fd1a5a67313356d9c1e600a18b4b1ced2b8f2ebe8b9de86536c0a5288faf9df4
- SHA256 fd1a5a67313356d9c1e600a18b4b1ced2b8f2ebe8b9de86536c0a5288faf9df4
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
update1404.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
update1404.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target fd1a5a67313356d9c1e600a18b4b1ced2b8f2ebe8b9de86536c0a5288faf9df4
- Size 12.4MB
- Sample240712-spqvpayhmn
- SHA256 fd1a5a67313356d9c1e600a18b4b1ced2b8f2ebe8b9de86536c0a5288faf9df4
- MD5 290a14f7f7e791da4aaba87cd4665c33
- SHA1 ebe2226d0d34b0353685d2f517081efddb8621c0
- SHA512 90486f47726e6a7bf2411966ebbcdcdce349e18d5fb4c365da15da64fbb3abe135fcbb21241e2266c531787dce576ae0bdb4616747b8725f40e856d0d901f0b0
- SSDEEP 196608:H4FI2NapZUOTgtxNwVLZqODH+Dr0SPMOLPDggc5oBt2kgHplyXdvWLov72dtKkV:YO0mTTG8V11G1PQoBteeNEKa
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/update1404.exe
File Explorer
-
fd1a5a67313356d9c1e600a18b4b1ced2b8f2ebe8b9de86536c0a5288faf9df4.zip 12.4MB
-
update1404.exe.exe 37.2MB
-
.CRT512B
-
.data718KB
-
.edata512B
-
.idata5KB
-
.pdata453KB
-
.rdata21.4MB
-
.reloc302KB
-
.rsrc/GROUP_ICON/10348B
-
.rsrc/ICON/1.ico9KB
-
.rsrc/ICON/2.ico4KB
-
.rsrc/ICON/3.ico1KB
-
.rsrc/MANIFEST/1.xml 934B
-
.rsrc/version.txt1KB
-
.text14.4MB
-
.tls512B
-
.xdata3KB
update1404.exe
- IMPHASH 7c2fe60df21c5bf7048fa4a414b9ecb8
- SHA256 6f39c1e2b09c4fa76933324da1bf88bcd41a3de381958e3da1c4ec4088b37351
- MD5 7df1209a494797af11d6cfeab44dd5ce
- SHA1 98a4f1282c66486fef9e2fbff538eb1dc8b2dde0
- SHA512 de6b184ae1f520fdf518a11e6097a35d5a68c2b8c09be5028ab2ffde598e357f13322e45283dcea9f5c42402fc970ad8da53bb7f368309e9fb0c75485c57930f
- SSDEEP 196608:28CgA7lmZguiomKaZM5VsQ9reIsfAQSmzF3qp:FCgAlmZQo/aKQme3fAQSmZ3k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddAtomA
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen
_cgo_dummy_export
Name
.text
Size
14.4MB
Virtual Size
14.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
718KB
Virtual Size
718KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
21.4MB
Virtual Size
21.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
453KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
698KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
302KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
.CRT
- SHA256 7c9c1641dfc77f3e66f49ac371a2de8d5e50e8842d10b618d47eed55c7b15626
- MD5 4d5678ad5daf71f3098fd94a094599e4
- SHA1 d093925b07f95843db0a06d7299e4c2b790e59cf
- SHA512 c1cd62feca5d380f620a0ec320c65f31e7a78d176f000dd02b579ed13f17ec810d601366aeaa32e7eb88b541b3936a78273a218376a46180b4a010852761ae0c
- MD5 SHA1 SHA512
.data
- SHA256 bcff940d03d5086d83514c163f81f355ce80d6ff7a93d3285a0fc535d55055da
- MD5 5088056eb025c2477c088386b16f792e
- SHA1 7ed3252fe9dd3777f12b22dc79aba127bc2b1d23
- SHA512 bfbf2217e1b12b190f17fc50d845724d38338a5c1349126d659d5c61ba9f8eb5c79e2b65c7d03a5de86719a87aa3ad1a052cfe3fd4b99e167f638ff9fbd9d9fc
- SSDEEP 6144:9Gi9TiJtf6jlm2hGt2AX+FdIn4b/QIkM9odH:k4Ktf6jlm2hGt25NdkMKdH
- MD5 SHA1 SHA512 SSDEEP
.edata
- SHA256 c0d2f749e63a2661ff014e46b521c5d7cc0d88ea967e4e92f441db93f711823b
- MD5 58120d99d3be1c29ff3474b37c70b5c2
- SHA1 6d936d4954b3009e50edf95381665111c862f798
- SHA512 f6f9d2d0c7efcafb7385d322e0afa4ad4a3b524b7430cddc9cff5312d3f658a61b0bab60cdcdaf583fb50487cfdde25360c56a1acccfde1c151c75d5cdd3ecfc
- MD5 SHA1 SHA512
.idata
- SHA256 52f88ce4ad8ecc6d13da2e861640562e73a53e9b0b1f79339d3435e3e61cb844
- MD5 dc5444e5ea24f4c77218dcf1c8ea8c25
- SHA1 4501ca73bb3a7f0ee55c6fede21936443ca7a26e
- SHA512 e5be166aea57d36decb8936b9b659fc53e59d1e6b76cd7e84027e0fbfc3b478109cc470cd7fa6ca2e624992a6e1ad95f9d1433032f43f11cc01539ac35e651bf
- SSDEEP 96:w8h6cQACMV0uh6cQACMV0uhXMC2EF/ZZhpvDnVnU5y9PtnQYt3j:w80uOu0uO4XMC2EF53nU5y9VnQYVj
- MD5 SHA1 SHA512 SSDEEP
.pdata
- SHA256 45f522adc3f2181b649a5eaf38006ae536cb2d351c241c1f344fcfd5047a2ecf
- MD5 7560e4f926224e964fac820ba1e5a239
- SHA1 cb7be2feb4c70e405fb97ff8dcf8fb62e79e471c
- SHA512 aa13497e013598b96a47507dfc1bd335d9b593003e025f7e5089c99662c67ba39234fa2ef7131c296fc059c8e0263b789d867d9fbde8bbfd7f2c2e30138d6408
- SSDEEP 6144:l8+Cr5Zy0MskSz5zV1DEaJfFYXOK/2ydzfKtNHCNYY:l8bdZy0MsJ/oaLY+rEGnHFY
- MD5 SHA1 SHA512 SSDEEP
.rdata
- SHA256 34071ce32c00592c1796ddff186255f25b4d1f676dc6b33b61dbebf0202e17ec
- MD5 ea91d0384d45b4ffee011949927d7419
- SHA1 4b6d1ba489677af9af1117dc86ec109ac1fa34bd
- SHA512 dda7364ce5f09b67aa0cec94de79d374ebc4f469f4ccdb0d8f99e7b324a57a80f7ad1fa8e95cf567afe5f86943f317eec4f3cebcf522404b1efa7a689be2b860
- SSDEEP 49152:rDVa6lmkpmMr0FXU17pDBmnymsGsN9jwqyOaf5EQB36XCEVGafHyMBEgFCns8HGc:KXU17pDOs0BxEQVQ4DlFWzF3+OAeC
- MD5 SHA1 SHA512 SSDEEP
.reloc
- SHA256 9626815d8e7c4e02d160cba58c6a8a3fbc5386457f5d65fc085385e5e0b14dc6
- MD5 30a9a9230ad0599682d0e5e54282caac
- SHA1 8a61b2728c0ca0b3d25e4f283e9d3d24beb17fbd
- SHA512 7e068d69e304791624c9d12671224bd08c861c91ddda2ce36012bae89c173c0c808bceafc9b41e973b41a27bd518cc6fe63c347eea0eed2756d182d7adfd1d0c
- SSDEEP 1536:9v7Zxjf68rC8TpCByLKirOPy5iEn0cSYLR1x6B5OdQrul3b5GAl9a4RhPFerjdmv:9v7XjfdnTpC7sVLHF5Ccvr
- MD5 SHA1 SHA512 SSDEEP
.rsrc/GROUP_ICON/103
- SHA256 77a1efb6136f52dd2372987b13bf486aa75baeacb93bad009aa3e284c57b8694
- MD5 1ec6a7b3300970378c29695a6cc13d36
- SHA1 99ce74251d19d800608e30bed6e0d793931da56e
- SHA512 cbfc3d0e7f55ed22067adac7a69a20e659c1a282d004c052621dbc884312882feb3c67702ba714fbc45ba853a9afc967904a2b5a73f098bf6bd283f8381772eb
- MD5 SHA1 SHA512
.rsrc/ICON/1.ico
- SHA256 a263c1911ff7c255af8799d3a9a8c0efe286442ee6e1c542c943a7a95e794ec5
- MD5 bcef8b84c20ae5c22c3a9453c846db2e
- SHA1 e0a468998d00cf9f417bd2cf8c3afcbb0a0d2edb
- SHA512 e123124032152d4f30a92f1025ed4d1bc0cb09eb4e281318fa3f5f614db2a4740fc9ab12c79b126d347502084522414aef14470cd4d86e410f8796a4f6c10256
- SSDEEP 192:yJds3dhvbxoDLwNNGQ/8Umn4I5JJpJUkUt8l0C8Y6S8P:yJdsNBxoDLwNNGjUq4I5JJzUkUtT5Y6B
- MD5 SHA1 SHA512 SSDEEP
.rsrc/ICON/2.ico
- SHA256 1de65b7f76674aa36f0d534dc47095bf2b53b4afa7b69592cebf750eb5071114
- MD5 544dd4bf9d2bbc8a0a4657f2e73f2880
- SHA1 5853b3ed2b726e8fc1a25affdc4fb25921cce65b
- SHA512 b5260e8a4d4f87e458e5fd869be756c2475a38104c4f368d224aa39b852ab0eaa0fe62b11e0efb926a1f2ee3c58b580f1f26a297f7afca229a702b8227c580a4
- SSDEEP 96:jXNCGgv8III1ai6P0ssqrjre9xzxtji7sA61n:jbgv0HMsJ8/
- MD5 SHA1 SHA512 SSDEEP
.rsrc/ICON/3.ico
- SHA256 862f0e42e0b25ca9e36171405913f75a90417a560849151c458e093a0a971fc4
- MD5 201dbe706857710effd7f6a59af28d11
- SHA1 4dead73031c5666fab3d92b34c7cc3796dbab9c1
- SHA512 7cfd8d6e1c521f2c7751d77209987aae71b1e11278a483b4a2f9d98a2cb7554ed149255e0ecfdbb12d0548b44060e939564e8f13c27a514713e4e74d9d039e4e
- MD5 SHA1 SHA512
.rsrc/MANIFEST/1
- SHA256 04cf97225bc5c037b9ae4fbb114ddca940d4346e76fc81ceb9e1d1c5d2d40a89
- MD5 c377f3c7c0fc6d263d4fd64f74acdfad
- SHA1 1e3542217b18419179719085a0d9897af824c14b
- SHA512 d1259311f4684f6c5ef85a6c12c4807118701db1e742543b8e8232d49aa90088112a58fed46800804360007139f9d233f303bf38381be739c698a355f0a14ff8
- MD5 SHA1 SHA512
.rsrc/version.txt
- SHA256 8aa542fed0a84e91e6b8933ebc5d9497b6d54cb3f33cd011e9351c095bc999dd
- MD5 8abe23b63d895a984b20b97e205a45c3
- SHA1 e76fa5687228b9c257bc9629cddb722a85d91b43
- SHA512 c3d522e9f16aed2b26b00e12fde2970289aa480b08cb2303584626fa37c3688c464a410ba47249e522c820e1ce11e032cb341e64a44bfdefda27bafa3eac1e1c
- MD5 SHA1 SHA512
.text
- SHA256 009328e88999164abecf4552bbb340c672d57d9f72bd7457b9a288fa6cf14b5f
- MD5 83d9e1df6fb26404c94ab4df92b5415b
- SHA1 37aa77cd206e7fd1621d8a561442528d123a0597
- SHA512 0a1e43d49b20b6faefbbf369122c5c4c8550e67f71312274e158cdc90377cb6247bc5f850d8b93b5441414e3bced79d0128dbb4aad61de4611b5d9cbd077a9e4
- SSDEEP 98304:f8CaT/KV0rLs7R/QsmZgULFn8WIYYAm0Koo2rixa4BSFhmjWa3JM5Vs:f8CgA7lmZguiomKaZM5Vs
- MD5 SHA1 SHA512 SSDEEP
.tls
- SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
- MD5 bf619eac0cdf3f68d496ea9344137e8b
- SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
- SHA512 df40d4a774e0b453a5b87c00d6f0ef5d753143454e88ee5f7b607134598294c7905ccbcf94bbc46e474db6eb44e56a6dbb6d9a1be9d4fb5d1b5f2d0c6ed34bfe
- MD5 SHA1 SHA512
.xdata
- SHA256 5ab6cde3202d221617affcaf8daedf97cc9555b6302f19a64d35d4f9a732720d
- MD5 65fa3e572c9dcf0eb6d5b2025e057b73
- SHA1 fb8c4421929df7e9f5b832ef0aa47a788821dc7c
- SHA512 6660a643bf2746b1329d32890470f02ad6e61101546c988359873e87e7d4a183195ef3de586cf6ee6e187f9820edcb2dbb2cab505ab7c71a2fcc9e068ebe654c
- MD5 SHA1 SHA512