Windows Update Clean Tool[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Windows Update Clean Tool.exe
Size

2.0MB
MD5

0102b2ed3c476f27716cc03fc6e6b435
SHA1

43a13be63a080c990bb648dd44fe8b678cbfcc02
SHA256

12b4e8e99b8692f2fc859cc851c358b5258e68fb05ba415dd09c492be7b72fc9
SHA512

06efdc75480532adb6521c969a9e76326b5870ee7f3719269918d89d1a5f50cd7d88cc99048e065c4ba93d6031c11a3a9cdd0de5d948d3d323366c20754b8d8d
SSDEEP

49152:lfRSPMYE4TouSwIbFLOAkGy3zdnErPSCTomFDS+BHEuSlVnPgbQp:lRFLOAkGkzdnEVomFHKnP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows Update Clean Tool.exe

Files

Windows Update Clean Tool.exe
.exe windows:6 windows x86 arch:x86

176a9f52aeaf9048a972b7570ef11281

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\个人资料\桌面\项目\MainTool\Release\Windows Update Clean Tool.pdb

Imports

kernel32

GlobalHandle
LocalReAlloc
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SetErrorMode
GlobalFlags
InterlockedIncrement
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetCurrentDirectoryW
GetCommandLineW
GetModuleHandleExW
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
CreateTimerQueueTimer
CreateTimerQueue
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
HeapAlloc
HeapFree
OutputDebugStringW
SwitchToThread
CreateThread
GetThreadTimes
FreeLibraryAndExitThread
HeapReAlloc
RtlUnwind
SetStdHandle
GetFileType
HeapSize
HeapQueryInformation
GetStdHandle
GetProcessHeap
QueryPerformanceCounter
GlobalReAlloc
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateSemaphoreW
IsValidCodePage
GetOEMCP
GetCPInfo
GetTimeZoneInformation
DeleteTimerQueueTimer
GetProcessAffinityMask
SetThreadAffinityMask
GetTickCount
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InitializeSListHead
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStringTypeW
GetThreadPriority
UnregisterWait
GetDriveTypeW
WriteConsoleW
SignalObjectAndWait
SetEnvironmentVariableA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
MulDiv
LocalAlloc
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
lstrcmpA
GlobalAlloc
GetCurrentThread
InterlockedExchange
GetCurrentProcessId
InterlockedDecrement
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
FreeLibrary
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GlobalFree
GlobalUnlock
GlobalLock
FreeResource
LoadLibraryW
LoadLibraryA
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
GetVersion
DuplicateHandle
OutputDebugStringA
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetFullPathNameW
GetFileSize
FlushFileBuffers
FileTimeToSystemTime
GetProcAddress
GetModuleHandleW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
SetLastError
InitializeCriticalSectionAndSpinCount
GetACP
WideCharToMultiByte
InitializeCriticalSectionEx
CreateMutexW
GetSystemDefaultLangID
ExitProcess
CreateFileW
GetFileAttributesW
LocalFree
FormatMessageW
GetSystemDirectoryW
GetLogicalDriveStringsW
GetVolumeInformationW
GetDiskFreeSpaceW
ReadFile
CloseHandle
CreateProcessW
GetStartupInfoW
CreatePipe
GetCurrentProcess
GetVersionExW
MultiByteToWideChar
RemoveDirectoryW
SetFileAttributesW
CreateHardLinkW
Sleep
CreateDirectoryW
GetLastError
GetWindowsDirectoryW
MoveFileExW
DeleteFileW
MoveFileW
FindResourceW
LoadResource
LockResource
SizeofResource
Wow64DisableWow64FsRedirection
GetEnvironmentStringsW
RaiseException

user32

InvalidateRect
KillTimer
SetTimer
UnregisterClassW
LoadCursorW
GetSysColorBrush
DestroyMenu
RealChildWindowFromPoint
ClientToScreen
EndPaint
BeginPaint
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
SetCursor
GetCursorPos
TranslateMessage
GetMessageW
PostQuitMessage
GetWindowThreadProcessId
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
SetWindowTextW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
GetSysColor
MapWindowPoints
ScreenToClient
MessageBoxW
AdjustWindowRectEx
GetWindowRect
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
RedrawWindow
ValidateRect
GetForegroundWindow
UpdateWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
SetWindowPos
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
CopyRect
ReleaseDC
GetDC
GetDesktopWindow
GetWindowLongW
SetActiveWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsWindow
CharUpperW
GetParent
SendDlgItemMessageA
IsWindowVisible
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
LoadIconW
SetForegroundWindow
ShowWindow
FindWindowW
ExitWindowsEx
SendMessageW
EnableWindow
GetWindowTextW

gdi32

SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SetViewportOrgEx
SetMapMode
SetViewportExtEx
ExtTextOutW
TextOutW
SelectObject
SaveDC
RestoreDC
RectVisible
PtVisible
GetStockObject
GetDeviceCaps
GetClipBox
Escape
DeleteObject
DeleteDC
CreateBitmap
GetObjectW
SetTextColor
SetBkColor

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

OpenProcessToken
RegQueryValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegOpenKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyW
RegLoadKeyW
RegUnLoadKeyW
RegCloseKey
RegOpenKeyExW
RegEnumKeyW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW
PathFileExistsW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathFindFileNameW
UrlUnescapeW
PathRemoveFileSpecW

ole32

CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoTaskMemFree

oleaut32

SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocString

wimgapi

WIMGetAttributes
WIMCloseHandle
WIMLoadImage
WIMGetImageInformation
WIMRegisterMessageCallback
WIMCaptureImage
WIMSetImageInformation
WIMUnregisterMessageCallback
WIMApplyImage
WIMSetTemporaryPath
WIMCreateFile

oleacc

CreateStdAccessibleObject
LresultFromObject

wininet

InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile
InternetSetFilePointer
InternetWriteFile
InternetQueryDataAvailable
InternetQueryOptionW

Sections

.text
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

176a9f52aeaf9048a972b7570ef11281

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

wimgapi

oleacc

wininet

Sections

.text Size: 436KB - Virtual size: 436KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 26KB - Virtual size: 43KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 116KB - Virtual size: 115KB

.text
Size: 436KB - Virtual size: 436KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 26KB - Virtual size: 43KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 116KB - Virtual size: 115KB