Static task
static1
Behavioral task
behavioral1
Sample
updaterv2.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
updaterv2.exe
Resource
win10v2004-20240709-en
General
-
Target
updaterv2.exe
-
Size
400KB
-
MD5
d2e3f14ae5a8921540b5d6259289c9b9
-
SHA1
7b834634c687dc2f9e7cff639bc83b7a65e42726
-
SHA256
761c29b2129d31ce2854bb1d59a1d80cedf0d49a98096652cd404480f01d33d3
-
SHA512
1321ba43dedc82484e91b1b7a58503173e87f7fa2985e11ab8fee54d4f8ca73e74e8ae823800f18fa984c82c128e631bd7a9b1bd266b78c1c8d6822c0c63510a
-
SSDEEP
12288:rjj60x36gTL0XwXVulDvH835KPdkjd24f:TbLfXVulDvWVjdF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource updaterv2.exe
Files
-
updaterv2.exe.exe windows:5 windows x86 arch:x86
aab50abf2e5b3fc7f8773e67fe3b9c1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
wsock32
WSACleanup
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetUseConnectionW
wininet
FtpOpenFileW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
userenv
LoadUserProfileW
uxtheme
IsThemeActive
user32
GetDC
gdi32
LineTo
comdlg32
GetOpenFileNameW
advapi32
GetAce
shell32
DragFinish
ole32
CoGetObject
oleaut32
LoadTypeLibEx
Sections
.MPRESS1 Size: 309KB - Virtual size: 868KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE