wup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wup.exe
Size 91KB
Sample260914-v155vssvbz
SHA256 353b99d21990dcd8a9fe8be9eaa1bea5ca482272e9a022e281001720d50d9dac
MD5 dfe5f51894f8e350fa5efda40f3ab0f2
SHA1 7993d4f4cb5a7ae5db02a5cfdce38f6b49140ec1
SHA512 bd4cf9253904fefa8fe1a2c033acded511719f716fcc6ca5f9ecdb9ca0477244378f8181da055f365cc78f6d15d5d2eb60983a8cfde022c35512b42f2721f2b7
SSDEEP 1536:rG80sBkpKpgR0crlxHgfC7sMqfqmgV0uSpyHmODFF7V1zOF/W:rEsu5lm7uS0G+FR11
TLSH
T14C934A47B1A396BCC15AC4784AE767726B72B8650531BF3F1690EE311E11F60AF2CB06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wup.exe

File Explorer

wup.exe

.exe 91KB

wup.exe

IMPHASH 33d8e976ab21a92aed517f2ac65e9e34
SHA256 353b99d21990dcd8a9fe8be9eaa1bea5ca482272e9a022e281001720d50d9dac
MD5 dfe5f51894f8e350fa5efda40f3ab0f2
SHA1 7993d4f4cb5a7ae5db02a5cfdce38f6b49140ec1
SHA512 bd4cf9253904fefa8fe1a2c033acded511719f716fcc6ca5f9ecdb9ca0477244378f8181da055f365cc78f6d15d5d2eb60983a8cfde022c35512b42f2721f2b7
SSDEEP 1536:rG80sBkpKpgR0crlxHgfC7sMqfqmgV0uSpyHmODFF7V1zOF/W:rEsu5lm7uS0G+FR11
TLSH
T14C934A47B1A396BCC15AC4784AE767726B72B8650531BF3F1690EE311E11F60AF2CB06
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegDeleteValueA RegOpenKeyA RegSetValueExA

bcrypt

BCryptGenRandom

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateFileA CreatePipe CreateProcessA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetConsoleWindow GetCurrentProcessId GetLastError GetModuleFileNameA InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MoveFileA MultiByteToWideChar OpenProcess Process32First Process32Next ReadFile RemoveDirectoryA SetFileAttributesA SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _chdir _commode _errno _fmode _getcwd _initterm _mkdir _onexit _stat64 _stricmp _time64 abort atoi calloc exit fclose fopen fprintf fputc fread free fwrite getenv localeconv malloc memchr memcpy memset realloc remove signal strchr strcmp strcspn strerror strlen strncmp strncpy strrchr strspn system vfprintf wcslen

user32

ShowWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

ws2_32

WSAGetLastError WSAStartup closesocket connect gethostbyname gethostname htons inet_pton recv recvfrom send sendto setsockopt socket

Name

.text

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wup.exe

advapi32

bcrypt

kernel32

msvcrt

user32

winhttp

ws2_32

generic