WindowsUpdate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WindowsUpdate.exe
Size 300KB
Sample260730-3vfa9azblb
SHA256 3b05d908adaf4cd1e51cdd919fb094986236d91bf836f6a720b1c39eb82c447f
MD5 aca6a171494dbf5ec7efc60904d1dbb8
SHA1 ae659e206a711f3a39869611d4fe9b24fe1647cc
SHA512 69e8525ffcb3254d3560f8e0063b2f400d365a876eae25e34ab3feec22f336e5b3fa452925fdf91aeb9381924e98edb7fdce3d5a3d579e4c9a7c0f1a2a91c314
SSDEEP 6144:tgb2sMT/4x6eXajkfGW2NtlwMHdU0mEyH4jlLZmE:tgCsMT/4IeKwGW2XTZj+E
TLSH
T175642A1BA3A277F8C55BC17882AAD37299F0F0140364FA1F1A58CB333E56E505F5EA58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
WindowsUpdate.exe

File Explorer

WindowsUpdate.exe

.exe 300KB

WindowsUpdate.exe

IMPHASH 6e54ad9ba4bff83a43c7f093344cd986
SHA256 3b05d908adaf4cd1e51cdd919fb094986236d91bf836f6a720b1c39eb82c447f
MD5 aca6a171494dbf5ec7efc60904d1dbb8
SHA1 ae659e206a711f3a39869611d4fe9b24fe1647cc
SHA512 69e8525ffcb3254d3560f8e0063b2f400d365a876eae25e34ab3feec22f336e5b3fa452925fdf91aeb9381924e98edb7fdce3d5a3d579e4c9a7c0f1a2a91c314
SSDEEP 6144:tgb2sMT/4x6eXajkfGW2NtlwMHdU0mEyH4jlLZmE:tgCsMT/4IeKwGW2XTZj+E
TLSH
T175642A1BA3A277F8C55BC17882AAD37299F0F0140364FA1F1A58CB333E56E505F5EA58
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4d:30:7b:03:03:d6:1b:c6:79:d3:7a:44:fc:2a:ab:90:74:f7:de:b2:4a:cd:9b:bb:fc:c9:50:54:4a:fa:20:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

42:e1:7c:81:d4:eb:31:87:d9:6c:76:8f:14:93:df:ae:f1:72:77:95

Issuer

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Revocation Status

Not revoked

Timespan

Jul 30, 2026 - Jul 30, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits GetDeviceCaps SelectObject

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateFileA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FreeLibrary GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDriveTypeA GetFileAttributesA GetFileSize GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemInfo GetThreadId GetTickCount GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MultiByteToWideChar Process32First Process32Next RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _stricmp abort atoi calloc exit fprintf fputc fputs free fwrite getenv isalnum localeconv malloc memchr memcmp memcpy memmove memset rand realloc signal srand strcat strchr strcmp strcpy strerror strlen strncmp strncpy strncpy_s strrchr strstr strtoul tolower vfprintf wcslen _read

shell32

SHGetFolderPathA

shlwapi

PathCombineA

user32

CharLowerA CloseClipboard GetClipboardData GetDC OpenClipboard ReleaseDC

Name

.text

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

ukqu

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.snff

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jbheco

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ldbd

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ptrb

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

gnfimg

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dbkm

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mddkqo

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ncmo

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.kdbk

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

WindowsUpdate.exe

PE Signature issue

advapi32

bcrypt

crypt32

gdi32

kernel32

msvcrt

shell32

shlwapi

user32

generic