EromUpgrade[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EromUpgrade.exe
Size 388KB
Sample260729-we61psyfnd
SHA256 a2e1e6aceba6c9608f05d80683f264f350766e35a4edfe212f85ca839bbca06d
MD5 176ffdebf175e13669c652b4d340191f
SHA1 e983184a97d10d32e2c81e6d9d892b8bad5bd745
SHA512 5a00ce81e5b744abf925325d22a0b9aa2dc6135a67539627fa81419292c29bc35400c79855d88a44aa3d5f353e9b8d230280b470e620d00c1569b0f301a4776a
SSDEEP 3072:38r7+rzsMudlObl+74HoMpxpS091+kTFyBZdlDIUxWyv1WSYRE6OtS/OrdGOy2A4:38r6ryS+77E1xw4aWDCtS/O7ys/Tfsf
TLSH
T1D1840A127260887EC591047E8DC79BB66B65EA343636CD83F798FE3DF9230A051E6253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EromUpgrade.exe

File Explorer

EromUpgrade.exe

.exe 388KB

EromUpgrade.exe

IMPHASH f0500af1dbe3383871625f902f1af360
SHA256 a2e1e6aceba6c9608f05d80683f264f350766e35a4edfe212f85ca839bbca06d
MD5 176ffdebf175e13669c652b4d340191f
SHA1 e983184a97d10d32e2c81e6d9d892b8bad5bd745
SHA512 5a00ce81e5b744abf925325d22a0b9aa2dc6135a67539627fa81419292c29bc35400c79855d88a44aa3d5f353e9b8d230280b470e620d00c1569b0f301a4776a
SSDEEP 3072:38r7+rzsMudlObl+74HoMpxpS091+kTFyBZdlDIUxWyv1WSYRE6OtS/OrdGOy2A4:38r6ryS+77E1xw4aWDCtS/O7ys/Tfsf
TLSH
T1D1840A127260887EC591047E8DC79BB66B65EA343636CD83F798FE3DF9230A051E6253
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetErrorMode RtlUnwind HeapFree HeapAlloc RaiseException ExitProcess TerminateProcess GetStartupInfoA GetCommandLineA CreateThread ExitThread GetTimeZoneInformation GetSystemTime GetLocalTime GetACP HeapSize HeapReAlloc HeapDestroy HeapCreate IsBadWritePtr SetUnhandledExceptionFilter LCMapStringA UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA GetProfileStringA GetFileTime GetOEMCP GetCPInfo SizeofResource WritePrivateProfileStringA GlobalFlags MulDiv GetProcessVersion SetLastError TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc DeleteCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime GetThreadLocale GetFullPathNameA lstrcpynA GetVolumeInformationA FindFirstFileA FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer GetCurrentProcess DuplicateHandle LoadLibraryA FreeLibrary GetVersion lstrcatA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA lstrcpyA GetModuleHandleA GetProcAddress GlobalUnlock FindResourceA LoadResource LockResource GlobalFree GlobalLock GlobalAlloc GlobalDeleteAtom lstrcmpA lstrcmpiA GetCurrentThread GetCurrentThreadId SetThreadPriority ResumeThread MultiByteToWideChar WideCharToMultiByte lstrlenA InterlockedDecrement InterlockedIncrement GetTempPathA FormatMessageA LocalFree PurgeComm GetTickCount WriteFile GetOverlappedResult ClearCommError SetCommTimeouts SetCommState SetupComm GetLastError WaitForSingleObject SuspendThread CreateEventA GetCurrentDirectoryA EnterCriticalSection LeaveCriticalSection SetEvent InitializeCriticalSection GetFileAttributesA GetFileAttributesExA VirtualAlloc VirtualFree CreateFileA GetFileSize CloseHandle ReadFile GetPrivateProfileStringA GetModuleFileNameA LCMapStringW Sleep

user32

InvalidateRect InflateRect RegisterClipboardFormatA PostThreadMessageA GetTopWindow IsChild WinHelpA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID DefWindowProcA CreateWindowExA GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement EndDialog IsWindow GetSystemMetrics CreateDialogIndirectParamA DestroyWindow GetWindow SetWindowContextHelpId MapDialogRect GetCapture SetActiveWindow GrayStringA GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetLastActivePopup SetCursor PostQuitMessage GetMessageA TranslateMessage CharNextA GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible PeekMessageA GetCursorPos SetWindowsHookExA UnhookWindowsHookEx SetFocus IsWindowEnabled ShowWindow SetWindowPos MoveWindow SetWindowLongA SendMessageA GetParent PostMessageA UnregisterClassA HideCaret ShowCaret ExcludeUpdateRgn DrawFocusRect GetDlgCtrlID GetWindowTextLengthA GetWindowTextA SetWindowTextA GetWindowLongA IsDialogMessageA SendDlgItemMessageA DestroyMenu MessageBeep GetNextDlgGroupItem SetRect GetWindowRect CopyAcceleratorTableA GetDlgItem wsprintfA MessageBoxA DefDlgProcA IsWindowUnicode EnableWindow DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC PtInRect GetClassNameA ClientToScreen GetDesktopWindow GetDC ReleaseDC GetSysColorBrush LoadCursorA LoadStringA CharUpperA LoadIconA UpdateWindow MapWindowPoints GetSysColor AdjustWindowRectEx ScreenToClient DispatchMessageA GetClientRect GetAsyncKeyState CopyRect

gdi32

SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx IntersectClipRect GetViewportExtEx GetWindowExtEx CreateSolidBrush PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextColor GetBkColor DPtoLP LPtoDP GetMapMode PatBlt SetBkMode GetStockObject SelectObject RestoreDC SaveDC DeleteDC DeleteObject GetDeviceCaps GetObjectA SetBkColor SetTextColor GetClipBox CreateDIBitmap GetTextExtentPointA BitBlt CreateCompatibleDC CreateBitmap

comdlg32

GetSaveFileNameA GetFileTitleA GetOpenFileNameA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA RegOpenKeyExA

shell32

ShellExecuteExA

comctl32

DestroyPropertySheetPage CreatePropertySheetPageA PropertySheetA ord17

oledlg

ord8

ole32

CoFreeUnusedLibraries OleInitialize CoTaskMemAlloc CoTaskMemFree CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard OleUninitialize

olepro32

ord253

oleaut32

VariantTimeToSystemTime SysAllocStringLen SysFreeString VariantCopy VariantChangeType SysAllocString SysAllocStringByteLen SysStringLen VariantClear