wusa (1).exe - wusa.exe - Windows Update Standalone Installer

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	wusa (1).exe
size	310272 (0x4bc00)
md5	7e8ae39be13b6f0a7cad480b7148123f

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Agent-7029271-0 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
147	30729	2
259	26715	2
260	26715	22
261	26715	8
257	26715	27
1	0	277
265	26715	21
255	26715	1
258	26715	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x7a1dc3b9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.15
SizeOfCode	0x16400
SizeOfInitializedData	0x35a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x16a40
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x51000
SizeOfHeaders	0x400
CheckSum	0x4e83f
Subsystem	2
DllCharacteristics	0xc160
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x162d4	0x16400	R-X CODE
.rdata	0x18000	0x1f03e	0x1f200	R-- IDATA
.data	0x38000	0x888	0x400	RW- IDATA
.pdata	0x39000	0x4e0	0x600	R-- IDATA
.rsrc	0x3a000	0x15488	0x15600	R-- IDATA
.reloc	0x50000	0x60	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x35b94	0x118
RESOURCE	0x3a000	0x15488
EXCEPTION	0x39000	0x4e0
SECURITY	0	0
BASERELOC	0x50000	0x60
DEBUG	0x35170	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x18158	0x28
LOAD_CONFIG	0x18050	0x108
Bound_IAT	0	0
IAT	0x18180	0x640
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x1400354d4	0x1400354dc	0x140038810	0x140018820	0	0x300000

show previews

type	name	size
MUI	#1	248
WEVT_TEMPLATE	#1	2634
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	55762
ICON	#8	9640
ICON	#9	4264
ICON	#10	1128
GROUP_ICON	#101	146
VERSION	#1	940
MANIFEST	#1	1425

module_name	hint	ord	function_name
ADVAPI32.dll	612		RegCreateKeyExW
ADVAPI32.dll	681		RegSetValueExW
ADVAPI32.dll	603		RegCloseKey
ADVAPI32.dll	405		InitiateSystemShutdownExW
ADVAPI32.dll	139		CreateProcessAsUserW
ADVAPI32.dll	652		RegOpenKeyExW
ADVAPI32.dll	123		ConvertSidToStringSidW
ADVAPI32.dll	627		RegDeleteValueW
ADVAPI32.dll	635		RegEnumKeyW
ADVAPI32.dll	665		RegQueryValueExW
ADVAPI32.dll	623		RegDeleteKeyW
ADVAPI32.dll	32		AllocateAndInitializeSid
ADVAPI32.dll	95		CheckTokenMembership
ADVAPI32.dll	308		FreeSid
ADVAPI32.dll	431		LookupPrivilegeValueW
ADVAPI32.dll	533		OpenProcessToken
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	368		GetTokenInformation
ADVAPI32.dll	133		CopySid
ADVAPI32.dll	622		RegDeleteKeyValueW
ADVAPI32.dll	765		StartTraceW
ADVAPI32.dll	263		EnableTrace
ADVAPI32.dll	110		ControlTraceW
ADVAPI32.dll	103		CloseTrace
ADVAPI32.dll	414		IsValidSid
ADVAPI32.dll	331		GetLengthSid
ADVAPI32.dll	399		InitializeSecurityDescriptor
ADVAPI32.dll	398		InitializeAcl
ADVAPI32.dll	16		AddAccessAllowedAce
ADVAPI32.dll	744		SetSecurityDescriptorDacl
ADVAPI32.dll	194		CryptAcquireContextW
ADVAPI32.dll	210		CryptGenRandom
ADVAPI32.dll	233		DecryptFileA
ADVAPI32.dll	220		CryptReleaseContext
ADVAPI32.dll	289		EventRegister
ADVAPI32.dll	291		EventUnregister
ADVAPI32.dll	287		EventEnabled
ADVAPI32.dll	292		EventWrite
KERNEL32.dll	742		GetSystemDirectoryA
KERNEL32.dll	1603		lstrcmpW
KERNEL32.dll	278		DeleteFileW
KERNEL32.dll	1003		MoveFileExW
KERNEL32.dll	1213		RemoveDirectoryW
KERNEL32.dll	1052		OutputDebugStringW
KERNEL32.dll	588		GetFileAttributesW
KERNEL32.dll	583		GetFileAttributesA
KERNEL32.dll	181		CreateDirectoryA
KERNEL32.dll	960		LeaveCriticalSection
KERNEL32.dll	309		EnterCriticalSection
KERNEL32.dll	1316		SetEvent
KERNEL32.dll	273		DeleteCriticalSection
KERNEL32.dll	872		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	191		CreateEventW
KERNEL32.dll	541		GetCurrentProcess
KERNEL32.dll	1010		MultiByteToWideChar
KERNEL32.dll	477		GetCommandLineW
KERNEL32.dll	615		GetLastError
KERNEL32.dll	978		LocalFree
KERNEL32.dll	242		CreateThread
KERNEL32.dll	390		FindFirstFileW
KERNEL32.dll	1606		lstrcmpiW
KERNEL32.dll	402		FindNextFileW
KERNEL32.dll	379		FindClose
KERNEL32.dll	580		GetExitCodeThread
KERNEL32.dll	134		CloseHandle
KERNEL32.dll	756		GetSystemWindowsDirectoryW
KERNEL32.dll	967		LoadLibraryW
KERNEL32.dll	429		FormatMessageW
KERNEL32.dll	693		GetProcAddress
KERNEL32.dll	433		FreeLibrary
KERNEL32.dll	743		GetSystemDirectoryW
KERNEL32.dll	1510		WaitForSingleObject
KERNEL32.dll	579		GetExitCodeProcess
KERNEL32.dll	1074		ProcessIdToSessionId
KERNEL32.dll	542		GetCurrentProcessId
KERNEL32.dll	1419		Sleep
KERNEL32.dll	727		GetStartupInfoW
KERNEL32.dll	608		GetFullPathNameW
KERNEL32.dll	203		CreateFileW
KERNEL32.dll	638		GetModuleHandleW
KERNEL32.dll	1403		SetUnhandledExceptionFilter
KERNEL32.dll	1104		QueryPerformanceCounter
KERNEL32.dll	546		GetCurrentThreadId
KERNEL32.dll	752		GetSystemTimeAsFileTime
KERNEL32.dll	782		GetTickCount
KERNEL32.dll	1468		UnhandledExceptionFilter
KERNEL32.dll	1434		TerminateProcess
KERNEL32.dll	1051		OutputDebugStringA
KERNEL32.dll	263		DebugBreak
GDI32.dll	380		DeleteDC
GDI32.dll	697		GetStockObject
GDI32.dll	630		GetDeviceCaps
GDI32.dll	860		SelectObject
GDI32.dll	49		CreateCompatibleDC
GDI32.dll	383		DeleteObject
GDI32.dll	67		CreateFontIndirectW
GDI32.dll	714		GetTextExtentPoint32W
USER32.dll	244		EndPaint
USER32.dll	657		MsgWaitForMultipleObjects
USER32.dll	681		PeekMessageW
USER32.dll	186		DialogBoxParamW
USER32.dll	242		EndDialog
USER32.dll	962		UpdateWindow
USER32.dll	598		LoadCursorW
USER32.dll	600		LoadIconW
USER32.dll	885		SetWindowLongW
USER32.dll	239		EnableWindow
USER32.dll	817		SetDlgItemTextW
USER32.dll	332		GetDlgItem
USER32.dll	820		SetFocus
USER32.dll	173		DestroyAcceleratorTable
USER32.dll	272		FillRect
USER32.dll	17		BeginPaint
USER32.dll	761		ReleaseDC
USER32.dll	322		GetDC
USER32.dll	780		SendDlgItemMessageW
USER32.dll	789		SendMessageW
USER32.dll	854		SetRect
USER32.dll	307		GetClientRect
USER32.dll	904		ShowWindow
USER32.dll	920		SystemParametersInfoW
USER32.dll	685		PostMessageW
USER32.dll	934		TranslateAcceleratorW
USER32.dll	94		CreateAcceleratorTableW
USER32.dll	181		DestroyWindow
USER32.dll	907		ShutdownBlockReasonDestroy
USER32.dll	906		ShutdownBlockReasonCreate
USER32.dll	118		CreateWindowExW
USER32.dll	731		RegisterClassExW
USER32.dll	167		DefWindowProcW
USER32.dll	189		DispatchMessageW
USER32.dll	936		TranslateMessage
msvcrt.dll	1172		memmove
msvcrt.dll	1174		memset
msvcrt.dll	47		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	656		_onexit
msvcrt.dll	123		__dllonexit
msvcrt.dll	833		_unlock
msvcrt.dll	1170		memcpy
msvcrt.dll	210		_commode
msvcrt.dll	295		_fmode
msvcrt.dll	898		_wcmdln
msvcrt.dll	381		_initterm
msvcrt.dll	144		__setusermatherr
msvcrt.dll	193		_cexit
msvcrt.dll	270		_exit
msvcrt.dll	1074		exit
msvcrt.dll	142		__set_app_type
msvcrt.dll	157		__wgetmainargs
msvcrt.dll	174		_amsg_exit
msvcrt.dll	85		_XcptFilter
msvcrt.dll	1100		free
msvcrt.dll	1158		malloc
msvcrt.dll	87		__C_specific_handler
msvcrt.dll	867		_vsnprintf
msvcrt.dll	1281		wcschr
msvcrt.dll	1139		iswdigit
msvcrt.dll	916		_wcsnicmp
msvcrt.dll	906		_wcsicmp
msvcrt.dll	486		_lock
msvcrt.dll	873		_vsnwprintf
msvcrt.dll	1296		wcsrchr
msvcrt.dll	191		_callnewh
msvcrt.dll	1218		strcmp
OLEAUT32.dll		6
OLEAUT32.dll		2
OLEAUT32.dll		8
SHELL32.dll	7		CommandLineToArgvW
SHELL32.dll		730
SHELL32.dll	438		ShellExecuteExW
SHLWAPI.dll	343		StrToIntExW
ntdll.dll	1532		RtlVirtualUnwind
ntdll.dll	1235		RtlLookupFunctionEntry
ntdll.dll	747		RtlCaptureContext
ntdll.dll	1711		WinSqmEndSession
ntdll.dll	1720		WinSqmSetDWORD
ntdll.dll	1725		WinSqmSetString
ntdll.dll	1726		WinSqmStartSession
dpx.dll	5		DpxNewJob
WTSAPI32.dll	41		WTSQueryUserToken
COMCTL32.dll	124		InitCommonControlsEx
COMCTL32.dll		344
api-ms-win-core-com-l1-1-0.dll	65		CoTaskMemFree
api-ms-win-core-com-l1-1-0.dll	41		CoInitializeSecurity
api-ms-win-core-com-l1-1-0.dll	68		CoUninitialize
api-ms-win-core-com-l1-1-0.dll	40		CoInitializeEx
api-ms-win-core-com-l1-1-0.dll	9		CoCreateInstance

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Update Standalone Installer
FileVersion	10.0.18362.1 (WinBuild.160101.0800)
InternalName	wusa.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	wusa.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.18362.1

VS_FIXEDFILEINFO

FileVersion	10.0.18362.1
ProductVersion	10.0.18362.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
3a268	55762	PNG	(256 x 256)	#
47c3a	16326	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x38810

wusa (1).exe- -

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 040904B0

VS_FIXEDFILEINFO

wusa (1).exe
-
-