GUP[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GUP.exe
Size 2.1MB
Sample250422-v27p3ssvbx
SHA256 9861b4a602eee6742bfcb24f2d262a67f0dc768826e1be1acc3ba84c4a15d0f5
MD5 c5dea5538d2e0aaa5f3242fe638dc3eb
SHA1 a24c29b88ab0cfcaa4b5b0185120e179756a3938
SHA512 8131d75742ea0fd8e904c7cbb0a03de913723c472031187ab46349b81f37742ececfcf8f710fb24c96c7e7d2760f99cbf92e0dec0de6947c4607652d67f396d3
SSDEEP 49152:Rh1zj/O6HWoctWpeBkIbxo++x+TwB835uqqfWZroRSK0kL2AnzkMIr:RA7eOkIbx9SdorB3qnzkn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GUP.exe

File Explorer

GUP.exe

.exe 2.1MB

GUP.exe

IMPHASH 81b21463d07fccae3334ddde819e1970
SHA256 9861b4a602eee6742bfcb24f2d262a67f0dc768826e1be1acc3ba84c4a15d0f5
MD5 c5dea5538d2e0aaa5f3242fe638dc3eb
SHA1 a24c29b88ab0cfcaa4b5b0185120e179756a3938
SHA512 8131d75742ea0fd8e904c7cbb0a03de913723c472031187ab46349b81f37742ececfcf8f710fb24c96c7e7d2760f99cbf92e0dec0de6947c4607652d67f396d3
SSDEEP 49152:Rh1zj/O6HWoctWpeBkIbxo++x+TwB835uqqfWZroRSK0kL2AnzkMIr:RA7eOkIbx9SdorB3qnzkn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

824575

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameW GetProcAddress LoadLibraryW LocalAlloc LocalFree CopyFileW MoveFileW FileTimeToSystemTime GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte GetSystemDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW K32GetProcessMemoryInfo K32GetProcessImageFileNameW FreeLibrary GetVersionExW GetSystemDirectoryW GetSystemTime OpenProcess HeapSize WriteConsoleW GetProcessHeap GetCommandLineA FindFirstFileExW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP SetEndOfFile HeapReAlloc GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree GetProcessId GetCurrentThreadId GetCurrentThread TerminateProcess GetCurrentProcessId GetCurrentProcess DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError CloseHandle OutputDebugStringW RemoveDirectoryW QueryDosDeviceW GetFileTime GetFileAttributesExW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW ExpandEnvironmentStringsW HeapAlloc GetStdHandle SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode FlushFileBuffers InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetCurrentDirectoryW GetFileAttributesW GetFileType GetLongPathNameW GetTempFileNameW GetTempPathW GetSystemTimeAsFileTime RaiseException WaitForSingleObject ExitProcess TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageW GetACP GetLocaleInfoW GetEnvironmentVariableW IsDebuggerPresent IsValidCodePage GetCommandLineW GetModuleHandleW ReadFile WriteFile PeekNamedPipe SetEvent CreateEventW WaitForMultipleObjects IsBadReadPtr IsBadStringPtrA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind SetLastError LoadLibraryExW GetDriveTypeW GetFullPathNameW SetEnvironmentVariableW GetCurrentDirectoryW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime MoveFileExW SetStdHandle GetModuleHandleExW

user32

LoadIconW LoadCursorW GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow UpdateWindow EnableWindow KillTimer SetTimer BringWindowToTop IsWindowVisible SetWindowPos ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW AttachThreadInput UnregisterHotKey MessageBoxW PostThreadMessageW RegisterClassW PeekMessageW UnregisterClassW DestroyWindow MsgWaitForMultipleObjects DdeInitializeW DdeUninitialize DdeConnect DdeDisconnect DdePostAdvise DdeNameService DdeClientTransaction DdeCreateDataHandle DdeGetData DdeFreeDataHandle DdeGetLastError DdeCreateStringHandleW DdeQueryStringW DdeFreeStringHandle RegisterHotKey DispatchMessageW TranslateMessage GetMessageW

advapi32

RegEnumKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl GetLengthSid FreeSid DuplicateToken AllocateAndInitializeSid AddAccessAllowedAce AccessCheck OpenThreadToken OpenProcessToken GetUserNameW

shell32

SHGetFolderPathW SHFileOperationW ShellExecuteW

ole32

CoTaskMemFree OleUninitialize CoCreateInstance OleInitialize

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

321KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.itext

Size

579KB

Virtual Size

578KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xldpmez

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

mvr

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

GUP.exe

kernel32

user32

advapi32

shell32

ole32

generic