Static task
static1
Behavioral task
behavioral1
Sample
selfupdate_cf.exe
Resource
win7-20240704-en
General
-
Target
selfupdate_cf.exe
-
Size
144KB
-
MD5
a3b2543f811f98b40a590fdfb4ff286d
-
SHA1
5312ca80799fcd801d79771da46a1e9cf49f49c0
-
SHA256
10b864e091951b886754161fe7bd61d7ce693c8c89498425700e4c28163970a9
-
SHA512
25a34e669d9c4b5bd548e92d90f749b3bc540ae2c848f04600adbc88f318760a6245eef01cc17ecc744e77226f578de4220ff7952013b2c774bd212a1e04af6d
-
SSDEEP
3072:n4y5EtEOIGErfKjEMOrGmw5EtY6r+FGCH:8txIGefmJv5Rk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource selfupdate_cf.exe
Files
-
selfupdate_cf.exe.exe windows:4 windows x86 arch:x86
0947a6a540031b8f8d0398a7bcdf871f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
IsDBCSLeadByte
DeleteFileA
CreateProcessA
Sleep
CloseHandle
OpenEventA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrlenW
GetModuleFileNameA
FlushFileBuffers
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
OutputDebugStringA
CreateDirectoryA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
GetStringTypeA
LCMapStringW
GetModuleHandleA
RaiseException
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetProcAddress
GetSystemInfo
VirtualQuery
HeapReAlloc
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointer
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateFileA
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEndOfFile
GetCPInfo
GetOEMCP
IsValidCodePage
LoadLibraryA
LCMapStringA
user32
CharNextA
DestroyWindow
DefWindowProcA
UnregisterClassA
advapi32
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
ole32
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemRealloc
oleaut32
VarUI4FromStr
comctl32
InitCommonControlsEx
Sections
.text Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�d<�u Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE