AtualizaçaoUI[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AtualizaçaoUI.exe
Size 2.4MB
Sample260809-deandsge25
SHA256 93739d37eb2d31917a008b8744f399cbdaee8f31dbff31de95435de075f377e9
MD5 47b3ccf11be1d9c4e18e11a0c288d8d6
SHA1 6aa04603fe766cff4d2a6e19886671daf935109d
SHA512 3bf3f0bb9b7ed4bcec8c7faf055e875b16fcfba512777efba8353ac72b647263c0a8fa02439abaf3e5ef2cb85496b827bc0f3346108d463bde35d6e341ff7fa1
SSDEEP 49152:Hn7c543S+EGyY61ifoVUzZdKW0tDxcfkorx0w3dFGPbmixTA3rz8n:HVxE991moVuZNCM0w3TabjTi
TLSH
T175B51246F6A651F5C07FC2389EDAA60FFE723455075086CB23E845691FF36F05ABA202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AtualizaçaoUI.exe

File Explorer

AtualizaçaoUI.exe

.exe 2.4MB

AtualizaçaoUI.exe

IMPHASH 8b1dde822f6a5b6673da7820fd1febaa
SHA256 93739d37eb2d31917a008b8744f399cbdaee8f31dbff31de95435de075f377e9
MD5 47b3ccf11be1d9c4e18e11a0c288d8d6
SHA1 6aa04603fe766cff4d2a6e19886671daf935109d
SHA512 3bf3f0bb9b7ed4bcec8c7faf055e875b16fcfba512777efba8353ac72b647263c0a8fa02439abaf3e5ef2cb85496b827bc0f3346108d463bde35d6e341ff7fa1
SSDEEP 49152:Hn7c543S+EGyY61ifoVUzZdKW0tDxcfkorx0w3dFGPbmixTA3rz8n:HVxE991moVuZNCM0w3TabjTi
TLSH
T175B51246F6A651F5C07FC2389EDAA60FFE723455075086CB23E845691FF36F05ABA202
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

469092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\legia\OneDrive\Desktop\MonsterWork\Monster-Loader\dist_cpp\Release\MonsterLoaderCpp.pdb

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegCloseKey RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegSetValueExW

shell32

ShellExecuteW CommandLineToArgvW

urlmon

URLDownloadToFileW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpConnect WinHttpQueryHeaders WinHttpReadData WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpSetTimeouts

kernel32

AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete GetCommandLineW LocalFree CreateDirectoryW ReadFile SetHandleInformation GetStdHandle WriteFile TerminateProcess GetModuleFileNameW CreatePipe GetEnvironmentVariableW PeekNamedPipe WaitForSingleObject WakeAllConditionVariable MultiByteToWideChar CloseHandle CreateProcessW SleepConditionVariableSRW GetExitCodeProcess OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter RtlCaptureContext IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlVirtualUnwind Sleep GetCurrentThreadId WideCharToMultiByte GetTickCount64 UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileAttributesW GetCurrentProcess

user32

GetMessageExtraInfo LoadImageW GetKeyState UpdateWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetWindowRect LoadCursorW DestroyWindow SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage SetProcessDPIAware

gdi32

CreateRoundRectRgn

ole32

CoUninitialize CoCreateInstance CoInitializeEx

msvcp140

?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z _Strxfrm _Cnd_broadcast _Mtx_unlock ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A _Query_perf_counter _Cnd_wait _Cnd_register_at_thread_exit ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z _Mtx_lock ?__ExceptionPtrCurrentException@@YAXPEAX@Z ??1_Lockit@std@@QEAA@XZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy _purecall __std_terminate strchr memchr memcmp __std_exception_destroy memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type terminate _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _initialize_onexit_table _invoke_watson _register_onexit_function abort

api-ms-win-crt-string-l1-1-0

strncmp tolower strncpy_s strcmp strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free realloc

api-ms-win-crt-stdio-l1-1-0

ftell fwrite __p__commode _set_fmode fflush __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen __acrt_iob_func fclose __stdio_common_vfprintf fseek

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

acosf cosf sqrtf sinf fmodf ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale