updater[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

updater.exe
Size

236KB
MD5

4c3ea6af665c08deae37e9b9db62ea9a
SHA1

49c3cb54723941e153145ad84e8e2de6d646b377
SHA256

b4cce2eff7991ed2c5655d7c0db25ddc3ac57b9b70fa7439c2c0774b55dbd4c9
SHA512

c4e6bc97a485f3d3b88b0333488824d7fb39d311d7c046cf7a4666a1218d761090d157be0f73fef4690da2171b417061f3ff365f863857d689bcd5c2968c357f
SSDEEP

6144:/MoifGIkILaKeIdys3qhl7v1oL3GpKZlrrdT8dOkvKky:/MFfwILNTdR3YvqGpBXT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
updater.exe

Files

updater.exe
.exe windows:6 windows x64 arch:x64

4bc65fac17dd29611be601946e709b7c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\pcsx2\pcsx2\build\updater\updater.pdb

Imports

comctl32

ord17

kernel32

CloseHandle
CreateDirectoryW
CreateFileW
CreateMutexExW
CreateSemaphoreExW
CreateToolhelp32Snapshot
DebugBreak
DeleteFileW
FormatMessageW
FreeLibrary
GetCommandLineW
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetFileAttributesW
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetThreadContext
GetThreadId
GetVersionExA
HeapAlloc
HeapFree
HeapReAlloc
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryW
LocalFree
MoveFileExW
MultiByteToWideChar
OpenProcess
OpenSemaphoreW
OpenThread
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSemaphore
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
SuspendThread
TerminateProcess
Thread32First
Thread32Next
UnhandledExceptionFilter
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile

user32

ChangeWindowMessageFilterEx
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetMessageW
GetWindowLongPtrW
LoadCursorW
LoadIconW
MessageBoxA
MessageBoxW
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
RegisterWindowMessageW
SendMessageW
SetWindowLongPtrW
SetWindowTextW
ShowWindow
TranslateMessage

gdi32

GetStockObject

shell32

CommandLineToArgvW
SHCreateItemFromParsingName
ShellExecuteA
ShellExecuteW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0facet@locale@std@@IEAA@_K@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1facet@locale@std@@MEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
_Cnd_do_broadcast_at_thread_exit
_Mtx_lock
_Mtx_unlock
_Thrd_id
_Thrd_join

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll

api-ms-win-core-path-l1-1-0

PathCchCanonicalizeEx

advapi32

GetUserNameA

version

GetFileVersionInfoA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExW
VerQueryValueW

vcruntime140

_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
_purecall
memchr
memcmp
memcpy
memmove
memset

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf
_set_fmode
_wfopen_s
fclose
fflush
fopen_s
fwrite

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_c_exit
_cexit
_configure_wide_argv
_crt_atexit
_errno
_exit
_get_wide_winmain_command_line
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
exit
strerror_s
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dsign
_dtest
_fdtest
_ldtest

api-ms-win-crt-string-l1-1-0

_strdup
_stricmp
_strnicmp
iswspace
strcat_s
strlen
strncpy_s
wcslen

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

Sections

.text
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4bc65fac17dd29611be601946e709b7c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

shell32

ole32

msvcp140

api-ms-win-core-synch-l1-2-0

api-ms-win-core-path-l1-1-0

advapi32

version

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 169KB - Virtual size: 168KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 12KB

.pdata Size: 3KB - Virtual size: 3KB

.00cfg Size: 512B - Virtual size: 56B

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 512B - Virtual size: 420B

.text
Size: 169KB - Virtual size: 168KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 12KB

.pdata
Size: 3KB - Virtual size: 3KB

.00cfg
Size: 512B - Virtual size: 56B

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 420B