Windows-KB2670838[.]msu[.]zip

General

Target
Windows-KB2670838.msu.zip
Size 611KB
Sample260930-gbb9laxw8k
SHA256 84499bf8af22cde94ee1c254d184df10bfcbf12fdaad7860950e8ba4face0e6b
MD5 f1ef0cd4929622d18dcdd9fe5f228e4b
SHA1 403bd7b9e78a5b8a617c8d28cf3c2e36c193dda9
SHA512 c1aa6a8fb94a721c07b4e9928dd48909dd7fde70db3db4b5600f3a8eb0d387dae09859d04ba5d00975b0aa0f68e2cacd846d3a5c00f818ceaf7bccc629abdd44
SSDEEP 12288:n/mt4UZ+bWpTYY7xKsBMkhWDD47Lmmy+AcrGTBzkO8LdTdlCw8JXUd15m:n/mmRwTYHI4g7LyLdON7585Ud15m
TLSH
T12ED423437560BA64A319674DB15A8D1D0AE8B20AAB63CFF4035DD13FCF0F82289E7567
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Windows-KB2670838.msu.exe

File Explorer

Windows-KB2670838.msu.zip

.zip 611KB
Windows-KB2670838.msu.exe

.exe 728KB

Windows-KB2670838.msu.zip

SHA256 84499bf8af22cde94ee1c254d184df10bfcbf12fdaad7860950e8ba4face0e6b
MD5 f1ef0cd4929622d18dcdd9fe5f228e4b
SHA1 403bd7b9e78a5b8a617c8d28cf3c2e36c193dda9
SHA512 c1aa6a8fb94a721c07b4e9928dd48909dd7fde70db3db4b5600f3a8eb0d387dae09859d04ba5d00975b0aa0f68e2cacd846d3a5c00f818ceaf7bccc629abdd44
SSDEEP 12288:n/mt4UZ+bWpTYY7xKsBMkhWDD47Lmmy+AcrGTBzkO8LdTdlCw8JXUd15m:n/mmRwTYHI4g7LyLdON7585Ud15m
TLSH
T12ED423437560BA64A319674DB15A8D1D0AE8B20AAB63CFF4035DD13FCF0F82289E7567
MD5 SHA1 SHA512 SSDEEP TLSH

Windows-KB2670838.msu.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f91f02fd27ada64f36f6df59a611fef106ff7734833dea825d0612e73bdfb621
MD5 6e49c75f701aa059fa6ed5859650b910
SHA1 ccb7898c509c3a1de96d2010d638f6a719f6f400
SHA512 ccd1b581a29de52d2313a97eb3c3b32b223dba1e7a49c83f7774b374bc2d16b13fba9566de6762883f3b64ed8e80327b454e5d32392af2a032c22653fed0fff8
SSDEEP 12288:5P/dTi0RF8dlFepPB0RF8dlFodTqPtoUBJMlANI/:5P/QBCpZB0iv8ld/
TLSH
T153F41292BB4896B6C9B291F11D15C0A522237C3EDE11429A38DCB71E6FF8143D63A727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

537326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Visual Studio Projects\WindowsUpdate\WindowsUpdate\obj\Release\Windows-KB2670838.msu.pdb

Windows-KB2670838.msu.zip

Windows-KB2670838.msu.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Windows-KB2670838.msu.zip

Windows-KB2670838.msu.exe

mscoree

dotnet