Update[.]exe | Triage™

General

Target
Update.exe
Size 3.8MB
Sample260707-kpg9jsbt2m
SHA256 b716430004afd2c1d2b8f191332541759f30d49fe19c49f671a241f68c3a468c
MD5 9c559eb649f6aae84517e8311ce0478d
SHA1 eb5735184f13c237c28c9b4e4deb8e3b8104e615
SHA512 80a19e3b298ae7c1c6ff3ba01d5e770b584a782b9f818f8cd86321ebb26a93a98f46cbcaf2db5da31890e37357d40ff4e5a6a61eff163ed1cea06850f03fd0a6
SSDEEP 49152:V0z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZC:S+v0ntHsOnaH
TLSH
T1E506BF62FF42D0F7C48A0175E42DF37D8636AE558B2A85C396A97C5CACF0270885739E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Update.exe

File Explorer

Update.exe

.exe 3.8MB

Update.exe

IMPHASH c06cf0cb9719d4659ab380800e751381
SHA256 b716430004afd2c1d2b8f191332541759f30d49fe19c49f671a241f68c3a468c
MD5 9c559eb649f6aae84517e8311ce0478d
SHA1 eb5735184f13c237c28c9b4e4deb8e3b8104e615
SHA512 80a19e3b298ae7c1c6ff3ba01d5e770b584a782b9f818f8cd86321ebb26a93a98f46cbcaf2db5da31890e37357d40ff4e5a6a61eff163ed1cea06850f03fd0a6
SSDEEP 49152:V0z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZC:S+v0ntHsOnaH
TLSH
T1E506BF62FF42D0F7C48A0175E42DF37D8636AE558B2A85C396A97C5CACF0270885739E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2221449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

update.pdb

kernel32

GetModuleFileNameW SetThreadErrorMode LoadLibraryExW SetUnhandledExceptionFilter SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformationForYear CloseHandle GetCommandLineW TlsSetValue UnhandledExceptionFilter GetFileInformationByHandleEx SetFileInformationByHandle FindClose GetFullPathNameW TlsGetValue GetSystemInfo WakeAllConditionVariable WakeConditionVariable SwitchToThread SleepConditionVariableSRW GetCurrentProcess DuplicateHandle AcquireSRWLockExclusive GetFileInformationByHandle InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree ReleaseSRWLockExclusive MultiByteToWideChar WaitForSingleObject GetCurrentThread ReleaseMutex SetLastError GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte GetCurrentThreadId GetEnvironmentVariableW GetModuleHandleA CreateThread GetProcAddress ReadFileEx SleepEx WriteFileEx CompareStringOrdinal GetModuleHandleW CreateFileW SetFileTime FindFirstFileExW SetFilePointerEx TryAcquireSRWLockExclusive SetHandleInformation GetSystemTimeAsFileTime CreateDirectoryW ExitProcess GetExitCodeProcess GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetTempPathW RemoveDirectoryW DeleteFileW CopyFileExW MoveFileExW CreateSymbolicLinkW CreateWaitableTimerExW SetWaitableTimer Sleep SetCurrentDirectoryW FindNextFileW GetFileSizeEx OpenProcess GetProcessTimes ExpandEnvironmentStringsW GetLongPathNameW HeapSize TerminateProcess QueryFullProcessImageNameW VirtualQuery GetLastError IsWow64Process GetProcessId GetUserPreferredUILanguages LoadLibraryExA VirtualProtect SetThreadStackGuarantee GetConsoleOutputCP FreeLibrary GetProcessHeap HeapFree HeapAlloc FormatMessageW GetConsoleMode GetStdHandle WriteConsoleW SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo OutputDebugStringA OutputDebugStringW AddVectoredExceptionHandler HeapReAlloc SetStdHandle DecodePointer RtlUnwind RtlCaptureContext IsDebuggerPresent QueryPerformanceFrequency QueryPerformanceCounter RaiseException EncodePointer GetModuleHandleExW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteFile GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW FlushFileBuffers

ntdll

NtReadFile NtWriteFile NtCreateFile RtlInitUnicodeString NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtQueryInformationProcess

user32

EndDialog AllowSetForegroundWindow SendMessageW

combase

CoTaskMemFree CoTaskMemAlloc

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Update.exe

kernel32

ntdll

user32

combase

generic