Static task
static1
Behavioral task
behavioral1
Sample
update_2_13.exe
Resource
win11-20240426-fr
General
-
Target
update_2_13.exe
-
Size
4.1MB
-
MD5
a91b7a546e13123a5cefc1df8a1fb48e
-
SHA1
c26a80ac5aeb459cda17e3232d49b2695aca65cf
-
SHA256
80a10cb2ebe68b26684e28163966efb052ad7e162546b8e5616fe9dcd9ddb9fe
-
SHA512
30290754fbb76401fe3c55da2a3620ed678c00aea71a4d2196237609745b333254bba55a68d3e6784701bad4d844d9cbe617e3a1f37bfcd121dc6490bb4e73c4
-
SSDEEP
98304:m705oAuq+gx5lmrC9AODtoxvUOOqJRgdXiBUwCC3Pe:m7vhgxF9AOtgvUOzgA5V/e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource update_2_13.exe
Files
-
update_2_13.exe.exe windows:6 windows x64 arch:x64
68aee62f17b96882fbf022bff911fbe0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQuerySystemInformation
RtlAdjustPrivilege
RtlInitAnsiString
RtlAnsiStringToUnicodeString
NtClose
kernel32
SetFileAttributesW
Sleep
GetLastError
CreateFileA
DeleteFileW
CloseHandle
GetProcAddress
DeleteCriticalSection
CopyFileW
QueryFullProcessImageNameW
CreateProcessA
LocalFree
GetCurrentProcessId
ReadFile
WriteFile
CreateFileW
GetFileAttributesA
LoadLibraryA
DeleteFileA
GetFirmwareEnvironmentVariableW
GetStdHandle
PeekConsoleInputA
ReadConsoleInputA
FlushConsoleInputBuffer
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
OpenProcess
GetModuleHandleA
WaitForSingleObject
GetFileAttributesW
InitializeCriticalSectionEx
LeaveCriticalSection
LoadLibraryExA
TerminateProcess
VirtualAlloc
GetCurrentProcess
VirtualFree
EnterCriticalSection
SetLastError
GetModuleFileNameA
WideCharToMultiByte
OutputDebugStringW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LocalAlloc
QueryPerformanceCounter
MultiByteToWideChar
GetFileInformationByHandleEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
GetCurrentThreadId
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
user32
GetKeyboardLayoutList
gdi32
GetObjectA
DeleteObject
advapi32
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegGetValueW
RegCreateKeyA
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyA
RegDeleteKeyA
CloseServiceHandle
OpenSCManagerW
DeleteService
StartServiceA
RegSetValueExA
OpenProcessToken
OpenServiceA
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
msvcp140
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
_Thrd_id
_Thrd_join
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?_Random_device@std@@YAIXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Xtime_get_ticks
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Thrd_detach
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
dbghelp
ImageDirectoryEntryToData
ImageNtHeader
ImageRvaToVa
gdiplus
GdiplusShutdown
GdipCreateBitmapFromScan0
GdiplusStartup
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipSaveImageToStream
bcrypt
BCryptEncrypt
BCryptDestroyKey
BCryptGetProperty
BCryptImportKey
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
ws2_32
WSAStartup
setsockopt
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
__std_exception_copy
memmove
memcpy
__std_terminate
memcmp
memchr
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
exit
system
_resetstkoflw
_errno
_beginthreadex
terminate
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-string-l1-1-0
strcpy_s
_stricmp
towlower
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
setlocale
localeconv
api-ms-win-crt-convert-l1-1-0
strtoll
strtoull
strtod
api-ms-win-crt-math-l1-1-0
_dclass
__setusermatherr
Sections
.text Size: - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.(dv Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.&>" Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Agd Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ