gpupdate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

gpupdate.exe
Size

24KB
MD5

c4319a874e88b2db9c964dec17a20eaa
SHA1

a4219e709b6d81e33b16857bda709387f5ecc0c2
SHA256

fb823e865dcc0bcbe540da48ac027405757d50d46d689f92d61ff7867025d488
SHA512

2cfab33b164df4419475ef52e9c219591209579ccc08a9742e796c99969ba8322b144503a6c6aad657e6437d6b6b9d9d534f6a16ceb955609200d4d8b9d3d228
SSDEEP

384:VDlRT3ksKmxTDxuioN9m/2fg9OvR/Q0Rdw4/xpyWFRDWC:PJ0lUDuV5pjw4ppP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gpupdate.exe

Files

gpupdate.exe
.exe windows:10 windows x86 arch:x86

6bdf19a89962002834de95a36c11c970

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

gpupdate.pdb

Imports

advapi32

InitiateSystemShutdownExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation

kernel32

GetLastError
LocalFree
GetCurrentProcess
GetConsoleOutputCP
WaitForMultipleObjects
SetThreadUILanguage
FormatMessageW
CloseHandle
CreateThread
HeapSetInformation
GetModuleHandleW
LocalReAlloc
Sleep
LocalAlloc

msvcrt

_initterm
_exit
?terminate@@YAXXZ
exit
__set_app_type
__wgetmainargs
_amsg_exit
_cexit
__p__commode
_XcptFilter
_except_handler4_common
_lock
_unlock
getwchar
towupper
__dllonexit
_onexit
_wcsnicmp
memmove
_controlfp
__p__fmode
_wsetlocale
_ultow
__setusermatherr
_wcsicmp
wcstol
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_purecall
??3@YAXPAX@Z
__CxxFrameHandler3
_vsnwprintf
wprintf
??1type_info@@UAE@XZ

gpapi

ord115

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

userenv

ForceSyncFgPolicy

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

ntdll

RtlConvertSidToUnicodeString
NtQueryInformationToken
RtlCopySid
RtlLengthSid

user32

ExitWindowsEx

wevtapi

EvtOpenPublisherMetadata
EvtQuery
EvtNext
EvtFormatMessage
EvtClose

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bdf19a89962002834de95a36c11c970

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

gpapi

api-ms-win-core-libraryloader-l1-2-0

userenv

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

user32

wevtapi

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB