WindowsUpdate[.]exe

Resubmissions

17/09/2026, 00:11

260917-agtx9svscs

16/09/2026, 23:40

260916-3pc9psfe783

Sharing

Copy URL Twitter E-mail

General

Target
WindowsUpdate.exe
Size 102KB
Sample260916-3pc9psfe78
SHA256 51d90fd5a75e906c10bf5ee8b4b43f7f6505a0f889a90a03f65a425f0e6317aa
MD5 ccd05452b6534fcd589f4c42e297a049
SHA1 6160db17c76e6b42030ecca5414a7428c2a48a8c
SHA512 23aa6a1eb621a22ce0c7016674ed0d7593ea813e8e7f4612c0f4cb6d148c3a79758289dd8207bdb329205681351f1b9afe10ddf2cbcc8c0138d8c12184deb21d
SSDEEP 1536:rjlQEyJS2IW6dZ4rs9h9tWHxlj9Kq0vamDvzuoJk3AzXxmUHmJmDoka:rjlQS2g1D9CxV9Kqiiv3AzeoDok
TLSH
T1E2A3195BF38320FCC517C2744AD75332A671B8611124AF7EA7A4EA312E21E41BE79B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WindowsUpdate.exe

File Explorer

WindowsUpdate.exe

.exe 102KB

WindowsUpdate.exe

IMPHASH cd3aa4d359f2961b8facf28861bd6acf
SHA256 51d90fd5a75e906c10bf5ee8b4b43f7f6505a0f889a90a03f65a425f0e6317aa
MD5 ccd05452b6534fcd589f4c42e297a049
SHA1 6160db17c76e6b42030ecca5414a7428c2a48a8c
SHA512 23aa6a1eb621a22ce0c7016674ed0d7593ea813e8e7f4612c0f4cb6d148c3a79758289dd8207bdb329205681351f1b9afe10ddf2cbcc8c0138d8c12184deb21d
SSDEEP 1536:rjlQEyJS2IW6dZ4rs9h9tWHxlj9Kq0vamDvzuoJk3AzXxmUHmJmDoka:rjlQS2g1D9CxV9Kqiiv3AzeoDok
TLSH
T1E2A3195BF38320FCC517C2744AD75332A671B8611124AF7EA7A4EA312E21E41BE79B16
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid GetUserNameA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegSetValueExA

crypt32

CryptBinaryToStringA CryptStringToBinaryA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateFileA CreateMutexA CreatePipe CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA FreeEnvironmentStringsA GetComputerNameA GetCurrentDirectoryA GetCurrentProcessId GetEnvironmentStrings GetEnvironmentVariableA GetFileAttributesA GetFileSizeEx GetLastError GetLogicalDriveStringsA GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetTempPathA GetTickCount GetTickCount64 GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection OpenProcess Process32First Process32Next ReadFile RemoveDirectoryA SetCurrentDirectoryA SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte

api-ms-win-crt-convert-l1-1-0

atoi atol mbrtowc strtol strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fclose fflush fopen fputc fwrite getc setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_stricmp isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strncpy strnlen tolower wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand

shell32

SHGetFolderPathA ShellExecuteA

user32

CallNextHookEx CloseClipboard DispatchMessageA EmptyClipboard GetClipboardData GetDC GetForegroundWindow GetKeyboardState GetSystemMetrics GetWindowTextA LockWorkStation MessageBoxA OpenClipboard PeekMessageA ReleaseDC SetClipboardData SetWindowsHookExA SwapMouseButton SystemParametersInfoA ToUnicode TranslateMessage UnhookWindowsHookEx

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

winmm

mciSendStringA waveOutSetVolume

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send setsockopt socket

Name

.text

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

WindowsUpdate.exe

advapi32

crypt32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

user32

wininet

winmm

ws2_32

generic