update[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
update.exe
Size 4.0MB
Sample250815-rlpb1sysas
SHA256 618070d597dd73c43ba5d4bde2baa93a4f6038e3279de3bafe688caa5c409a58
MD5 4e7434ac13001fe55474573aa5e9379d
SHA1 53385e0fd7fc9c88080abf5b97cd5b84b31c876e
SHA512 abf7b1963ab955b44eae80b0ebcd72a96b71762e00a3c82ae2894cc54f55a75f811079efe82fb942b08b22772ef822eb7588f8d8430531d79be3bf6bad69b762
SSDEEP 49152:IigbvDVBZWFKrqU/G6daKd4Kmk1uLc+3IWz65hbk8oH7s9:VLKrr0k1QrDz65hbk8oH70
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update.exe

File Explorer

update.exe

.exe 4.0MB

update.exe

IMPHASH 4d467283cf2bcd0813eae5baa1d3ab0f
SHA256 618070d597dd73c43ba5d4bde2baa93a4f6038e3279de3bafe688caa5c409a58
MD5 4e7434ac13001fe55474573aa5e9379d
SHA1 53385e0fd7fc9c88080abf5b97cd5b84b31c876e
SHA512 abf7b1963ab955b44eae80b0ebcd72a96b71762e00a3c82ae2894cc54f55a75f811079efe82fb942b08b22772ef822eb7588f8d8430531d79be3bf6bad69b762
SSDEEP 49152:IigbvDVBZWFKrqU/G6daKd4Kmk1uLc+3IWz65hbk8oH7s9:VLKrr0k1QrDz65hbk8oH70
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

libcrypto-3-x64

BIO_ctrl BIO_f_base64 BIO_free BIO_free_all BIO_new BIO_new_mem_buf BIO_push BIO_read BIO_s_mem BIO_set_flags BIO_write EVP_CIPHER_CTX_free EVP_CIPHER_CTX_new EVP_EncryptFinal_ex EVP_EncryptInit_ex EVP_EncryptUpdate EVP_PKEY_CTX_free EVP_PKEY_CTX_new EVP_PKEY_CTX_set_rsa_padding EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_free EVP_aes_256_cbc PEM_read_bio_PUBKEY RAND_bytes

libcurl-4

curl_easy_cleanup curl_easy_init curl_easy_perform curl_easy_setopt curl_easy_strerror curl_global_cleanup curl_global_init curl_mime_addpart curl_mime_data curl_mime_filedata curl_mime_free curl_mime_init curl_mime_name curl_mime_type curl_slist_append curl_slist_free_all

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CreateFileW CreateHardLinkW CreateMutexA CreateProcessA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FindFirstVolumeW FindNextVolumeW FindVolumeClose FormatMessageA GetComputerNameA GetCurrentProcess GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetTempPathW GetThreadContext GetTickCount GetVersionExA GetVolumeInformationW InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenProcess Process32First Process32Next RaiseException RemoveDirectoryW ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointer SetThreadContext SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAllocEx VirtualProtect VirtualQuery WideCharToMultiByte WriteProcessMemory

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _close _commode _errno _fdopen _fileno _findclose _fmode _fstat64 _get_osfhandle _initterm _ismbblead _lock _lseeki64 _lseeki64 _read _stricmp _telli64 _unlock _wchdir _wchmod _wfindfirst64 _wfindnext64 _wfopen _wfullpath atexit _wgetcwd _wmkdir _wopen _write _wstat64 _wutime64 abort calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv iswctype localeconv malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm system towlower towupper vfprintf wcscat wcscmp wcscoll wcscpy wcsftime wcslen wcsxfrm

netapi32

NetLocalGroupAddMembers NetUserAdd NetUserDel

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

libwinpthread-1

nanosleep64 pthread_cond_broadcast pthread_cond_wait pthread_create pthread_detach pthread_getspecific pthread_join pthread_key_create pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock pthread_num_processors_np pthread_once pthread_setspecific

shell32

SHChangeNotify SHGetFolderPathA ShellExecuteA

user32

GetDC GetDesktopWindow GetSystemMetrics ReleaseDC SystemParametersInfoA

ws2_32

gethostbyname gethostname inet_ntoa

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

635KB

Virtual Size

635KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

update.exe

advapi32

libcrypto-3-x64

libcurl-4

gdi32

gdiplus

kernel32

msvcrt

netapi32

ole32

oleaut32

libwinpthread-1

shell32

user32

ws2_32

generic