Adobe Plugin Update[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Adobe Plugin Update.exe
Size 76.4MB
Sample260804-yncvbsga83
SHA256 7422d3c1c4c458f4c7fd44e9ff2c4f7969711f250772ccd6bc36d156a29ed46c
MD5 20953c981a64a48c3781cfcd4ec1c500
SHA1 b8de4d9b1141e02c4b23378440856cf09fc3313d
SHA512 44e7f61934b5e515edf8bddc396e8455c1a2b22b13e82be42e8d4ae2182a31728be7fbb51a8875053751c95f6b066c92751f10c4b400b6e7bfab731d1f082cee
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpp:9iLVelepClAy6uw3W0BEROh2nvvj
TLSH
T1B208011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Adobe Plugin Update.exe

File Explorer

Adobe Plugin Update.exe

.exe 76.4MB

Adobe Plugin Update.exe

IMPHASH 63c11544893457fb321a43dc42728c6a
SHA256 7422d3c1c4c458f4c7fd44e9ff2c4f7969711f250772ccd6bc36d156a29ed46c
MD5 20953c981a64a48c3781cfcd4ec1c500
SHA1 b8de4d9b1141e02c4b23378440856cf09fc3313d
SHA512 44e7f61934b5e515edf8bddc396e8455c1a2b22b13e82be42e8d4ae2182a31728be7fbb51a8875053751c95f6b066c92751f10c4b400b6e7bfab731d1f082cee
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpp:9iLVelepClAy6uw3W0BEROh2nvvj
TLSH
T1B208011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Faronics\morocco\Faronics_Hg\Deploy\Faronics-Deploy_CloudAgent\Source\bin\Release\FaronicsDeployAgent\Win32\FaronicsDeployAgent.pdb

comctl32

ord17

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

crypt32

CryptStringToBinaryA CryptBinaryToStringA

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

kernel32

LocalAlloc LockResource DeviceIoControl FindNextFileW LocalFree SetFilePointer SetEndOfFile InterlockedDecrement ReadFile GetCurrentProcess LoadLibraryW GetUserDefaultLangID SetLastError GetVersionExW GetExitCodeProcess TerminateProcess IsWow64Process ExpandEnvironmentStringsW GetCurrentProcessId Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GlobalLock GlobalAlloc GlobalUnlock GetComputerNameExW GlobalFree GetWindowsDirectoryW CreateThread GetSystemDefaultLCID GetLocaleInfoW GetTimeZoneInformation MapViewOfFile UnmapViewOfFile CreateFileMappingW MoveFileExW GetSystemWindowsDirectoryW FindClose GetPrivateProfileStringW CopyFileW GetFileAttributesW WritePrivateProfileStringW GetTempPathW GetPrivateProfileIntW CreateEventW RemoveDirectoryW GetSystemInfo LoadResource LeaveCriticalSection EnterCriticalSection SystemTimeToFileTime FileTimeToSystemTime InterlockedCompareExchange InterlockedExchange GetProcessHeap WriteConsoleW SetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize IsValidCodePage GetOEMCP GetACP GetCurrentThreadId TlsFree TlsSetValue TlsGetValue GetProcAddress SizeofResource GetSystemDirectoryW GetModuleHandleW WaitForSingleObject CreateDirectoryW CreateProcessW CloseHandle GetLocalTime CreateFileW WriteFile DeleteFileW OutputDebugStringA MoveFileW GetLastError lstrlenW MultiByteToWideChar GetBinaryTypeW GetModuleFileNameW Sleep WideCharToMultiByte OutputDebugStringW FindFirstFileW TlsAlloc FlushFileBuffers GetConsoleMode GetConsoleCP FindResourceW InitializeCriticalSection FindResourceExW ExitProcess HeapDestroy HeapCreate IsProcessorFeaturePresent GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW HeapAlloc RtlUnwind RaiseException GetCPInfo GetStartupInfoW HeapSetInformation GetStringTypeW EncodePointer DecodePointer DeleteCriticalSection HeapFree GetSystemTimeAsFileTime GetCommandLineW InterlockedIncrement

user32

GetDesktopWindow EndDialog InvalidateRect LoadIconW PtInRect BeginPaint SetFocus GetClientRect DialogBoxParamW SetWindowPos GetWindowRect SetTimer SetWindowRgn EndPaint GetSystemMetrics ShowWindow SendMessageW SetWindowTextW MoveWindow wsprintfW MessageBoxExW ExitWindowsEx KillTimer

gdi32

SelectObject Rectangle CreateRoundRectRgn CreatePen CreateSolidBrush DeleteObject

advapi32

DeregisterEventSource RegCreateKeyExA ReportEventW RegOpenKeyExA RegisterEventSourceW RegCreateKeyA RegDeleteKeyW RegCreateKeyExW LookupAccountSidW ConvertStringSidToSidW RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken QueryServiceConfigW ControlService QueryServiceStatus StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

ole32

CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CLSIDFromProgID CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantTimeToSystemTime VarCmp SysStringByteLen VariantChangeType SysAllocStringByteLen SysStringLen SysFreeString VariantInit VariantClear SysAllocString VariantCopy

shlwapi

PathGetArgsW PathAddBackslashW StrTrimW PathRemoveFileSpecW StrStrIW PathUnquoteSpacesW PathQuoteSpacesW PathRemoveArgsW PathFileExistsW

winhttp

WinHttpSetCredentials WinHttpReadData WinHttpOpenRequest WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpSetOption WinHttpReceiveResponse WinHttpSendRequest

msi

ord119 ord163 ord17 ord160 ord20 ord158 ord125 ord115 ord32 ord118 ord8 ord92 ord159

gdiplus

GdiplusStartup GdipCreatePen1 GdipCreatePath GdipCloneImage GdipCreateFromHDC GdipCreateFontFamilyFromName GdipDrawString GdipDeletePath GdipCreateFont GdiplusShutdown GdipDeleteBrush GdipFree GdipDeletePen GdipCloneBrush GdipStartPathFigure GdipCreateBitmapFromStream GdipSetTextRenderingHint GdipDrawPath GdipDisposeImage GdipAlloc GdipDrawImageI GdipCreateSolidFill GdipAddPathArcI GdipDeleteFontFamily GdipAddPathLineI GdipClosePathFigure GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteFont