upd[.]exe | Triage™

General

Target
upd.exe
Size 7.0MB
Sample260930-w4svdafb72
SHA256 ce8c5b4683505bdb606e41cbe7399df839c68c12992f9a1ab0965e0026ae668f
MD5 04ed4ff2f04fa4f396e66fe5aba76a54
SHA1 bf8d3cd9f16b67c54ff1263aea9862cbb4b7bdc6
SHA512 df21fc238b2603438c39e2ab98f113ef103669bc071d595cb43a3bda494c62cd2b0053d2c87aade3e19ad4612f87d500ab844185655046c45767414b30ea7f41
SSDEEP 196608:CivquXjLxHk1k4t7Viy3aY6/TFKp0t2E4xLbyBKigFxR:1v3LFsaY6/TFbtt45OBKJ
TLSH
T11E76335071DA51E8D7082EB90427DED01E09EDA92F57E5E773EA4EF70A28BC18E36C11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
upd.exe

File Explorer

upd.exe

.exe 7.0MB

upd.exe

IMPHASH dc7d264bd2a57dd40d441e6d59b26afb
SHA256 ce8c5b4683505bdb606e41cbe7399df839c68c12992f9a1ab0965e0026ae668f
MD5 04ed4ff2f04fa4f396e66fe5aba76a54
SHA1 bf8d3cd9f16b67c54ff1263aea9862cbb4b7bdc6
SHA512 df21fc238b2603438c39e2ab98f113ef103669bc071d595cb43a3bda494c62cd2b0053d2c87aade3e19ad4612f87d500ab844185655046c45767414b30ea7f41
SSDEEP 196608:CivquXjLxHk1k4t7Viy3aY6/TFKp0t2E4xLbyBKigFxR:1v3LFsaY6/TFbtt45OBKJ
TLSH
T11E76335071DA51E8D7082EB90427DED01E09EDA92F57E5E773EA4EF70A28BC18E36C11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

22160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateThread VirtualAlloc VirtualFree GetModuleHandleA GetProcAddress WaitForSingleObject LockResource SizeofResource LoadLibraryA FindResourceExA WriteConsoleW LoadResource CloseHandle IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW HeapFree HeapAlloc IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW DecodePointer

advapi32

RegGetValueA

Name

.text

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pedata

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

upd.exe

kernel32

advapi32

generic