iupdate.exe

First submission 2024-10-15 18:12:03

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 5385.5 KB (5514752 bytes)
Compile time: 2024-10-08 14:35:02
MD5: 8f2382e57ef226bcbf3f549280a59085
SHA1: c2b51f4d2ab05a13e55ddf493febfbb64d091dd6
SHA256: 7610decf9c6c0fe1da22550d4542b9c42be3c7ede12a7c768200b74b45c4b470
Import Hash : a5d5c38edfe5a4011fc459b9f1adab46
Sections 11 .text .itext .data .bss .idata .didata .edata .tls .rdata .reloc .rsrc
Directories 5 import export resource tls relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 28/77 VT report date: 2024-10-10 19:53:49
Malware Type 1 trojan
Threat Type 2 midie sonbokli

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://download.innovare.no/ftp/iupdate.exe VirusTotal Report download.innovare.no VirusTotal Report 2024-10-15 18:12:03

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x46a4c0 4630016 4c2b5cbd3118d643fda623317ff274135ab4bd21 eccbd6312c811e62c0b76446a0c107bc
.itext 0x46c000 0x5f18 24576 9e84e60397d55fb3dcea6cbf1e0e8791e93d8e57 2e813652681c973c49a115adb3f1575c
.data 0x472000 0x17718 96256 57d31d8a3d2b2c24fc5c83a1873a7fad3b21cd8a 1525d12d40ea56b7b2962985030edb93
.bss 0x48a000 0x1b4ec 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0x4a6000 0x3ade 15360 8b41d7363d108502b23f4834336ffdbac44d0ac4 e0cec0d9f82f7e7dd01f0d04801146b1
.didata 0x4aa000 0xe14 4096 e354c86b707bc878293b084fda2aa822a6dc1f93 5c9084f982cae4e046526dafb1920f5d
.edata 0x4ab000 0x70 512 017416f007e5d69b2656930441075bf17a1b2f5b 88d4fea0f70eace093a52c91f3fa0de7
.tls 0x4ac000 0x54 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x4ad000 0x5d 512 bc06fb5dce68f46596ceeabb9758d465736496aa 513cab3271beeb577823378207549162
.reloc 0x4ae000 0x5d7b4 382976 fd5a738bae67f560e60d223cb11b2e4588ce0678 dcdfd97b1144298b8a907e8d00e6257a
.rsrc 0x50c000 0x57c00 359424 adaf69f14c296f37f3d7eec80f06a6622a382cde e286826f9bfbfeb018c6c88ac1b99d06

PE Resources 9

Name Language Sublanguage Offset Size Data
RT_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x50f018 308
RT_BITMAP LANG_ENGLISH SUBLANG_ENGLISH_US 0x50f96c 224
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x50fa4c 9640
RT_STRING LANG_NEUTRAL SUBLANG_NEUTRAL 0x5222e4 820
RT_RCDATA LANG_NEUTRAL SUBLANG_NEUTRAL 0x554ed0 58074
RT_GROUP_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x563238 20
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x56324c 20
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x563260 500
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x563454 1495

Meta infos 6

ProgramID: com.embarcadero.iupdate
FileVersion: 1.0.0.0
FileDescription: iupdate
Translation: 0x0409 0x04e4
ProductName: iupdate
ProductVersion: 1.0.0.0

Packers detected 5

Borland Delphi 3.0 (???)
Borland Delphi 4.0
Borland Delphi v3.0
Borland Delphi v6.0 - v7.0
BobSoft Mini Delphi -> BoB / BobSoft

Anti debug functions 7

FindWindowExW
FindWindowW
GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
RaiseException
UnhandledExceptionFilter

Strings analysis - File found

Database
Data.DB
Library
Cannot load ws2_32.dll
secur32.dll
IdnDL.dll
ssleay32.dll
security.dll
MSWSOCK.DLL
wship6.dll
libcrypto-3.dll
Fwpuclnt.dll
libmysqld.dll
WS2_32.dll
libcrypto-1_1.dll
USER32.dll
UxTheme.dll
ntdll.dll
OLEAUT32.dll
normaliz.dll
PSAPI.DLL
NETAPI32.dll
COMCTL32.dll
DWrite.dll
ole32.dll
IMM32.dll
ADVAPI32.dll
libssl-3.dll
Msctf.dll
xolehlp.dll
libmySQL.dll
KERNEL32.dll
IPHLPAPI.DLL
libssl-1_1.dll
libeay32.dll
Can not find xolehlp.dll
d2d1.dll
libssl32.dll
MSVCRT.dll
api-ms-win-core-winrt-l1-1-0.dll
dwmapi.dll
rpcrt4.dll
VERSION.dll
MSIMG32.dll
imagehlp.dll
WTSAPI32.dll
WSOCK32.dll
WindowsCodecs.dll
Shcore.dll
GDI32.dll
SHELL32.dll
Web Page
http://www.innovare.no/index.php?valgtside=oppdater.php

Strings analysis - Possible IPs found 3

0.0.0.1
255.255.255.255
127.0.0.1

Strings analysis - Possible URLs found 5

http://www.indyproject.org/
http://download.innovare.no/ftp/64/
file:///
http://www.innovare.no/index.php?valgtside=oppdater.php
http://download.innovare.no/ftp/

Import functions

PE Exports 2 suspicious

Function Address
__dbk_fcall_wrapper 0x412788
dbkFCallWrapperAddr 0x88d648