c66dae5fe5a7550df3c3cb51bdf3235e7c16c54c9fedb385af59887a48134d1f
- SHA256 c66dae5fe5a7550df3c3cb51bdf3235e7c16c54c9fedb385af59887a48134d1f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Update-AV.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
General
- Target c66dae5fe5a7550df3c3cb51bdf3235e7c16c54c9fedb385af59887a48134d1f
- Size 125KB
- Sample240410-reb34sad57
- SHA256 c66dae5fe5a7550df3c3cb51bdf3235e7c16c54c9fedb385af59887a48134d1f
- MD5 ec1f0609cb23e09d481d6e17713ee76e
- SHA1 3141cbacf3146c9c273b7d3ec0454494f67ff7a4
- SHA512 c30cc818da37dff69184442abf155cc4f3b0a0f8cc34d79fb0729244d2c00c3163f0922f5366370a7e3c3544d91323aedf985cc6dcbc2b06d5b2d34089f913ff
- SSDEEP 3072:qhwUekmWWQXXkH7TdAGyau5ljOPBbzeDkn1:FUekmWy7ZAGyapPBb6O
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Update-AV.exe
File Explorer
-
c66dae5fe5a7550df3c3cb51bdf3235e7c16c54c9fedb385af59887a48134d1f.zip 125KB
-
Update-AV.exe.exe 223KB
Update-AV.exe
- IMPHASH 8f3b883f63bfc01a6dacbc74bf6f7699
- SHA256 ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9
- MD5 893b17ed65ecffa8376063349f22d2bc
- SHA1 50c556277899d6b9da5ec125c0a58650a14a08a7
- SHA512 e61a215547991592a204868a979ec513198a6ba192a692a97ccba352c427dc1721a433c0aaaa98107f2d91ae5d2b0aad57ea9ea86ca48a0d61b8a48ecef6b787
- SSDEEP 3072:EwA6vAcT6agXrIISqRIYrCNrACDJi7kX9ne6uDxj5AiOhtSvLt2b:6cT6PXrI/qRIZrACGkX9niILtUt2b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
28355
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\lorec53_niyu-femebovoyipo_giguma-remex-gozu.pdb
kernel32
WriteConsoleW
GetSystemPowerStatus
DeleteVolumeMountPointW
GetDefaultCommConfigW
CreateMutexW
GetStdHandle
InterlockedDecrement
SetSystemTimeAdjustment
FileTimeToSystemTime
GetNamedPipeHandleStateW
CallNamedPipeW
EnumResourceNamesW
BuildCommDCBAndTimeoutsA
EnterCriticalSection
DebugSetProcessKillOnExit
EnumTimeFormatsW
TlsSetValue
GetACP
WriteFile
GetCurrentActCtx
ReleaseActCtx
AddRefActCtx
GetHandleInformation
OpenFile
VerifyVersionInfoA
GetVersionExA
FreeLibrary
LoadLibraryExW
GetComputerNameA
CommConfigDialogA
VirtualProtect
GetProcessPriorityBoost
LoadLibraryW
GlobalAlloc
SetEndOfFile
CancelWaitableTimer
GetCurrentDirectoryW
VirtualFree
GetCommMask
HeapFree
RaiseException
GetBinaryTypeA
LocalSize
SetConsoleMode
GetLargestConsoleWindowSize
WriteConsoleInputW
OpenMutexW
SetThreadContext
AddAtomW
FindVolumeMountPointClose
GetSystemTime
GetCommandLineA
SetLocalTime
GetSystemTimeAsFileTime
DisconnectNamedPipe
SetConsoleCursorInfo
TerminateThread
GetFileAttributesW
GetLastError
lstrlenA
CompareStringW
CompareStringA
lstrcpyA
CreateJobObjectW
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoA
HeapAlloc
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCurrentThread
Sleep
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetOEMCP
IsValidCodePage
FatalAppExitA
VirtualAlloc
HeapReAlloc
HeapSize
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FlushFileBuffers
GetLocaleInfoW
CreateFileA
CloseHandle
GetTimeZoneInformation
SetEnvironmentVariableA
user32
GetComboBoxInfo
advapi32
ClearEventLogW
Name
.text
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
39.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=20, id=149, productName=VS2008 build 21022, version=21022,
count=115, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=135, id=1, productName=Unmarked objects,
count=45, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,