WriteUpdateFile[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WriteUpdateFile.exe
Size

16KB
MD5

d24708a2eb0c9f0ca7fa366ad838c6c7
SHA1

f49f427efccf3692ea978a9fb51ec0974c84183a
SHA256

165cf3b9f4593a8b362e8163f11d49d4ac3b6a8e357743f80de387bc6e1d723c
SHA512

625c6a323d352f468e61cfa23bc6343ad2ece873006e5847408cf8528ef4f12a667a50a6e14da90ca549c416776e1002d2e6b1b26ae351154677f64401516aaf
SSDEEP

384:Nv4R9jDHQ9r1N9i/AdebW9UqwFh1DZi1xVBBZf7EBJd+WRybW7Bs/e:K9nwj2sPWEsWW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WriteUpdateFile.exe

Files

WriteUpdateFile.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ