Static task
static1
Behavioral task
behavioral1
Sample
Updater.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Updater.exe
Resource
win10v2004-20240508-en
General
-
Target
Updater.exe
-
Size
2.8MB
-
MD5
dc41e011e5a84694bc8559f323f76935
-
SHA1
f7c39a8a970ebf491fdbba2818a1de205dd751ed
-
SHA256
8e81a843acfadfe1295c60d51ed249a022f8dae87f787880ae3fedd402c0a88e
-
SHA512
1c71d4e01b4d83e047af9a9bf42bab07da7bb64709db412ba321b4cea51156ed5259bf981f0818ced548db3f57f0799e79743db91f0fe8b178cc0e2ae60948a5
-
SSDEEP
49152:5NqMhDAG3RDw+MJj28bLzpN69QqBcXbLVcp64Mxqbi:5NK+GR24NN69QqBcXbLVcMZxqbi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Updater.exe
Files
-
Updater.exe.exe windows:6 windows x64 arch:x64
91533cd0901a926548d904883f897c08
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SleepEx
FreeLibrary
VerSetConditionMask
GetProcAddress
FormatMessageA
LoadLibraryA
UnhandledExceptionFilter
GetModuleHandleA
VerifyVersionInfoA
CreateDirectoryA
GetFileAttributesA
GetLastError
GetCurrentThreadId
SetLastError
ExpandEnvironmentStringsA
ReadFile
GetStdHandle
WaitForMultipleObjects
PeekNamedPipe
GetFileType
WaitForSingleObjectEx
GetFileSizeEx
CreateFileA
RtlCaptureContext
RtlLookupFunctionEntry
QueryPerformanceFrequency
RtlVirtualUnwind
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleFileNameW
CloseHandle
CreateProcessA
Sleep
GetSystemDirectoryA
SetConsoleTitleA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?uncaught_exception@std@@YA_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
__std_terminate
memcpy
__C_specific_handler
memmove
memchr
strrchr
__std_exception_destroy
__current_exception
strchr
memcmp
strstr
memset
_CxxThrowException
_local_unwind
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_crt_atexit
_register_onexit_function
_exit
_initialize_narrow_environment
_set_app_type
__p___argc
terminate
_beginthreadex
exit
__p___argv
_getpid
__sys_nerr
_get_initial_narrow_environment
_initterm
strerror
_configure_narrow_argv
_initterm_e
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_c_exit
_cexit
_errno
api-ms-win-crt-heap-l1-1-0
malloc
calloc
realloc
_set_new_mode
_callnewh
free
api-ms-win-crt-stdio-l1-1-0
fgetc
fwrite
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
fputc
_get_stream_buffer_pointers
fclose
fopen_s
fseek
ftell
rewind
__acrt_iob_func
__stdio_common_vfprintf_s
__stdio_common_vfwprintf_s
__stdio_common_vsprintf_s
ungetc
_close
_open
_write
_read
__p__commode
_set_fmode
_lseeki64
fgets
__stdio_common_vsscanf
fputs
fopen
__stdio_common_vsprintf
fread
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
remove
_unlink
_fstat64
_lock_file
_access
_stat64
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
_gmtime64
strftime
api-ms-win-crt-convert-l1-1-0
strtol
atoi
strtoul
strtoll
api-ms-win-crt-string-l1-1-0
strncmp
tolower
_strdup
_stricmp
isupper
strpbrk
strspn
strcspn
strcmp
strncpy
api-ms-win-crt-environment-l1-1-0
_dupenv_s
getenv
api-ms-win-crt-multibyte-l1-1-0
_mbschr
_mbsnbcpy
_mbsncmp
_mbspbrk
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
crypt32
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertCreateCertificateChainEngine
CryptStringToBinaryA
ws2_32
recvfrom
sendto
freeaddrinfo
ioctlsocket
__WSAFDIsSet
select
bind
WSAIoctl
closesocket
getaddrinfo
WSASetLastError
htonl
getpeername
gethostname
ntohl
send
accept
setsockopt
getsockname
recv
socket
WSAStartup
WSACleanup
listen
htons
ntohs
getsockopt
connect
WSAGetLastError
wldap32
ord79
ord143
ord200
ord27
ord26
ord41
ord46
ord50
ord301
ord211
ord30
ord217
ord35
ord33
ord32
ord45
ord60
ord22
advapi32
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
Sections
.text Size: 372KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 363KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE