Updater[.]exe | Triage™

Resubmissions

16/09/2026, 23:40

260916-3n7f6afe74

16/09/2026, 23:05

260916-226lcagm413

Sharing

Copy URL Twitter E-mail

General

Target
Updater.exe
Size 77KB
Sample260916-226lcagm41
SHA256 9824ca5a61f9b7ed495cd7556880c4d13a9ac66d3c7a7b7475b54c044200bee6
MD5 79dc75174f5e1e0db79e349a093d258a
SHA1 fd89e750f8fcdf45ae1ab153ab1da56ea2cda05d
SHA512 5aceffab60c4fb276198006b0bb4d2e39d205de660faf1b7fa71afff1b31c8bafb6f551135e8c77624b5fae1894f09b465a1e6e09792f3dd1864765fb2690afc
SSDEEP 768:ED5IB58qvWab38XVJRo1RyubwfH0uPmwevVcaeezF/0oqjxJvaQ:ED5IQ6KY1RyubwPxmwevAAFcofQ
TLSH
T1317320E43AD49CC6FA40527C55D6D2322A3CBAE1CA434B4765207A321F12FD13EDB66E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Updater.exe

File Explorer

Updater.exe

.exe 77KB

Updater.exe

IMPHASH 7cb2b98ae492524249636f5101a05251
SHA256 9824ca5a61f9b7ed495cd7556880c4d13a9ac66d3c7a7b7475b54c044200bee6
MD5 79dc75174f5e1e0db79e349a093d258a
SHA1 fd89e750f8fcdf45ae1ab153ab1da56ea2cda05d
SHA512 5aceffab60c4fb276198006b0bb4d2e39d205de660faf1b7fa71afff1b31c8bafb6f551135e8c77624b5fae1894f09b465a1e6e09792f3dd1864765fb2690afc
SSDEEP 768:ED5IB58qvWab38XVJRo1RyubwfH0uPmwevVcaeezF/0oqjxJvaQ:ED5IQ6KY1RyubwPxmwevAAFcofQ
TLSH
T1317320E43AD49CC6FA40527C55D6D2322A3CBAE1CA434B4765207A321F12FD13EDB66E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptBinaryToStringA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits GetObjectA SelectObject

kernel32

CloseHandle CreateFileA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA GetConsoleWindow GetCurrentDirectoryA GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetStartupInfoA GetTempPathA InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection ReadFile SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _pclose _popen fclose fflush fgets fopen fwrite setvbuf

api-ms-win-crt-string-l1-1-0

memset strcat strcmp strcpy strlen strncmp

shell32

ShellExecuteA

user32

CallNextHookEx DispatchMessageA GetDC GetKeyNameTextA GetSystemMetrics MessageBoxA PeekMessageA ReleaseDC SetWindowsHookExA ShowWindow TranslateMessage UnhookWindowsHookEx

ws2_32

WSACleanup WSAStartup closesocket connect gethostname htons inet_addr recv send socket

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

512B

Virtual Size

202B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

163B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Updater.exe

crypt32

gdi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

shell32

user32

ws2_32

generic