update[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
update.exe
Size 7.7MB
Sample260813-vffdpsvbmg
SHA256 63963fc9dede449e5e40520f6c40e34888ef2cc0fa459772437ec6b69f44267e
MD5 851d27d635d738fe2d8ab113bcb8b5a4
SHA1 223fcdaeb13174e2c9a11abff43b92fea7b9e3d7
SHA512 cb941c45f2313ce275bdeb19cf09b4c8f15ed752033a65e6a681d59fb9a83a59b7b7ff5060559ac1d7aef79405bdc55bf95bef2a0c6deb480f1f37eece2ce749
SSDEEP 196608:MhG3uXG5LE6HX5jNf9C4l55zBvyszq2eof:MhG+0pH9rV
TLSH
T17586E148777A4A7DE1128838C39A4077F11A391B9732A45E4D0DE7610FB2273AE7F792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update.exe

File Explorer

update.exe

.exe 7.7MB

update.exe

IMPHASH ce564ba57e1cf5fb4dfdabcd24a1029e
SHA256 63963fc9dede449e5e40520f6c40e34888ef2cc0fa459772437ec6b69f44267e
MD5 851d27d635d738fe2d8ab113bcb8b5a4
SHA1 223fcdaeb13174e2c9a11abff43b92fea7b9e3d7
SHA512 cb941c45f2313ce275bdeb19cf09b4c8f15ed752033a65e6a681d59fb9a83a59b7b7ff5060559ac1d7aef79405bdc55bf95bef2a0c6deb480f1f37eece2ce749
SSDEEP 196608:MhG3uXG5LE6HX5jNf9C4l55zBvyszq2eof:MhG+0pH9rV
TLSH
T17586E148777A4A7DE1128838C39A4077F11A391B9732A45E4D0DE7610FB2273AE7F792
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1445980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\n\Desktop\work\suomimania\eu\implant\tools\stego-pack\loader9\bin\Release\net9.0-windows\win-x64\native\msedgewebview2.pdb

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

FreeLibrary TlsFree CloseHandle CreateEventExW DuplicateHandle FormatMessageW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetModuleFileNameW GetProcAddress GetStdHandle GetThreadPriority GetTickCount64 IsDebuggerPresent LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException SetEvent SetLastError SetThreadErrorMode Sleep VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ResetEvent SleepEx DebugBreak InitializeCriticalSection WaitForSingleObject GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoTaskMemAlloc CoInitializeEx CoGetApartmentType CoUninitialize CoTaskMemFree CoWaitForMultipleHandles

api-ms-win-crt-math-l1-1-0

ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncmp strcmp strlen _stricmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate abort _register_onexit_function _initialize_onexit_table _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _register_thread_local_exe_atexit_callback __p___argc __p___wargv _cexit _c_exit _exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale