update[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

update.exe
Size

132.8MB
MD5

595e2b569d654dbf2e0bcaf28daf39cd
SHA1

fade462f2a1d7e47478694f8f307d8168bbe83d7
SHA256

76d611b46f7bb722e262e8b253abbf8b535b08701e9288c9fdd57023dc4accde
SHA512

194474b4d13b8cc799754e4dd23992d96e80834edfbd0caec073bd6c561949607f1224b687a1f9e1798a7a03824a0531cf0b788c5abd66c5b1637f24c7236622
SSDEEP

3145728:Pn54/DzpjnlrkcqnzsgOJ1pEIdzYQiRBTOvKkgZXJ55dwBksvQglMSUqm9D:P54tNkcqxQboT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update.exe

Files

update.exe
.exe windows x86

efc96589240d86dd7f463f8b0724395d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
SetEndOfFile
WriteConsoleW
HeapReAlloc
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
FindClose
FindFirstFileW
FindNextFileW
GetTempPathW
GetLastError
GetTempFileNameW
CreateDirectoryW
CreateFileW
DeleteFileW
FormatMessageW
LocalAlloc
lstrlenW
LocalSize
LocalFree
LoadLibraryW
GetProcAddress
GetCurrentDirectoryW
SetCurrentDirectoryW
GetUserDefaultLangID
CloseHandle
FreeLibrary
GetCurrentProcess
CreateFileA
GetFileType
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryA
DosDateTimeToFileTime
CreateDirectoryA
WriteFile
SetFileTime
CompareStringW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleFileNameW
HeapCreate
HeapSize
Sleep
ExitProcess
SetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
GetStdHandle
SetHandleCount
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
ExitThread
ResumeThread
CreateThread
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
EnterCriticalSection

user32

WaitForInputIdle
SetCursor
PostMessageW
GetMessageW
RegisterClassExW
LoadCursorW
PostQuitMessage
DestroyWindow
DefWindowProcW
EndPaint
DrawIcon
GetClientRect
BeginPaint
MoveWindow
GetSystemMetrics
GetIconInfo
LoadIconW
UpdateWindow
ShowWindow
GetWindowLongW
SetWindowLongW
CreateWindowExW
DispatchMessageW
TranslateMessage
MessageBoxW
wsprintfW
LoadStringW

shell32

ShellExecuteExW
SHFileOperationW

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132.7MB - Virtual size: 132.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

efc96589240d86dd7f463f8b0724395d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 132.7MB - Virtual size: 132.7MB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 132.7MB - Virtual size: 132.7MB

.reloc
Size: 8KB - Virtual size: 7KB