update[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
update.zip
Size 476KB
Sample260916-vg9zpsdn6v
SHA256 539e8c9641fbb2004fbf5af4b352c9853293612cb04f8ec639699fcb4abce4c5
MD5 4a0fb46f3be0219b4403a7b722ca30f3
SHA1 e126689acf75fe34bb1aaaa5735275abb3c3db0d
SHA512 d912a50e9c9b2b4f0b859630156740d3d851232fcaa0804d7fc4fe7703c3e53da6ba96f6043079bce4abcfb6aaf185157a0300c192bcf5824bf324a2bd8a9135
SSDEEP 12288:U8yprs1Q9H34Uos/UqE1f4RmTgIsmmmmmmmmmmmmmmmmmmmmmmmC:U8Ars1Q9H3oNKZ
TLSH
T15FA4F14D5EBE0EEA31C984C54A618751BF8903D8DC378CB7BDA982DE019661428F87DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SyncHost.exe
unpack001/propsys.dll

File Explorer

update.zip

.zip 476KB
1.bat

.bat 1KB
SyncHost.exe

.exe 42KB
propsys.dll

.dll 1.6MB

update.zip

SHA256 539e8c9641fbb2004fbf5af4b352c9853293612cb04f8ec639699fcb4abce4c5
MD5 4a0fb46f3be0219b4403a7b722ca30f3
SHA1 e126689acf75fe34bb1aaaa5735275abb3c3db0d
SHA512 d912a50e9c9b2b4f0b859630156740d3d851232fcaa0804d7fc4fe7703c3e53da6ba96f6043079bce4abcfb6aaf185157a0300c192bcf5824bf324a2bd8a9135
SSDEEP 12288:U8yprs1Q9H34Uos/UqE1f4RmTgIsmmmmmmmmmmmmmmmmmmmmmmmC:U8Ars1Q9H3oNKZ
TLSH
T15FA4F14D5EBE0EEA31C984C54A618751BF8903D8DC378CB7BDA982DE019661428F87DF
MD5 SHA1 SHA512 SSDEEP TLSH

SyncHost.exe

IMPHASH 5aa0983e1070b60743f3452592b62369
SHA256 581f472d7b4222aa55ca742b717905a2607c64ff49a5180c8508e02cf806eee5
MD5 7c3cdc978e54fb2bc807599f430f76a4
SHA1 74782febff75ca3a3147ec3b6bbe7615003ebca5
SHA512 43eec8ccd716122e05a4f9037f5bc6ea9fff0ed2dd2172d4169dcba4c2c662fc53fac3a1410a28c315645e8c51368d9bf05964c3e0056653ac286141e9160b44
SSDEEP 768:xdeHKOKReTHFpBsUtb4Pz53eNUqmdieqyQOhxIHtHqAvj6qLXyOA++tCfq:KHKJ4HFb4PgUTh2wR42wXyOZ
TLSH
T1C8135D53B3FD24B6D1BAD13ACAE28319D6B1B691571017CF316C025E6F32AE18A3D712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SyncHost.pdb

advapi32

RegCreateKeyExW GetTraceEnableFlags RegQueryInfoKeyW GetTraceLoggerHandle RegDeleteValueW UnregisterTraceGuids RegOpenKeyExW GetTraceEnableLevel RegEnumKeyExW RegCloseKey RegisterTraceGuidsW RegSetValueExW TraceMessage

kernel32

GetCommandLineW FindResourceW FreeLibrary LoadResource LoadLibraryExW SetEvent GetModuleHandleW InitializeCriticalSection LoadLibraryW Sleep SizeofResource LeaveCriticalSection GetModuleFileNameW MultiByteToWideChar lstrlenW RaiseException GetLastError GetProcAddress EnterCriticalSection lstrcmpiW DeleteCriticalSection GetCurrentThreadId FormatMessageW DebugBreak GetVersionExA GetStartupInfoW SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter OutputDebugStringA

user32

GetMessageW CharNextW TranslateMessage CharUpperW DispatchMessageW PostThreadMessageW UnregisterClassA

msvcrt

memset ??2@YAPEAX_K@Z _purecall _errno wcscat_s memcpy_s ??_V@YAXPEAX@Z malloc free ??_U@YAPEAX_K@Z realloc ?terminate@@YAXXZ _lock __dllonexit _unlock __set_app_type _fmode _commode __setusermatherr _amsg_exit _initterm _wcmdln exit _cexit _onexit wcsncpy_s ??3@YAXPEAX@Z _exit _XcptFilter __wgetmainargs __C_specific_handler wcscpy_s memcmp

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

ole32

CoTaskMemAlloc CoTaskMemFree CoInitializeEx CoTaskMemRealloc CoUninitialize CoCreateInstance CoRevokeClassObject CoRegisterClassObject PropVariantClear StringFromGUID2

oleaut32

SysAllocString SysStringLen LoadTypeLi UnRegisterTypeLi VarUI4FromStr RegisterTypeLi GetErrorInfo SysFreeString

shlwapi

SHStrDupW

propsys

PropVariantToUInt32 PropVariantToGUID

winsync

ord1

propsys.dll

IMPHASH 26c2856b9813d8990c01c5a711b5063a
SHA256 f4ef1dff3515c3428d59e102e454427d38985453556dce236e26d4496834caa1
MD5 f01264059fb153ac68ad5e46d1a93176
SHA1 d4fe8c09604fbb3667fc75d66b13b1c837979674
SHA512 0bcb03ba12bfd8b3f65d3b7a73aeac3e67227e73285765ddeac7a14b3f1f2f5d6ba2569341f30975722d77d4ba7e4a5a1b520ef5119248b7b0a83a1062e038a6
SSDEEP 12288:l+AsLFRagpMmUH9kbafa5AIOMzCEo79GXKMclAIIrA95DiaVAStpZUPlt/wffK:0LXLMPdOawAlMzC37kXclbxZiap0Z
TLSH
T1C8752A24FA6D9D6CCC9D4137CA70F634DD2AFEB286309205A3B8F277A8017945B6B711
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

propsys.pdb

msvcrt

_onexit _vsnwprintf __dllonexit _unlock __C_specific_handler _amsg_exit free _initterm malloc _XcptFilter memcmp memcpy memset wcstoul _errno swscanf_s swprintf_s wcstod _wcstoui64 iswcntrl iswprint iswalnum iswspace towlower qsort iswpunct _wcsicmp _wcsnicmp wcsncmp bsearch _vsnprintf _strnicmp isalpha _wcstoi64 wcstol qsort_s _ultow_s wcschr iswalpha memmove _lock floor

ntdll

RtlNtStatusToDosError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

kernel32

FindNextFileW FindResourceExW DuplicateHandle LoadResource RegDeleteKeyExA RegDeleteValueA ExpandEnvironmentStringsA ExpandEnvironmentStringsW UnlockFileEx LockFileEx SetEndOfFile WriteFile SetFilePointer SetFileInformationByHandle ReplaceFileW GetFileInformationByHandleEx GetVolumeInformationByHandleW SetFilePointerEx ReadFile RegSetValueExA LocalReAlloc lstrcmpiW GetCurrentThread SizeofResource FindResourceW GetModuleHandleW InitializeCriticalSection DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection LocalFree LocalAlloc lstrlenW GetLocaleInfoW GetLastError GetCalendarInfoW GetDurationFormat InitializeSRWLock AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared EnterCriticalSection CreateMutexW WaitForSingleObject ReleaseMutex CloseHandle GetTickCount SetLastError LoadLibraryExW FreeLibrary FindNLSString GetDateFormatW GetLocalTime CompareFileTime GetUserDefaultLCID CompareStringW GetThreadLocale FileTimeToSystemTime LoadLibraryW GetProcAddress GetCurrentProcess HeapAlloc GetProcessHeap HeapFree TlsFree TlsAlloc DisableThreadLibraryCalls FileTimeToLocalFileTime SystemTimeToFileTime WideCharToMultiByte GlobalAlloc GlobalFree GetFileAttributesExW GetModuleFileNameW GetSystemDirectoryW GetSystemWow64DirectoryW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetTimeFormatW LoadLibraryExA DelayLoadFailureHook GetCurrentThreadId GetNumberFormatW FormatMessageW lstrlenA MultiByteToWideChar GetUserDefaultUILanguage GetModuleHandleExW TlsSetValue TlsGetValue TzSpecificLocalTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemInfo MapViewOfFile VirtualAlloc UnmapViewOfFile FindFirstFileW DeleteFileW FindClose CreateDirectoryW LoadLibraryA GetEnvironmentVariableW OpenFileMappingW CreateFileMappingW CreateFileW FlushViewOfFile Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileAttributesW SetErrorMode RegQueryInfoKeyA LockResource LocaleNameToLCID GetStringTypeW SearchPathW GetSystemDefaultUILanguage GetVersionExW HeapReAlloc lstrcmpiA RegOpenKeyExA GetFileAttributesA GetModuleFileNameA GetModuleHandleA IsDBCSLeadByte GetCPInfo CompareStringA RegQueryInfoKeyW RegDeleteKeyExW RegEnumValueW RegDeleteValueW RegSetValueExW RegQueryValueExA

ole32

CoFileTimeNow StringFromGUID2 CreateBindCtx CLSIDFromString CoTaskMemRealloc CoCreateInstance StringFromCLSID CoTaskMemFree PropVariantClear PropVariantCopy CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoGetMalloc StgOpenStorageOnILockBytes CreateStreamOnHGlobal CoGetApartmentType CoRegisterInitializeSpy CoRevokeInitializeSpy FreePropVariantArray

oleaut32

SysFreeString VariantInit SystemTimeToVariantTime SafeArrayGetElement SafeArrayGetVartype SafeArrayPtrOfIndex VarBstrFromR8 VarBstrFromBool VarBstrFromI2 SysAllocStringLen VarBstrFromUI1 VarBstrFromUI2 VarBstrFromI4 VarBstrFromUI4 VarBstrFromI8 VarBstrFromUI8 VarBoolFromR8 VarI1FromR8 VarUI1FromR8 VarI2FromR8 VarUI2FromR8 VarI4FromR8 VarUI4FromR8 VarI8FromR8 VarUI8FromR8 VarBoolFromStr SafeArrayPutElement SafeArrayCreate SafeArrayDestroy VariantCopy SysStringLen SafeArrayCreateVector VariantTimeToDosDateTime VarCmp SafeArrayUnaccessData SafeArrayAccessData VariantChangeType VariantTimeToSystemTime SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SysAllocString VarMul VariantClear VarDiv VarRound VarPow VarNeg LPSAFEARRAY_UserFree LPSAFEARRAY_UserUnmarshal BSTR_UserSize64 BSTR_UserFree64 LPSAFEARRAY_UserMarshal64 LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserFree64 BSTR_UserMarshal LPSAFEARRAY_UserSize64 LPSAFEARRAY_UserSize LPSAFEARRAY_UserUnmarshal64 BSTR_UserUnmarshal64 BSTR_UserMarshal64 BSTR_UserUnmarshal BSTR_UserFree BSTR_UserSize SysAllocStringByteLen SafeArrayCreateEx VarBstrFromI1 SafeArrayGetElemsize

user32

CharLowerW LoadStringW CharNextA GetSystemMetrics CharPrevA

rpcrt4

CStdStubBuffer_Invoke CStdStubBuffer_Connect NdrStubForwardingFunction NdrStubCall3 CStdStubBuffer_Disconnect CStdStubBuffer_DebugServerRelease IUnknown_AddRef_Proxy CStdStubBuffer_QueryInterface CStdStubBuffer_DebugServerQueryInterface NdrClientCall3 IUnknown_Release_Proxy CStdStubBuffer_CountRefs NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy CStdStubBuffer_AddRef UuidCreate NdrDllUnregisterProxy NdrDllRegisterProxy NdrDllGetClassObject NdrDllCanUnloadNow NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release CStdStubBuffer_IsIIDSupported

ClearPropVariantArray ClearVariantArray DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer GetProxyDllInfo InitPropVariantFromBooleanVector InitPropVariantFromBuffer InitPropVariantFromCLSID InitPropVariantFromDoubleVector InitPropVariantFromFileTime InitPropVariantFromFileTimeVector InitPropVariantFromGUIDAsString InitPropVariantFromInt16Vector InitPropVariantFromInt32Vector InitPropVariantFromInt64Vector InitPropVariantFromPropVariantVectorElem InitPropVariantFromResource InitPropVariantFromStrRet InitPropVariantFromStringAsVector InitPropVariantFromStringVector InitPropVariantFromUInt16Vector InitPropVariantFromUInt32Vector InitPropVariantFromUInt64Vector InitPropVariantVectorFromPropVariant InitVariantFromBooleanArray InitVariantFromBuffer InitVariantFromDoubleArray InitVariantFromFileTime InitVariantFromFileTimeArray InitVariantFromGUIDAsString InitVariantFromInt16Array InitVariantFromInt32Array InitVariantFromInt64Array InitVariantFromResource InitVariantFromStrRet InitVariantFromStringArray InitVariantFromUInt16Array InitVariantFromUInt32Array InitVariantFromUInt64Array InitVariantFromVariantArrayElem PSCoerceToCanonicalValue PSCreateAdapterFromPropertyStore PSCreateDelayedMultiplexPropertyStore PSCreateMemoryPropertyStore PSCreateMultiplexPropertyStore PSCreatePropertyChangeArray PSCreatePropertyStoreFromObject PSCreatePropertyStoreFromPropertySetStorage PSCreateSimplePropertyChange PSEnumeratePropertyDescriptions PSFormatForDisplay PSFormatForDisplayAlloc PSFormatPropertyValue PSGetImageReferenceForValue PSGetItemPropertyHandler PSGetItemPropertyHandlerWithCreateObject PSGetNameFromPropertyKey PSGetNamedPropertyFromPropertyStorage PSGetPropertyDescription PSGetPropertyDescriptionByName PSGetPropertyDescriptionListFromString PSGetPropertyFromPropertyStorage PSGetPropertyKeyFromName PSGetPropertySystem PSGetPropertyValue PSLookupPropertyHandlerCLSID PSPropertyBag_Delete PSPropertyBag_ReadBOOL PSPropertyBag_ReadBSTR PSPropertyBag_ReadDWORD PSPropertyBag_ReadGUID PSPropertyBag_ReadInt PSPropertyBag_ReadLONG PSPropertyBag_ReadPOINTL PSPropertyBag_ReadPOINTS PSPropertyBag_ReadPropertyKey PSPropertyBag_ReadRECTL PSPropertyBag_ReadSHORT PSPropertyBag_ReadStr PSPropertyBag_ReadStrAlloc PSPropertyBag_ReadStream PSPropertyBag_ReadType PSPropertyBag_ReadULONGLONG PSPropertyBag_ReadUnknown PSPropertyBag_WriteBOOL PSPropertyBag_WriteBSTR PSPropertyBag_WriteDWORD PSPropertyBag_WriteGUID PSPropertyBag_WriteInt PSPropertyBag_WriteLONG PSPropertyBag_WritePOINTL PSPropertyBag_WritePOINTS PSPropertyBag_WritePropertyKey PSPropertyBag_WriteRECTL PSPropertyBag_WriteSHORT PSPropertyBag_WriteStr PSPropertyBag_WriteStream PSPropertyBag_WriteULONGLONG PSPropertyBag_WriteUnknown PSPropertyKeyFromString PSRefreshPropertySchema PSRegisterPropertySchema PSSetPropertyValue PSStringFromPropertyKey PSUnregisterPropertySchema PropVariantChangeType PropVariantCompareEx PropVariantGetBooleanElem PropVariantGetDoubleElem PropVariantGetElementCount PropVariantGetFileTimeElem PropVariantGetInt16Elem PropVariantGetInt32Elem PropVariantGetInt64Elem PropVariantGetStringElem PropVariantGetUInt16Elem PropVariantGetUInt32Elem PropVariantGetUInt64Elem PropVariantToBSTR PropVariantToBoolean PropVariantToBooleanVector PropVariantToBooleanVectorAlloc PropVariantToBooleanWithDefault PropVariantToBuffer PropVariantToDouble PropVariantToDoubleVector PropVariantToDoubleVectorAlloc PropVariantToDoubleWithDefault PropVariantToFileTime PropVariantToFileTimeVector PropVariantToFileTimeVectorAlloc PropVariantToGUID PropVariantToInt16 PropVariantToInt16Vector PropVariantToInt16VectorAlloc PropVariantToInt16WithDefault PropVariantToInt32 PropVariantToInt32Vector PropVariantToInt32VectorAlloc PropVariantToInt32WithDefault PropVariantToInt64 PropVariantToInt64Vector PropVariantToInt64VectorAlloc PropVariantToInt64WithDefault PropVariantToStrRet PropVariantToString PropVariantToStringAlloc PropVariantToStringVector PropVariantToStringVectorAlloc PropVariantToStringWithDefault PropVariantToUInt16 PropVariantToUInt16Vector PropVariantToUInt16VectorAlloc PropVariantToUInt16WithDefault PropVariantToUInt32 PropVariantToUInt32Vector PropVariantToUInt32VectorAlloc PropVariantToUInt32WithDefault PropVariantToUInt64 PropVariantToUInt64Vector PropVariantToUInt64VectorAlloc PropVariantToUInt64WithDefault PropVariantToVariant StgDeserializePropVariant StgSerializePropVariant VariantCompare VariantGetBooleanElem VariantGetDoubleElem VariantGetElementCount VariantGetInt16Elem VariantGetInt32Elem VariantGetInt64Elem VariantGetStringElem VariantGetUInt16Elem VariantGetUInt32Elem VariantGetUInt64Elem VariantToBoolean VariantToBooleanArray VariantToBooleanArrayAlloc VariantToBooleanWithDefault VariantToBuffer VariantToDosDateTime VariantToDouble VariantToDoubleArray VariantToDoubleArrayAlloc VariantToDoubleWithDefault VariantToFileTime VariantToGUID VariantToInt16 VariantToInt16Array VariantToInt16ArrayAlloc VariantToInt16WithDefault VariantToInt32 VariantToInt32Array VariantToInt32ArrayAlloc VariantToInt32WithDefault VariantToInt64 VariantToInt64Array VariantToInt64ArrayAlloc VariantToInt64WithDefault VariantToPropVariant VariantToStrRet VariantToString VariantToStringAlloc VariantToStringArray VariantToStringArrayAlloc VariantToStringWithDefault VariantToUInt16 VariantToUInt16Array VariantToUInt16ArrayAlloc VariantToUInt16WithDefault VariantToUInt32 VariantToUInt32Array VariantToUInt32ArrayAlloc VariantToUInt32WithDefault VariantToUInt64 VariantToUInt64Array VariantToUInt64ArrayAlloc VariantToUInt64WithDefault

Name

.text

Size

419KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

1024B

Virtual Size

745B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

731KB

Virtual Size

730KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cpoc

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

update.zip

1.bat

SyncHost.exe

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

shlwapi

propsys

winsync

generic

propsys.dll

msvcrt

ntdll

kernel32

ole32

oleaut32

user32

rpcrt4

generic