Windows.Defender.Update.exe

First submission 2024-10-17 17:40:02

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 955.38 KB (978308 bytes)
Compile time: 2024-05-12 12:17:07
MD5: bde1d37ad1cf05320955681bf6455efa
SHA1: 52feb8bc6c21770eea00d19b1c228ee707228da7
SHA256: b4596116d3cb69f0dc38413f8469e1f81a99d89ded606bd8da3320c55c9ba12f
Import Hash : b1c5b1beabd90d9fdabd1df0779ea832
Sections 8 .text .rdata .data .pdata .didat _RDATA .rsrc .reloc
Directories 6 import export resource debug tls relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 32/77 VT report date: 2024-10-16 16:05:41
Malware Type 2 trojan worm
Threat Type 2 nekark gcosm

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://microsoftcomdefenderupdate.vercel.app/Windows.Defender.Update.exe VirusTotal Report microsoftcomdefenderupdate.vercel.app VirusTotal Report 2024-10-17 17:40:02

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x4676e 288768 278d421b8fcce5071cdb55190b5a29b42bdf8201 f06bb06e02377ae8b223122e53be35c2
.rdata 0x48000 0x128c4 76288 3114d29305d4b88fffea6ad50b3704072be27858 2de06d4a6920a6911e64ff20000ea72f
.data 0x5b000 0xe75c 6656 a1ae38ef93496365ab03cd8e1b3098ca6ac430e0 0dbdb901a7d477980097e42e511a94fb
.pdata 0x6a000 0x306c 12800 e0cde833721b87c288e4dbf07c14d46d8670d708 b0ce0f057741ad2a4ef4717079fa34e9
.didat 0x6e000 0x360 1024 190f8d2fea268d844623189351a02d25e6bedfff 1fcc7b1d7a02443319f8fcc2be4ca936
_RDATA 0x6f000 0x15c 512 8d13993151b09d8343303215408e337388130e61 3f331ec50f09ba861beaf955b33712d5
.rsrc 0x70000 0x1e598 124416 f1e7837596ce2db2f1088ee0a6375c0bf9d18d89 e07587b0f249be0fe027a0deedb0c8f9
.reloc 0x8f000 0x970 2560 b8c49df878d332ebd45f8be315a23f5d1c7402bf 77a9ddfc47a5650d6eebbcc823e39532

PE Resources 6

Name Language Sublanguage Offset Size Data
PNG LANG_ENGLISH SUBLANG_ENGLISH_US 0x7118c 5545
RT_ICON LANG_NEUTRAL SUBLANG_DEFAULT 0x8ac40 4745
RT_DIALOG LANG_ENGLISH SUBLANG_ENGLISH_US 0x8c7e4 594
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_US 0x8db98 592
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_DEFAULT 0x8dde8 90
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x8de44 1875

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)

Anti debug functions 6

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Temporary
winrarsfxmappingfile.tmp
Text
YA.NO.LO.PUEDES.RECUPERAR.txt
Library
Crypt32.dll
peerdist.dll
msasn1.dll
profapi.dll
api-ms-win-core-synch-l1-2-0.dll
RpcRtRemote.dll
sfc_os.dll
XmlLite.dll
USERENV.dll
ntmarta.dll
rasadhlp.dll
mscoree.dll
mlang.dll
cryptsp.dll
linkinfo.dll
UxTheme.dll
imageres.dll
VERSION.dll
cscapi.dll
usp10.dll
wkscli.dll
devrtl.dll
secur32.dll
wintrust.dll
atl.dll
WINNSI.DLL
rsaenh.dll
riched20.dll
cryptui.dll
ntshrui.dll
slc.dll
oleaccrc.dll
PSAPI.DLL
propsys.dll
KERNEL32.dll
NETAPI32.dll
aclui.dll
dhcpcsvc6.dll
cryptbase.dll
ws2help.dll
SHELL32.dll
samlib.dll
shdocvw.dll
dwmapi.dll
cabinet.dll
MPR.dll
WS2_32.dll
WindowsCodecs.dll
dnsapi.dll
SSPICLI.DLL
samcli.dll
apphelp.dll
dfscli.dll
dsrole.dll
ieframe.dll
lpk.dll
comres.dll
netutils.dll
clbcatq.dll
dhcpcsvc.dll
IPHLPAPI.DLL
srvcli.dll
DXGIDebug.dll
browcli.dll
SETUPAPI.dll
ADVAPI32.dll
SHLWAPI.dll
OLEAUT32.dll
COMCTL32.dll
Fole32.dll
USER32.dll
gdiplus.dll
GDI32.dll
COMDLG32.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2005/WindowsSettings

Import functions

Name Latest seen MD5
a.exe 2024-05-26 01:26:02 5c95d5493dda877b228a6485a6d40d9c
csrss.exe 2024-05-30 10:24:06 1eaae465bda927c1893a5744301cde9b
lrthijawd.exe 2024-06-14 16:06:02 1b1ecd323162c054864b63ada693cd71
kfiwarhg.exe 2024-06-14 16:30:14 7d44a8a6757c2b7287c4a7b761f4e326
4x.exe 2024-06-07 14:16:02 c8432b773d48e5e0a9f2d1ecb7c557f8
motruhjgmawes.exe 2024-06-14 16:49:08 57a6a83482ce2897e8cdec17accbd662
potkmdaw.exe 2024-07-12 12:39:02 cefc3739d099bae51eb2a9d3887ac12c
live3.exe 2024-07-20 05:58:04 9fe68af3f2db3c8428035cabfccafd04
live.exe 2024-07-20 07:37:04 deb7f0871db1a1ad70b0ec844efc51d1
gawdth.exe 2024-09-02 00:31:29 c02798b26bdaf8e27c1c48ef5de4b2c3
jsawdtyjde.exe 2024-08-25 14:04:02 4c3049f8e220c2264692cb192b741a30
66b2871b47a8b_uhigdbf.exe 2024-10-09 18:58:05 eeecdefa939b534bc8f774a15e05ab0f
66e30a27e0efe_tmpD.exe 2024-09-28 05:39:01 af91873c641aab500eba3a3ad6f17b74
66e1a49ce28da_wtyhjkosefktyh.exe 2024-09-28 04:07:03 68821531a37ba7822fd5d67019733b6b
Meeting-https.exe 2024-10-07 21:45:02 4b61a3d79a892267bf6e76a54e188cc0
setup2.exe 2024-10-13 13:56:08 2ffafb44b3efdc58f229ffbce7b12796
rbx.exe?ex=670cc4cc&is=670b734c&hm=3c647bebfcf01e0dd93e67e212054aa02bc3b2b54a7738168d98490d5192ee3c& 2024-10-13 17:14:02 abfe9c702641bda679c3947a9bbde15f
xbyxsv3.94.exe 2024-10-15 18:34:32 2fe7543228c4b5807227ae21f3fdce4d