WindowsUpdate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WindowsUpdate.exe
Size 352KB
Sample261030-ejhp8svzbt
SHA256 139798bbb0cff70c150d8731c20b5e54fe2b78855771046049b84a6145be53b8
MD5 f3dba80373abc546a08fd1b0e3c9d88d
SHA1 fcba264e1b70b938890a981ff3b9dce09e249a38
SHA512 a1e86014fda0af2af1bd5bd77127bc88057c52d41fc480da17b2ae06f260acb38191370751a769ccd4f23794400e69f866daf017c18226ff97e3bf2a229605d8
SSDEEP 6144:rNZ2XgFlI/e624CYkdzdZkBjzWeoZYM49fV6Dz6tNPwgqtCDk4L:pWUIq4BkdpW1yxY9t7tNPwgR
TLSH
T157746C25EB6504FCE173D1B8CD674802EA727C8A0375AEEF139059A21F276D49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WindowsUpdate.exe

File Explorer

WindowsUpdate.exe

.exe 352KB

WindowsUpdate.exe

IMPHASH 9967305c5f44bb89b6cb098eade12607
SHA256 139798bbb0cff70c150d8731c20b5e54fe2b78855771046049b84a6145be53b8
MD5 f3dba80373abc546a08fd1b0e3c9d88d
SHA1 fcba264e1b70b938890a981ff3b9dce09e249a38
SHA512 a1e86014fda0af2af1bd5bd77127bc88057c52d41fc480da17b2ae06f260acb38191370751a769ccd4f23794400e69f866daf017c18226ff97e3bf2a229605d8
SSDEEP 6144:rNZ2XgFlI/e624CYkdzdZkBjzWeoZYM49fV6Dz6tNPwgqtCDk4L:pWUIq4BkdpW1yxY9t7tNPwgR
TLSH
T157746C25EB6504FCE173D1B8CD674802EA727C8A0375AEEF139059A21F276D49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

125472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

user32

GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW OpenClipboard CloseClipboard GetClipboardData GetAsyncKeyState GetKeyboardState ToUnicode VkKeyScanA VkKeyScanW SendInput GetSystemMetrics EnumDisplayMonitors CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetCursorPos SetCursorPos MessageBoxW GetWindowTextW ReleaseDC GetDC GetForegroundWindow

advapi32

GetTokenInformation GetUserNameA RegCloseKey RegDeleteValueW RegOpenKeyExW RegSetValueExW OpenProcessToken

gdi32

CreateCompatibleDC DeleteDC DeleteObject SelectObject StretchBlt SetStretchBltMode CreateCompatibleBitmap

gdiplus

GdipGetImageEncoders GdipFree GdipAlloc GdipSaveImageToStream GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdipDisposeImage GdiplusStartup

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

shell32

ShellExecuteW

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID FindFirstFileExW GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW IsValidLocale ExitProcess UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree HeapAlloc GetProcAddress GetModuleHandleExW FreeLibrary GetStdHandle IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue GetEnvironmentVariableA CreateDirectoryA CreateFileA CreateFileW DeleteFileA DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesA GetFileSize GetFileSizeEx ReadFile RemoveDirectoryW WriteFile GetTempPathA CloseHandle SetHandleInformation GetLastError CreatePipe InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateThread CreateProcessA CreateProcessW OpenProcess GetTickCount GetModuleFileNameW GetModuleHandleW GlobalSize GlobalUnlock GlobalLock CopyFileA MoveFileW GetComputerNameA MultiByteToWideChar WideCharToMultiByte InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW FlsAlloc RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError

Name

.text

Size

241KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WindowsUpdate.exe

winhttp

user32

advapi32

gdi32

gdiplus

ole32

shell32

kernel32

generic