Updater[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Updater.exe
Size

10.6MB
MD5

4a5335842808b37991cc865743197ebc
SHA1

f0f8db3f4db8fc7cc768890a6c8b8965ddec76d1
SHA256

4940faef2fff61260c56ae5897fe2aab69c76da797b22ac6a93dedf67e62c50e
SHA512

bccc2b8e762a2395aeba57a72e647d39eacee164ac8ab0a49eb7ac72d6ffd342a0756c4e35281e9d4e160838607e91f240ab6107a83438cdb3be4fcd7bbf6b14
SSDEEP

98304:94+cgY4rTjUC4yL+twR3PnjJ5eS1hc7/pBD+9dyWnuT:q6UPyLIwR3Pn+S3c7/pBD+/yWuT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Updater.exe

Files

Updater.exe
.exe windows:6 windows x64

3896ed3ac4f62ef7a615d805df91f8ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdiplus

GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdiplusStartup
GdipFree
GdiplusShutdown

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

wininet

InternetReadFile
InternetOpenUrlA
InternetConnectA
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCloseHandle

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString
CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo

ole32

GetHGlobalFromStream
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal

user32

SetCursorPos
DispatchMessageA
EnumDisplayDevicesA
GetMonitorInfoA
EnumDisplayMonitors
GetMessageExtraInfo
TranslateMessage
GetMessageA
WaitForInputIdle
UnregisterClassA
FindWindowA
SendMessageTimeoutA
ShowWindow
GetWindowTextA
CallNextHookEx
EnumWindows
SendInput
UnhookWindowsHookEx
SetWindowsHookExA
GetKeyState
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
GetCursorPos
GetForegroundWindow
GetDC
ReleaseDC
GetDesktopWindow
MonitorFromPoint
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
wsprintfW

crypt32

CertOpenStore
CertCloseStore
CryptUnprotectData
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreW

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx

kernel32

FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
WakeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
LCMapStringEx
EncodePointer
GetStringTypeW
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CopyFileW
CreateDirectoryExW
DeviceIoControl
AreFileApisANSI
DecodePointer
GetLastError
SetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LocalFree
GetDiskFreeSpaceExA
GetLogicalDrives
GetTempPathA
GetVolumeInformationA
CloseHandle
GetCurrentProcessId
TerminateProcess
OpenProcess
GetModuleFileNameA
GetLogicalDriveStringsA
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetModuleFileNameExA
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
Sleep
GetCurrentProcess
GetModuleHandleA
GetProcAddress
LoadLibraryA
SetThreadExecutionState
QueryFullProcessImageNameW
CopyFileA
CopyFileExW
MoveFileExW
Process32FirstW
Process32NextW
GlobalUnlock
GlobalLock
GetStdHandle
GetConsoleMode
SetConsoleMode
GetConsoleWindow
K32EnumProcessModules
K32GetModuleBaseNameA
CreateMutexW
K32EnumProcesses
GetModuleFileNameW
FreeLibrary
CreateThreadpoolWait
K32GetModuleFileNameExW
FindFirstFileExW
FindNextFileW
GetFullPathNameW
GlobalSize
GlobalFree
GetTempPathW
OutputDebugStringA
lstrcatW
GetNativeSystemInfo
LocalAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
lstrlenW
CreateFileA
GetFileInformationByHandle
GetFileSize
ReadFile
SetFilePointer
WriteFile
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
lstrcpynA
lstrcpyA
lstrcatA
CreateFileMappingA
FileTimeToSystemTime
SystemTimeToFileTime
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryA
FormatMessageA
GetFileType
GetModuleHandleW
GetModuleHandleExW
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
VirtualLock
GetEnvironmentVariableW
GetSystemTimeAsFileTime
GetACP
SwitchToFiber
DeleteFiber
CreateFiberEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
WaitForSingleObject
GetSystemTime
ConvertFiberToThread
ConvertThreadToFiberEx
FindFirstFileW
ReadConsoleA
ReadConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
QueryPerformanceCounter
InitializeSListHead
SetFileTime
SetThreadpoolWait
CloseThreadpoolWait
CompareStringEx
GetCPInfo
OutputDebugStringW
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
HeapSize
HeapValidate
DuplicateHandle
CreateProcessW
ExitProcess
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
GetCommandLineA
GetCommandLineW
GetCurrentThread
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
HeapQueryInformation
GetExitCodeProcess
CreatePipe
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetOEMCP
SetFileInformationByHandle
GetFinalPathNameByHandleW
GetFileAttributesExW
GetDiskFreeSpaceExW
CreateFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetLocaleInfoEx
TryAcquireSRWLockExclusive
SwitchToThread
SetEnvironmentVariableW
SetEndOfFile
LoadLibraryW
GetExitCodeThread
QueryPerformanceFrequency

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject

advapi32

RegSetValueExA
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
LookupAccountSidW
GetUserNameW
LookupPrivilegeValueA
ImpersonateLoggedOnUser
DuplicateTokenEx
SetThreadToken
CreateProcessAsUserW
RegSetValueExW
RegOpenKeyExW
FreeSid
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken

shell32

SHGetFolderPathW
ShellExecuteA
SHGetKnownFolderPath
ShellExecuteExA
ShellExecuteExW
SHFileOperationA
SHGetFolderPathA

urlmon

URLDownloadToFileA

iphlpapi

GetAdaptersInfo
GetExtendedTcpTable
GetExtendedUdpTable

ws2_32

bind
accept
send
recv
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_addr
setsockopt
WSAGetLastError
gethostbyname
select
ntohs
getsockopt
getsockname
ioctlsocket
inet_ntoa
freeaddrinfo
getaddrinfo
shutdown
connect
closesocket
listen
WSACleanup
WSAStartup
socket
htons
htonl

Sections

.textbss
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 389KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 671B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3896ed3ac4f62ef7a615d805df91f8ba

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

setupapi

wininet

oleaut32

ole32

user32

crypt32

ntdll

kernel32

gdi32

advapi32

shell32

urlmon

iphlpapi

ws2_32

Sections

.textbss Size: - Virtual size: 3.9MB

.text Size: 8.0MB - Virtual size: 8.0MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 67KB - Virtual size: 105KB

.pdata Size: 389KB - Virtual size: 388KB

.idata Size: 19KB - Virtual size: 18KB

.msvcjmc Size: 20KB - Virtual size: 20KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 373B

_RDATA Size: 1024B - Virtual size: 671B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 94KB - Virtual size: 93KB

.textbss
Size: - Virtual size: 3.9MB

.text
Size: 8.0MB - Virtual size: 8.0MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 67KB - Virtual size: 105KB

.pdata
Size: 389KB - Virtual size: 388KB

.idata
Size: 19KB - Virtual size: 18KB

.msvcjmc
Size: 20KB - Virtual size: 20KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 373B

_RDATA
Size: 1024B - Virtual size: 671B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 94KB - Virtual size: 93KB