uspdate[.]exe_

Sharing

Copy URL Twitter E-mail

General

Target

uspdate.exe_
Size

73KB
MD5

15cbe6f4dd64b2fed2be1e4b39adad99
SHA1

fb2b6151268040d442f3c5e40050f80287e0d454
SHA256

97badfb66cfbcf175a03272041d11908267696d06671b15523f67463f21768c4
SHA512

cca62683affc855856ab821c1c52bad4b388f11e15a790b1e5d1a8491e04f00f9ea008cf848153f65098a3931c2ba323d76b97c9a838555be0affd7eaebd68ea
SSDEEP

1536:LPdFVmhm2N9wo/8RuM9LHOr9V4PXxpwk1H55:bAQaqEpeLE4vxjH55

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
uspdate.exe_

Files

uspdate.exe_
.exe windows:5 windows x86 arch:x86

449841514fcbd7c2204500e68569ab43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Imports

shlwapi

PathStripPathW

kernel32

CloseHandle
WaitForSingleObject
CreateProcessW
GetStdHandle
CreateFileW
SetThreadPriority
CreateThread
GetModuleFileNameW
GetLastError
CreateFileA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
Sleep
GetTickCount
CopyFileW
DeleteFileW
GetConsoleMode
GetSystemTimeAsFileTime
GetStartupInfoW
HeapAlloc
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
ReadFile
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
SetFilePointer
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA

user32

TranslateMessage
DispatchMessageW
LoadCursorW
RegisterClassExW
DefWindowProcW
GetMessageW
EndPaint
PostQuitMessage
CreateWindowExW
wsprintfW
RegisterDeviceNotificationW
BeginPaint

advapi32

CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

449841514fcbd7c2204500e68569ab43

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

advapi32

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 229KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 229KB