Windows-KB2670838[.]msu[.]exe | Triage

Sharing

General

Target

Windows-KB2670838.msu.exe
Size

728KB
MD5

6e49c75f701aa059fa6ed5859650b910
SHA1

ccb7898c509c3a1de96d2010d638f6a719f6f400
SHA256

f91f02fd27ada64f36f6df59a611fef106ff7734833dea825d0612e73bdfb621
SHA512

ccd1b581a29de52d2313a97eb3c3b32b223dba1e7a49c83f7774b374bc2d16b13fba9566de6762883f3b64ed8e80327b454e5d32392af2a032c22653fed0fff8
SSDEEP

12288:5P/dTi0RF8dlFepPB0RF8dlFodTqPtoUBJMlANI/:5P/QBCpZB0iv8ld/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows-KB2670838.msu.exe

Files

Windows-KB2670838.msu.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Visual Studio Projects\WindowsUpdate\WindowsUpdate\obj\Release\Windows-KB2670838.msu.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 517KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ