ERPIFUpdate[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ERPIFUpdate.exe
Size

316KB
MD5

0640b9c0e7e2481c146e3734b4e0b4fd
SHA1

b0269cbdabbf75bbf53fecda26735fec428000e4
SHA256

abe0e9d0a2c4bb2ea67125bcef5242a0912b98e0cb51dc78f1de1cc5d2d76cd3
SHA512

eac7b2dc5eda0a55aea11a6fab94ff26bff9905f3f0d65a91d7c1ae8ea39f3d3ae036da4df1dba9f3c1ad1a7d8b67a96d71151375cb568a2f1890744b194b0f8
SSDEEP

6144:XWnX4BeE+D7ljou7yGQBcd+QX7WREWUXm80nh:b+HlEu2GYcdTaRGXmBh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ERPIFUpdate.exe

Files

ERPIFUpdate.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ