updater.pdb
Static task
static1
Behavioral task
behavioral1
Sample
updater.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
updater.exe
Resource
win10v2004-20240730-en
General
-
Target
updater.exe
-
Size
10.9MB
-
MD5
1c28034e116afe153b3b302a724c6d78
-
SHA1
e9f8cabd63fd4d63193ff474876f6a8b7fb98c00
-
SHA256
14e0ffd153b81fddd493dc323d574024696e0dbbef43e8ef02de3478162b8138
-
SHA512
09bbd832b0a1263d970ff848e9a3a76e2225c0fe22c668c6df35df25f91c1a6465425d3cfbb375b9fab235e32a82289f1db1dc716b121eb608fe7b5952d039ba
-
SSDEEP
98304:wK0QVCU1FA6WWB6kad0lTXvXeksplGcBmJNcZT+nTqGgjAGM8o:HlA6j4/Wl7eN9A8Mj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource updater.exe
Files
-
updater.exe.exe windows:6 windows x64 arch:x64
13734ad1f261b150b9bae9fc41ce6d38
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
user32
SetWindowLongPtrW
ValidateRect
PostThreadMessageW
GetUpdateRect
DefWindowProcW
RegisterClassExW
ScreenToClient
GetMenu
DestroyWindow
LoadCursorW
SetCursor
MonitorFromRect
TrackMouseEvent
GetTouchInputInfo
CreateIcon
InvalidateRgn
GetClientRect
AdjustWindowRectEx
GetWindowLongW
SetWindowLongW
SendMessageW
EnableMenuItem
GetSystemMenu
ShowWindow
SetWindowPos
IsIconic
CloseTouchInputHandle
SetWindowDisplayAffinity
RegisterTouchWindow
ClipCursor
GetClipCursor
ShowCursor
GetCursorPos
GetRawInputData
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetSystemMetrics
ClientToScreen
GetWindowLongPtrW
SetForegroundWindow
FlashWindowEx
DispatchMessageW
TranslateMessage
PeekMessageW
SendInput
MapVirtualKeyW
RedrawWindow
PostMessageW
SetWindowTextW
MonitorFromPoint
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
GetKeyState
MapVirtualKeyA
SystemParametersInfoA
IsProcessDPIAware
DestroyIcon
SetCapture
GetMessageW
MsgWaitForMultipleObjectsEx
ChangeDisplaySettingsExW
RegisterWindowMessageA
RegisterRawInputDevices
GetWindowPlacement
CloseClipboard
GetDC
CreateWindowExW
SetClipboardData
EmptyClipboard
GetClipboardData
OpenClipboard
SetWindowPlacement
IsWindowVisible
ReleaseCapture
GetForegroundWindow
GetActiveWindow
kernel32
LoadLibraryA
GlobalSize
CloseHandle
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalAlloc
GetCurrentThreadId
GlobalFree
GetFullPathNameW
CreateThread
WriteConsoleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetFileAttributesW
CreateProcessW
RtlVirtualUnwind
GetLastError
Sleep
FormatMessageW
GetProcAddress
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
CreateNamedPipeW
ExitProcess
GetFinalPathNameByHandleW
SetHandleInformation
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
GetFileInformationByHandle
WideCharToMultiByte
FindClose
FindNextFileW
HeapReAlloc
GetSystemTimePreciseAsFileTime
TerminateProcess
CreateIoCompletionPort
GetQueuedCompletionStatusEx
SleepEx
PostQueuedCompletionStatus
WriteFileEx
SetFileCompletionNotificationModes
GetStdHandle
QueryPerformanceFrequency
QueryPerformanceCounter
WaitForSingleObject
RemoveVectoredExceptionHandler
GetModuleHandleW
AddVectoredExceptionHandler
LoadLibraryExW
MultiByteToWideChar
SetFilePointerEx
FreeLibrary
GetModuleFileNameW
SetThreadErrorMode
RtlCaptureContext
RtlLookupFunctionEntry
ReleaseMutex
GetCurrentProcess
WaitForSingleObjectEx
GetCurrentProcessId
CreateMutexA
lstrlenW
GetProcessHeap
HeapFree
SetFileInformationByHandle
HeapAlloc
GetCommandLineW
GetEnvironmentVariableW
CreateEventA
GetConsoleMode
GetModuleHandleA
GetSystemInfo
GetUserPreferredUILanguages
CreateFileMappingW
MapViewOfFile
DuplicateHandle
UnmapViewOfFile
VirtualProtect
GlobalLock
CreateFileW
GlobalUnlock
GetEnvironmentStringsW
GetCurrentDirectoryW
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
SetLastError
IsProcessorFeaturePresent
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
RegisterDragDrop
OleInitialize
RevokeDragDrop
gdi32
CreateRectRgn
GetDeviceCaps
DeleteObject
StretchDIBits
dwmapi
DwmEnableBlurBehindWindow
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
ws2_32
WSAStartup
getsockname
getpeername
WSASocketW
bind
connect
ioctlsocket
getsockopt
shutdown
recv
send
WSASend
setsockopt
WSAIoctl
getaddrinfo
WSAGetLastError
freeaddrinfo
closesocket
WSACleanup
shell32
DragFinish
DragQueryFileW
winmm
timeGetDevCaps
timeEndPeriod
timeBeginPeriod
uxtheme
SetWindowTheme
imm32
ImmGetCompositionStringW
ImmGetContext
ImmAssociateContextEx
ImmReleaseContext
ntdll
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCancelIoFileEx
NtCreateFile
NtReadFile
NtWriteFile
d3dcompiler_47
D3DCompile
oleaut32
GetErrorInfo
SysStringLen
SysFreeString
bcrypt
BCryptGenRandom
userenv
GetUserProfileDirectoryW
vcruntime140
memcpy
__current_exception_context
__current_exception
__CxxFrameHandler3
memcmp
memmove
memset
__C_specific_handler
api-ms-win-crt-math-l1-1-0
round
fmaf
fmodf
_hypotf
floorf
roundf
ceil
powf
exp2f
trunc
tan
floor
cosf
acosf
pow
sinf
exp2
ceilf
__setusermatherr
expf
tanf
cos
truncf
acos
fmod
atan2
sin
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
strerror
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_initialize_narrow_environment
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Sections
.text Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ