| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Apr-06 18:07:48 |
| Detected languages |
English - United States
|
| Debug artifacts |
MpAdlElvtStub.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | AntiMalware Platform Update (amd64fre) |
| InternalName | UpdatePlatform.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | UpdatePlatform.exe |
| ProductName | Microsoft Malware Protection |
| FileVersion | 4.18.26030.3011 |
| ProductVersion | 4.18.26030.3011 |
| StubVersion | 1.1.26030.3011 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to security software:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. |
Resource UPDATEPAYLOAD detected as a CAB Installer file.
Resources amount for 97.3226% of the executable. |
| Info | The PE is digitally signed. |
Signer: Microsoft Windows Publisher
Issuer: Microsoft Windows Production PCA 2011 |
| Safe | VirusTotal score: 0/70 (Scanned on 2026-05-04 14:50:29) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-Apr-06 18:07:48 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x38000 |
| SizeOfInitializedData | 0x121c000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000011C40 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | 6.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1256000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x1287839 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x80000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| RPCRT4.dll |
UuidCreate
|
|---|---|
| ntdll.dll |
RtlVirtualUnwind
RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlGetVersion RtlNtStatusToDosError NtSetInformationFile |
| KERNEL32.dll |
GetFileSizeEx
RemoveDirectoryW SetFilePointerEx WriteFile SetLastError WaitForSingleObject OpenProcess LoadLibraryExW GetEnvironmentVariableW GetCurrentDirectoryW GetTempPathW HeapSetInformation GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetModuleHandleW HeapAlloc HeapFree GetProcessHeap GetFileAttributesW EncodePointer DecodePointer LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte GetSystemTimeAsFileTime QueryFullProcessImageNameW VirtualLock HeapReAlloc HeapSize FlsFree FindNextFileW FindFirstFileExW FindClose DeleteFileW CreateFileW CreateDirectoryW ExpandEnvironmentStringsW SetEnvironmentVariableW GetProcAddress GetThreadTimes FlushFileBuffers VirtualQuery DosDateTimeToFileTime GetSystemTime FreeLibrary SystemTimeToFileTime FindResourceW LoadResource LockResource SetFilePointer VirtualUnlock SetFileTime SizeofResource GetProcessTimes Process32FirstW Process32NextW GetLastError CreateToolhelp32Snapshot GetCurrentProcessId GetCommandLineW Sleep SetFileAttributesW ReadFile TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThreadId GetCurrentThread GetCurrentProcess CloseHandle GetModuleHandleExW GetModuleFileNameW RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetErrorMode SetUnhandledExceptionFilter GetStringTypeW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW SetEndOfFile WriteConsoleW EnterCriticalSection FlsSetValue LCMapStringW CompareStringW VirtualProtect TerminateProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException SetConsoleCtrlHandler IsValidCodePage GetACP GetOEMCP GetCPInfo GetStdHandle ExitProcess GetCommandLineA GetFileType FlsAlloc FlsGetValue InitializeCriticalSectionEx |
| ADVAPI32.dll |
SetSecurityDescriptorControl
RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW LookupPrivilegeValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid FreeSid CopySid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges AddAccessAllowedAceEx OpenThreadToken OpenProcessToken RegCloseKey TraceMessage GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids EventWriteTransfer EventSetInformation EventUnregister EventRegister |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 4.18.26030.3011 |
| ProductVersion | 4.18.26030.3011 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | AntiMalware Platform Update (amd64fre) |
| InternalName | UpdatePlatform.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | UpdatePlatform.exe |
| ProductName | Microsoft Malware Protection |
| FileVersion (#2) | 4.18.26030.3011 |
| ProductVersion (#2) | 4.18.26030.3011 |
| StubVersion | 1.1.26030.3011 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1971-Jun-05 02:18:39 |
| Version | 0.0 |
| SizeofData | 42 |
| AddressOfRawData | 0x46b94 |
| PointerToRawData | 0x46b94 |
| Referenced File | MpAdlElvtStub.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1971-Jun-05 02:18:39 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x46bc0 |
| PointerToRawData | 0x46bc0 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1971-Jun-05 02:18:39 |
| Version | 0.0 |
| SizeofData | 1264 |
| AddressOfRawData | 0x46bd4 |
| PointerToRawData | 0x46bd4 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1971-Jun-05 02:18:39 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x470ec |
| PointerToRawData | 0x470ec |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1971-Jun-05 02:18:39 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0x47110 |
| PointerToRawData | 0x47110 |
| StartAddressOfRawData | 0x140047138 |
|---|---|
| EndAddressOfRawData | 0x140047140 |
| AddressOfIndex | 0x14004dba0 |
| AddressOfCallbacks | 0x1400395c8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14004c1c0 |
| GuardCFCheckFunctionPointer | 5368943880 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0x80a50d87 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 161 |
| C objects (33145) | 13 |
| ASM objects (33145) | 8 |
| ASM objects (35207) | 9 |
| C objects (35207) | 17 |
| C++ objects (35207) | 52 |
| ASM objects (35222) | 1 |
| C objects (35222) | 10 |
| Imports (33145) | 9 |
| Total imports | 299 |
| C++ objects (35222) | 54 |
| C++ objects (LTCG) (35222) | 10 |
| Resource objects (35222) | 1 |
| 151 | 1 |
| Linker (35222) | 1 |
No comments yet.