update[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
update.exe
Size 6.1MB
Sample260730-pg85hs1vhs
SHA256 8d928a4c5bbc267a7ab60037bfcef54b79a53913dfcab4fe33831da0fd29974b
MD5 8e1d9b9a58ba843c7a5b5ad539e44dc6
SHA1 c464390b65f0b3762edf51bbf4c4d87b2aca2329
SHA512 65ca846f2a796f15bd453c6b90cae7aadc82b2ee59c2bb31b63cc9c449faea5894c337bd5c4d729d825ee49534485fe65673cef6988766ddc42696b942aa581e
SSDEEP 98304:SHTP+CElQEAoc3fWU+7M8uNeQUMIoPfQFJX3gIrA+h0MTThAhxNM346kEb:q+CElQE1QtWJQUMIcfcwIr9h6NMo6t
TLSH
T16356331F680E06A5D5C25D743B279FCB7A25923DDFCA1E203E48390AF542FB3665B0A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update.exe

File Explorer

update.exe

.exe 6.1MB

update.exe

IMPHASH 53f9e7620c35e01269612092834e77be
SHA256 8d928a4c5bbc267a7ab60037bfcef54b79a53913dfcab4fe33831da0fd29974b
MD5 8e1d9b9a58ba843c7a5b5ad539e44dc6
SHA1 c464390b65f0b3762edf51bbf4c4d87b2aca2329
SHA512 65ca846f2a796f15bd453c6b90cae7aadc82b2ee59c2bb31b63cc9c449faea5894c337bd5c4d729d825ee49534485fe65673cef6988766ddc42696b942aa581e
SSDEEP 98304:SHTP+CElQEAoc3fWU+7M8uNeQUMIoPfQFJX3gIrA+h0MTThAhxNM346kEb:q+CElQE1QtWJQUMIcfcwIr9h6NMo6t
TLSH
T16356331F680E06A5D5C25D743B279FCB7A25923DDFCA1E203E48390AF542FB3665B0A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12487531

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControls FlatSB_SetScrollInfo ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add ImageList_GetDragImage FlatSB_SetScrollProp ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_Draw ImageList_Remove ImageList_SetOverlayImage

winmm

timeGetTime

wininet

InternetCloseHandle InternetReadFile InternetOpenW InternetOpenUrlW InternetSetOptionW HttpQueryInfoW

shell32

Shell_NotifyIconW SHAppBarMessage

user32

CopyImage MoveWindow CreateWindowExW GetMenuItemInfoW SetMenuItemInfoW DefFrameProcW GetDCEx PeekMessageW MonitorFromWindow GetDlgCtrlID GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW FrameRect MapVirtualKeyW IsWindowUnicode RegisterWindowMessageW FillRect GetMenuStringW DispatchMessageW SendMessageA DefMDIChildProcW EnumWindows GetClassInfoW ShowOwnedPopups GetSystemMenu GetScrollRange GetScrollPos SetScrollPos GetActiveWindow SetActiveWindow DrawEdge InflateRect GetKeyboardLayoutList LoadBitmapW DrawFocusRect EnumChildWindows GetScrollBarInfo ReleaseCapture UnhookWindowsHookEx LoadCursorW GetCapture SetCapture CreatePopupMenu ScrollWindow ShowCaret GetMenuItemID GetLastActivePopup CharLowerBuffW GetSystemMetrics SetWindowLongW PostMessageW DrawMenuBar SetParent IsZoomed CharUpperBuffW GetClientRect IsChild ClientToScreen GetClipboardData SetClipboardData SetWindowPlacement IsIconic CallNextHookEx GetMonitorInfoW ShowWindow CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow SetForegroundWindow GetWindowTextW EnableWindow DestroyWindow IsDialogMessageW EndMenu RegisterClassW CharNextW GetWindowThreadProcessId RedrawWindow GetDC GetFocus SetFocus EndPaint ReleaseDC MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW GetClassLongW ActivateKeyboardLayout GetParent DrawTextW SetScrollRange InsertMenuItemW PeekMessageA GetPropW SetClassLongW MessageBoxW MessageBeep SetPropW RemovePropW UpdateWindow GetSubMenu MsgWaitForMultipleObjects DestroyMenu DestroyIcon SetWindowsHookExW EmptyClipboard IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW AdjustWindowRectEx DrawIcon IsWindow EnumThreadWindows GetMessageTime InvalidateRect GetKeyboardState DrawFrameControl ScreenToClient SetCursor CreateIcon CreateMenu LoadStringW CharLowerW SetWindowPos SetWindowRgn GetMenuItemCount RemoveMenu GetSysColorBrush GetKeyboardLayoutNameW GetWindowDC TranslateMessage OpenClipboard DrawTextExW MapWindowPoints EnumDisplayMonitors CallWindowProcW CloseClipboard DestroyCursor GetScrollInfo SetWindowTextW GetMessageExtraInfo EnableScrollBar GetSysColor TrackPopupMenu DrawIconEx PostQuitMessage GetClassNameW ShowScrollBar EnableMenuItem GetIconInfo GetMessagePos SetScrollInfo GetKeyNameTextW GetDesktopWindow GetCursorPos SetCursorPos HideCaret GetMenu GetMenuState SetMenu SetRect GetKeyState FindWindowExW MonitorFromPoint ValidateRect SystemParametersInfoW LoadIconW GetCursor GetWindow GetWindowLongW GetWindowRect InsertMenuW KillTimer WaitMessage IsWindowEnabled IsDialogMessageA TranslateMDISysAccel GetWindowPlacement CreateIconIndirect FindWindowW DeleteMenu GetKeyboardLayout

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement SysFreeString GetErrorInfo SafeArrayAccessData VariantClear VariantInit SafeArrayCreate SafeArrayGetElement GetActiveObject SafeArrayUnaccessData SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

advapi32

CloseServiceHandle InitializeAcl OpenServiceW ControlService SetEntriesInAclW RegEnumKeyExW QueryServiceStatus OpenSCManagerW RegOpenKeyExW RegDeleteValueW BuildExplicitAccessWithNameW StartServiceW SetNamedSecurityInfoW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey

msvcrt

memcpy memset

kernel32

SetFileAttributesW QueryDosDeviceW GetACP GetExitCodeProcess CloseHandle LocalFree GetCurrentProcessId SizeofResource TerminateThread QueryPerformanceFrequency FindNextFileW GetFullPathNameW GetThreadContext VirtualFree SetThreadContext GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW GlobalSize RtlUnwind GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile GetUserDefaultLCID CreateProcessW HeapSize GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW CopyFileW MapViewOfFile LoadLibraryA ResetEvent MulDiv FreeResource GetVersion RaiseException GlobalAddAtomW FormatMessageW OpenProcess SwitchToThread GetExitCodeThread GetCurrentThread IsBadReadPtr ExpandEnvironmentStringsW LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW DeviceIoControl LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage UnmapViewOfFile lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW EnumResourceNamesW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

ole32

IsAccelerator CoCreateInstance CoUninitialize IsEqualGUID CreateStreamOnHGlobal OleInitialize ProgIDFromCLSID OleUninitialize CoGetClassObject CoInitialize CoTaskMemFree OleDraw CoTaskMemAlloc OleSetMenuDescriptor StringFromCLSID

gdi32

Arc Pie SetBkMode SelectPalette CreateCompatibleBitmap GetEnhMetaFileHeader CloseEnhMetaFile ExcludeClipRect SetWindowOrgEx RectVisible MaskBlt AngleArc DeleteEnhMetaFile ResizePalette Chord SetTextColor SetDIBits StretchBlt SetViewportOrgEx CreateRectRgn RealizePalette GetDIBColorTable SetDIBColorTable RoundRect SelectClipRgn RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette CreateBrushIndirect PatBlt SetEnhMetaFileBits PolyBezierTo GetStockObject CreateSolidBrush Polygon Rectangle MoveToEx DeleteDC SaveDC PlayEnhMetaFile BitBlt Ellipse FrameRgn GetDeviceCaps GetBitmapBits GetTextExtentPoint32W GetClipBox Polyline IntersectClipRect GetEnhMetaFileBits GetSystemPaletteEntries CreateBitmap CombineRgn SetWinMetaFileBits CreateDIBitmap GetStretchBltMode CreateDIBSection CreatePenIndirect GetDIBits GetEnhMetaFilePaletteEntries SetStretchBltMode SetMapMode CreateFontIndirectW PolyBezier LineTo GetRgnBox LPtoDP CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetObjectW GetBrushOrgEx GetCurrentPositionEx GetWinMetaFileBits SetROP2 GetNearestPaletteIndex GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetEnhMetaFileDescriptionW GetPixel ArcTo GdiFlush SetPixel EnumFontFamiliesExW CreateEnhMetaFileW StretchDIBits GetPaletteEntries

Name

.text

Size

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

31KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

80B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.'*6

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gHZ

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.*Rb

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

update.exe

comctl32

winmm

wininet

shell32

user32

version

oleaut32

wtsapi32

advapi32

msvcrt

kernel32

ole32

gdi32

generic