upd_b344a83d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
upd_b344a83d.exe
Size 1.2MB
Sample261101-3fca2s1s8r
SHA256 b344a83d528b8f915e559d788153a1ee720514407a102c98138967a77aaa40e2
MD5 189da2657ed5d89d46a74bc3996437c2
SHA1 7d1f2e74c62e15b991fbe571a30b867c5a87371c
SHA512 a221b7f52bde3993fafaaf5c686e4e47fc355f5c8f81a1b7b83684c4ff7133de3cc64dcc69c60a9304bfc4ec01bcf568795b52aa5aa565405f3878831d1e80cc
SSDEEP 24576:kOCtNiEVUsJtdEfLGsuBDaLvTnPxKOCDhQHAyj3P03uelEit:kThhtWCRBu7DZmhgbrelEit
TLSH
T1454533BFDA400EF6D579593552FE65732A92BDFE0C109F30B1856A2A2D51CA01A3CF83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
upd_b344a83d.exe

File Explorer

upd_b344a83d.exe

.exe 1.2MB

upd_b344a83d.exe

IMPHASH 6c20e9eac2a829715b8868ed176877ff
SHA256 b344a83d528b8f915e559d788153a1ee720514407a102c98138967a77aaa40e2
MD5 189da2657ed5d89d46a74bc3996437c2
SHA1 7d1f2e74c62e15b991fbe571a30b867c5a87371c
SHA512 a221b7f52bde3993fafaaf5c686e4e47fc355f5c8f81a1b7b83684c4ff7133de3cc64dcc69c60a9304bfc4ec01bcf568795b52aa5aa565405f3878831d1e80cc
SSDEEP 24576:kOCtNiEVUsJtdEfLGsuBDaLvTnPxKOCDhQHAyj3P03uelEit:kThhtWCRBu7DZmhgbrelEit
TLSH
T1454533BFDA400EF6D579593552FE65732A92BDFE0C109F30B1856A2A2D51CA01A3CF83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CreateFileA CreateFileW CreateMutexA CreateProcessW DeleteCriticalSection EnterCriticalSection ExitProcess ExpandEnvironmentStringsA GetComputerNameA GetCurrentThread GetEnvironmentVariableA GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoW GetThreadContext GetTickCount GlobalMemoryStatusEx HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency ReadFile ResumeThread SetThreadContext SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WriteFile lstrcpyA lstrlenA

api-ms-win-crt-environment-l1-1-0

__p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

_strlwr _wcsicmp strlen strncmp wcslen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand srand

user32

GetCursorPos GetSystemMetrics wsprintfW

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

540B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cfgdat

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

upd_b344a83d.exe

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

generic