Auto updater[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Auto updater.exe
Size 940KB
Sample260823-d62aeshc28
SHA256 647eb21a09ed8a0d4f94f03c023658c8abe4ee577aad4c209535b8e348177175
MD5 678a12587c2e3cd37dc9e3d276100b73
SHA1 9690a816fed1e3ffab48d40b322b463fde20fee0
SHA512 f41db791a9c7e30489766f95a004aad0d14275c9c209252b20064dfe736482b4fd52fb1d85b00117409a53f9cb6d7daee622be658d15681a94cb664ad5ba80fc
SSDEEP 24576:AnYWf9c8Ype/rhipUuqdqja/8GuBzhdRwxNXHI4ee5k:AYWf9cjrp2QI8GuBzhdRwxNXHI4es
TLSH
T1E6259D5BA7A401FCC5BBD17CC61B8617E7B270590320A6DB06E0C6A52F13BE16B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Auto updater.exe

File Explorer

Auto updater.exe

.exe 940KB

Auto updater.exe

IMPHASH 9eb9ea7b920ab65c5c0cb996523d8987
SHA256 647eb21a09ed8a0d4f94f03c023658c8abe4ee577aad4c209535b8e348177175
MD5 678a12587c2e3cd37dc9e3d276100b73
SHA1 9690a816fed1e3ffab48d40b322b463fde20fee0
SHA512 f41db791a9c7e30489766f95a004aad0d14275c9c209252b20064dfe736482b4fd52fb1d85b00117409a53f9cb6d7daee622be658d15681a94cb664ad5ba80fc
SSDEEP 24576:AnYWf9c8Ype/rhipUuqdqja/8GuBzhdRwxNXHI4ee5k:AYWf9cjrp2QI8GuBzhdRwxNXHI4es
TLSH
T1E6259D5BA7A401FCC5BBD17CC61B8617E7B270590320A6DB06E0C6A52F13BE16B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

1234

Minor OS version

Major OS version

Entry point

715312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a orqur soure code\protection\Auto updater (reseller only)\x64\Release\Auto updater.pdb

kernel32

AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetFileSizeEx CreateFileW VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW WideCharToMultiByte MultiByteToWideChar GetTickCount QueryPerformanceCounter GetSystemInfo SleepEx LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary GetSystemDirectoryW QueryPerformanceFrequency LocalFree LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError GetModuleHandleA GetModuleFileNameW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleFileNameA DeleteCriticalSection InitializeCriticalSectionEx GetLastError GetCurrentProcess GetFileInformationByHandleEx GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetConsoleWindow CloseHandle Sleep GetCurrentProcessId

user32

ShowWindow MessageBoxA

advapi32

CryptEncrypt RegDeleteKeyA CryptImportKey CryptDestroyKey SystemFunction036 GetTokenInformation OpenProcessToken CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

shell32

ShellExecuteA

msvcp140

_Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_function_call@std@@YAXXZ ?_Random_device@std@@YAIXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1_Lockit@std@@QEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?uncaught_exception@std@@YA_NXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertOpenStore

ws2_32

inet_ntop WSAStartup WSACleanup bind connect getpeername getsockname htons gethostname ioctlsocket sendto recvfrom freeaddrinfo ntohs getaddrinfo listen htonl accept select getsockopt send WSACloseEvent WSACreateEvent __WSAFDIsSet WSAEnumNetworkEvents WSAEventSelect WSAIoctl WSAResetEvent WSAWaitForMultipleEvents socket closesocket WSAGetLastError recv inet_pton setsockopt WSASetLastError

shlwapi

PathFindFileNameW

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset wcschr memmove __C_specific_handler __current_exception __current_exception_context strstr memcmp memchr _CxxThrowException __std_terminate strchr __std_exception_destroy memcpy strrchr __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

fflush fputc fread _close _fileno _write _read _fseeki64 __p__commode _set_fmode _get_stream_buffer_pointers _lseeki64 fgets _pclose fclose _wfopen _wopen _popen __stdio_common_vsscanf __stdio_common_vsprintf fsetpos ftell fseek feof fgetc fputs ungetc setvbuf fwrite __acrt_iob_func fgetpos

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode realloc _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _errno _cexit exit _seh_filter_exe _set_app_type _configure_narrow_argv _initterm _initterm_e _exit system __p___argc __p___argv _c_exit terminate _register_thread_local_exe_atexit_callback _beginthreadex _initialize_onexit_table __sys_errlist _get_initial_narrow_environment abort __sys_nerr _invoke_watson _register_onexit_function _initialize_narrow_environment _invalid_parameter_noinfo_noreturn

api-ms-win-crt-filesystem-l1-1-0

_unlink _lock_file _unlock_file _wstat64 _fstat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strcspn strncmp strspn strcmp wcsncmp strpbrk tolower wcsncpy _strdup _wcsdup wcspbrk

api-ms-win-crt-math-l1-1-0

_dsign __setusermatherr _fdopen

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoull wcstombs atoi strtoul

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64 _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-utility-l1-1-0

qsort