upd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
upd.exe
Size 198KB
Sample261002-eqb62atdmg
SHA256 f3016f7e967ace800d9aa1c66535dbd698f51182628fa7c415e2f1c4699e4ab3
MD5 05c79741f371b3db9412f3d4652747ae
SHA1 1596171868a2d9fb34c818c6eedaa20dec4ac4b1
SHA512 646aca87ce9e9335a7c22405538edf846264a020d452a21ed9436ad8f51020dca5f5ed55515be3e89dfa3bd324667058009b77352abec8eb44fa50e90edb5492
SSDEEP 3072:tKT3EcOkjUT3SJrKCqIFzkhEfIkQC1LfEtyHo6hEq0XKCmJjquVF3tO:tKT3EcOMGCx6hAI4l8mBquVZg
TLSH
T1CB148E19B7AA10FBE1779938C9514906FA737C524760AADF43900BB68F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
upd.exe

File Explorer

upd.exe

.exe 198KB

upd.exe

IMPHASH 31255cad033271b7d1d8d38eb82eb60e
SHA256 f3016f7e967ace800d9aa1c66535dbd698f51182628fa7c415e2f1c4699e4ab3
MD5 05c79741f371b3db9412f3d4652747ae
SHA1 1596171868a2d9fb34c818c6eedaa20dec4ac4b1
SHA512 646aca87ce9e9335a7c22405538edf846264a020d452a21ed9436ad8f51020dca5f5ed55515be3e89dfa3bd324667058009b77352abec8eb44fa50e90edb5492
SSDEEP 3072:tKT3EcOkjUT3SJrKCqIFzkhEfIkQC1LfEtyHo6hEq0XKCmJjquVF3tO:tKT3EcOMGCx6hAI4l8mBquVZg
TLSH
T1CB148E19B7AA10FBE1779938C9514906FA737C524760AADF43900BB68F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect inet_pton WSAStartup socket send recv htons closesocket

user32

GetMessageA TranslateMessage DispatchMessageA GetKeyboardState ToAscii GetSystemMetrics CallNextHookEx SetWindowsHookExA MessageBoxA ReleaseDC GetDC

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetOpenA

gdi32

GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

advapi32

RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteKeyValueA

shell32

ShellExecuteA

kernel32

LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW CompareStringW LCMapStringW GetProcessHeap ReadFile CreateFileW ReadConsoleW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile LeaveCriticalSection GetEnvironmentStringsW WideCharToMultiByte DeleteFileA Sleep ExitProcess CreateThread GetModuleFileNameA GetModuleHandleA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW MultiByteToWideChar RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection RtlUnwind InitializeCriticalSectionEx DeleteCriticalSection CloseHandle DuplicateHandle GetCurrentProcess CreateProcessW GetStdHandle WriteFile GetModuleFileNameW TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree WaitForSingleObject GetExitCodeProcess GetFileAttributesExW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileType GetFileSizeEx SetFilePointerEx HeapAlloc CreatePipe FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

Name

.text

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

upd.exe

ws2_32

user32

wininet

gdi32

advapi32

shell32

kernel32

generic