVYo8NwQ5ADzcLnaOejI4ysP8Ut:l1nQRgOXwn/e1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource update_2_10.exe
Files
-
update_2_10.exe.exe windows x64
7cff96c1040c8c6ba67c997c704e4c82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlAdjustPrivilege
NtClose
RtlInitAnsiString
kernel32
SetFileAttributesW
Sleep
GetLastError
CreateFileA
DeleteFileW
CloseHandle
GetProcAddress
DeleteCriticalSection
CopyFileW
QueryFullProcessImageNameW
OpenProcess
LocalAlloc
LocalFree
GetCurrentProcessId
ReadFile
WriteFile
CreateFileW
GetFileAttributesA
LoadLibraryA
DeleteFileA
GetStdHandle
PeekConsoleInputA
ReadConsoleInputA
FlushConsoleInputBuffer
IsDebuggerPresent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetModuleHandleA
GetFileAttributesW
InitializeCriticalSectionEx
WaitForSingleObject
LeaveCriticalSection
LoadLibraryExA
TerminateProcess
VirtualAlloc
GetCurrentProcess
VirtualFree
EnterCriticalSection
SetLastError
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringW
ResetEvent
SetEvent
CreateProcessA
InitializeCriticalSectionAndSpinCount
GetFileInformationByHandleEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
IsProcessorFeaturePresent
GetFileAttributesExW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
user32
GetKeyboardLayoutList
CharUpperBuffW
gdi32
GetObjectA
DeleteObject
advapi32
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegGetValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyA
RegDeleteKeyA
CloseServiceHandle
OpenSCManagerW
DeleteService
InitiateSystemShutdownExA
StartServiceA
OpenProcessToken
OpenServiceA
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
msvcp140
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
_Thrd_id
_Thrd_join
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?_Random_device@std@@YAIXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Xtime_get_ticks
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
dbghelp
ImageDirectoryEntryToData
ImageNtHeader
ImageRvaToVa
gdiplus
GdiplusShutdown
GdipSaveImageToStream
GdiplusStartup
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
bcrypt
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptEncrypt
BCryptImportKey
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptSetProperty
ws2_32
setsockopt
WSAStartup
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
strstr
_CxxThrowException
__std_exception_copy
memcpy
memset
memmove
__std_terminate
__current_exception
__std_exception_destroy
memchr
memcmp
__current_exception_context
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_configure_narrow_argv
system
_seh_filter_exe
_set_app_type
_crt_atexit
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_resetstkoflw
_beginthreadex
exit
_invalid_parameter_noinfo_noreturn
terminate
_cexit
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf_s
__acrt_iob_func
_set_fmode
__stdio_common_vsprintf
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-string-l1-1-0
_stricmp
towlower
strcpy_s
strncpy_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
setlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
."Ko Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.7\P Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i$. Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ