scodeupdate[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
scodeupdate.exe
Size 356KB
Sample261101-b455gsba55
SHA256 73d9d511a2372403ba903e96160712b0447f987aa6ac12b522874180005d8fa4
MD5 a624a18d9d86d9b7e9894f880d80707c
SHA1 550a642d711385f7f122a085434a95519ffc9d10
SHA512 5b84597007b96a7569ef70147316c1dde8c3df4e3bdbcf7a7d494ca79201ac6c4f726178a507d411412874332a73a0fb967fc171567d796331e008183e506316
SSDEEP 6144:lw7Hu0qFciO/qtBjejL3/OFk4fDiMEjRePmX5V+q9BgU:6Stci7ajL2nDZEjRePmX5
TLSH
T1C1746C25EA6808FCE173D1B8CD674802D6727C8E0375AADF239059A21F176E49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
scodeupdate.exe

File Explorer

scodeupdate.exe

.exe 356KB

scodeupdate.exe

IMPHASH c19bce5aad4b7898d9456b96d37fc41c
SHA256 73d9d511a2372403ba903e96160712b0447f987aa6ac12b522874180005d8fa4
MD5 a624a18d9d86d9b7e9894f880d80707c
SHA1 550a642d711385f7f122a085434a95519ffc9d10
SHA512 5b84597007b96a7569ef70147316c1dde8c3df4e3bdbcf7a7d494ca79201ac6c4f726178a507d411412874332a73a0fb967fc171567d796331e008183e506316
SSDEEP 6144:lw7Hu0qFciO/qtBjejL3/OFk4fDiMEjRePmX5V+q9BgU:6Stci7ajL2nDZEjRePmX5
TLSH
T1C1746C25EA6808FCE173D1B8CD674802D6727C8E0375AADF239059A21F176E49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl

user32

GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW OpenClipboard CloseClipboard GetClipboardData GetAsyncKeyState GetKeyboardState ToUnicode VkKeyScanA VkKeyScanW SendInput GetSystemMetrics EnumDisplayMonitors CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetCursorPos SetCursorPos MessageBoxW GetWindowTextW ReleaseDC GetDC GetForegroundWindow

advapi32

GetTokenInformation GetUserNameA RegCloseKey RegDeleteValueW RegOpenKeyExW RegSetValueExW OpenProcessToken

gdi32

CreateCompatibleDC DeleteDC DeleteObject SelectObject StretchBlt SetStretchBltMode SetBrushOrgEx CreateCompatibleBitmap

gdiplus

GdipAlloc GdiplusStartup GdipSaveImageToStream GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdipDisposeImage GdipFree

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

shell32

ShellExecuteW

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW LoadLibraryExW VirtualProtect GetFileType UnhandledExceptionFilter FindFirstFileExW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW GetLocaleInfoW GetCurrentProcessId IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree HeapAlloc GetProcAddress GetModuleHandleExW FreeLibrary GetStdHandle IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc GetEnvironmentVariableA CreateDirectoryA CreateFileA CreateFileW DeleteFileA DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesA GetFileSize GetFileSizeEx ReadFile RemoveDirectoryW WriteFile GetTempPathA CloseHandle SetHandleInformation GetLastError CreatePipe InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject Sleep GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess CreateThread CreateProcessA CreateProcessW OpenProcess GetTickCount GetModuleFileNameW GetModuleHandleW GlobalSize GlobalUnlock GlobalLock CopyFileA MoveFileW GetComputerNameA MultiByteToWideChar WideCharToMultiByte InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW SetLastError RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx

Name

.text

Size

246KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

scodeupdate.exe

winhttp

user32

advapi32

gdi32

gdiplus

ole32

shell32

kernel32

generic