KbUpdate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

KbUpdate.exe
Size

40KB
MD5

12fd9100e372806c878c33f109ceed7c
SHA1

437d242477bd53e156280a33fd81118f09a6d4dd
SHA256

54d3f21009acde870817cd42597447786f7c728183fa16966bdeebb1bc3c87e5
SHA512

28aeb4b632e838a1d7015d7181861ac52d3e813e687d691fbe51c1884f1af9ffffb5719eecadbc7206cd1fe4e05330695fb5c9c4d59941de59043ded501ffdef
SSDEEP

768:Oy8XL+hQQ88KeFhFzdHW3fgwvcw8sggyBee9z0Bc:Oy2k8mz43xGgyBeazmc

Score

1^/10

Malware Config

Signatures

Files

KbUpdate.exe
.exe windows:6 windows x64 arch:x64

1998dec811e24c791887ac17ff8db2f0

Code Sign

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:08

Not After

14/11/2024, 19:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:73:6a:4b:c3:ab:80:54:79:01:91:06:ee:eb:3b:a0:33:74:e4:a6:ba:fc:5d:f8:fc:41:62:4d:91:de:f7:c1
Signer

Actual PE Digest

6a:73:6a:4b:c3:ab:80:54:79:01:91:06:ee:eb:3b:a0:33:74:e4:a6:ba:fc:5d:f8:fc:41:62:4d:91:de:f7:c1

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\user\source\repos\MW-BLACK-Shell\x64\Release\MW-BLACK-Shell.pdb

Imports

kernel32

GetModuleFileNameA
CreateMutexA
WaitForSingleObject
Sleep
GetLastError
CloseHandle
FreeConsole
GetModuleHandleW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext

msvcp140

??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
_CxxThrowException
__C_specific_handler
__current_exception_context
__std_terminate
__std_exception_copy
__std_exception_destroy
memcpy
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_cexit
__p___argv
terminate
__p___argc
_c_exit
_initterm
exit
_crt_atexit
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_exit
_initterm_e
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free
_set_new_mode

api-ms-win-crt-string-l1-1-0

_wcslwr_s
wcscpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1998dec811e24c791887ac17ff8db2f0

Code Sign

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:aeCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

6a:73:6a:4b:c3:ab:80:54:79:01:91:06:ee:eb:3b:a0:33:74:e4:a6:ba:fc:5d:f8:fc:41:62:4d:91:de:f7:c1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 160B

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

6a:73:6a:4b:c3:ab:80:54:79:01:91:06:ee:eb:3b:a0:33:74:e4:a6:ba:fc:5d:f8:fc:41:62:4d:91:de:f7:c1
Signer

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 160B