Static task
static1
Behavioral task
behavioral1
Sample
Update.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Update.exe
Resource
win10v2004-20240802-en
General
-
Target
Update.exe
-
Size
253KB
-
MD5
e983253ae3545f9f6d23145cad90a738
-
SHA1
3966acf98bff5689c19937ad685ace38fa0a1d41
-
SHA256
85c1d81652a892c6abea20df3690c8b51caac195547f428d74538aff0883038d
-
SHA512
237447a0810255ebe69ec06a0d6c9c51b01387f893b2f9ac8e90ac58d101357accb608b572378c9d1e73ee37524e7c952e83fcfcafef557106b32bfeb572fd6a
-
SSDEEP
6144:oESYEHrsnmMT+WgKMAzUbLONCDSQCNX3HJR2liC8PD92:ocYr2XTqKMAzwdD23HJxx2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Update.exe
Files
-
Update.exe.exe windows:6 windows x64 arch:x64
Password: 111
74b4ba740c9ad200f68d41be5f21ff19
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
lstrcatW
CloseHandle
GetProcAddress
GlobalLock
GlobalUnlock
CreateMutexA
HeapFree
HeapAlloc
GetProcessHeap
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
GlobalSize
GetLastError
Sleep
GetModuleHandleA
WaitForSingleObject
FindClose
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
SetFilePointer
GetModuleFileNameW
ReadFile
IsValidCodePage
FindNextFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
FindFirstFileExW
user32
GetDC
ReleaseDC
GetSystemMetrics
gdi32
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteObject
ole32
GetHGlobalFromStream
CreateStreamOnHGlobal
wininet
InternetCloseHandle
InternetReadFile
gdiplus
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipCloneImage
GdipGetImageEncoders
iphlpapi
GetAdaptersInfo
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ