update[.]exe | Triage™

General

Target
update.exe
Size 671KB
Sample231004-ef7vysah26
SHA256 ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0deb
MD5 221bb71916e1e9d532ae7022869d55ae
SHA1 241dc48d97b2f7527c21f3bb78ab1646de099b18
SHA512 14af6d828ccd7712b2ceb4ee8a2129ee4ae11a492034ec0f904edf4e4585ccb3e7f98fc54641d7443998c621ad49edba8654fc811351f7968f60b8d39500718b
SSDEEP 12288:jgN4/W78H0gxU2QYLMoXbCrcp2YhRLvLY9YhT6oc8kJrhr4QD2s0BC+:OUW7u0T2TL/XmqhhY9YV6oc8k7r4q0l
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update.exe

File Explorer

update.exe

.exe 671KB

update.exe

IMPHASH 96baacc90461fcd4b5d9fcc50047c098
SHA256 ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0deb
MD5 221bb71916e1e9d532ae7022869d55ae
SHA1 241dc48d97b2f7527c21f3bb78ab1646de099b18
SHA512 14af6d828ccd7712b2ceb4ee8a2129ee4ae11a492034ec0f904edf4e4585ccb3e7f98fc54641d7443998c621ad49edba8654fc811351f7968f60b8d39500718b
SSDEEP 12288:jgN4/W78H0gxU2QYLMoXbCrcp2YhRLvLY9YhT6oc8kJrhr4QD2s0BC+:OUW7u0T2TL/XmqhhY9YV6oc8k7r4q0l
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

40291

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

DeleteAce

kernel32

FreeConsole GetCurrentThreadId CloseHandle WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateFileW RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Sharing