WindowsUpdate[.]exe

General

Target
WindowsUpdate.exe
Size 18.2MB
Sample260620-k87njsft4s
SHA256 1be14cc1883eab57b838b6ee895c92f1f8cbe951bb9db05c4a4b3cd296c70704
MD5 1c4916f3209e2c82c1831917b1837420
SHA1 bc00cb9c334a3426c7c9d06427da2d3424960de4
SHA512 953cd3e2515ddda2e484e0d561d9b451e549ac71d81e820a26fc10c67295bd4a262c0d99312ea10a6fbfc1de7118585b3d528774bb5407c208c9941ebc82104b
SSDEEP 393216:5Tr2DS8BG+u6fb+SJ8aqq1CPwDvt3uFhCas4eBM609Bu:5T6DS8BLgBu
TLSH
T162177C5176908466F8B6F279C5170606E370ECB16720C7CB319DB2691F37BE12EBA6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WindowsUpdate.exe

File Explorer

WindowsUpdate.exe

.exe 18.2MB

WindowsUpdate.exe

IMPHASH 47d8e0175a59b4e11d4f4c22503643b7
SHA256 1be14cc1883eab57b838b6ee895c92f1f8cbe951bb9db05c4a4b3cd296c70704
MD5 1c4916f3209e2c82c1831917b1837420
SHA1 bc00cb9c334a3426c7c9d06427da2d3424960de4
SHA512 953cd3e2515ddda2e484e0d561d9b451e549ac71d81e820a26fc10c67295bd4a262c0d99312ea10a6fbfc1de7118585b3d528774bb5407c208c9941ebc82104b
SSDEEP 393216:5Tr2DS8BG+u6fb+SJ8aqq1CPwDvt3uFhCas4eBM609Bu:5T6DS8BLgBu
TLSH
T162177C5176908466F8B6F279C5170606E370ECB16720C7CB319DB2691F37BE12EBA6C8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

FlsFree WriteConsoleW HeapReAlloc CreateDirectoryW SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError CloseHandle GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter SetDllDirectoryW LoadLibraryExW GetExitCodeProcess GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter MultiByteToWideChar HeapAlloc HeapFree VirtualProtect LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18.1MB

Virtual Size

18.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WindowsUpdate.exe

shell32

kernel32

generic