| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Feb-17 20:06:17 |
| Detected languages |
English - United States
|
| Debug artifacts |
MpWUStub.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Antimalware WU Stub |
| InternalName | AM_Delta_Patch_1.445.111.0.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | AM_Delta_Patch_1.445.111.0.exe |
| ProductName | Microsoft Malware Protection |
| FileVersion | 1.445.113.0 |
| ProductVersion | 1.445.113.0 |
| StubName | WuStubFinal |
| StubVersion | 1.1.24010.2001 |
| Info | Matching compiler(s): | Microsoft Visual C++ 8.0 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. | Resource UPDATEPAYLOAD detected as a CAB Installer file. |
| Info | The PE is digitally signed. |
Signer: Microsoft Corporation
Issuer: Microsoft Windows Code Signing PCA 2024 |
| Safe | VirusTotal score: 0/72 (Scanned on 2026-02-17 23:03:13) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Feb-17 20:06:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2c000 |
| SizeOfInitializedData | 0x26000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000007770 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x55000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x58c10 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x80000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
UnregisterTraceGuids
RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage EventWriteTransfer RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey EventUnregister EventRegister OpenThreadToken OpenProcessToken GetLengthSid CheckTokenMembership FreeSid CopySid AllocateAndInitializeSid |
|---|---|
| KERNEL32.dll |
CloseHandle
IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError SetLastError GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThread GetCurrentThreadId HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime FreeLibrary GetProcAddress LoadLibraryExW CompareStringW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar ExitProcess GetModuleHandleW GetModuleHandleExW GetProcessHeap WideCharToMultiByte HeapSize HeapReAlloc GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead EncodePointer RaiseException InitializeCriticalSectionEx CallNamedPipeW InitializeProcThreadAttributeList CreateToolhelp32Snapshot UpdateProcThreadAttribute Process32NextW Process32FirstW DeleteProcThreadAttributeList WaitNamedPipeW VirtualQuery FlushFileBuffers GetProcessId GetProcessTimes GetCommandLineW GetThreadTimes GetModuleFileNameW GetEnvironmentVariableW GetSystemDirectoryW HeapSetInformation CreateProcessW GetExitCodeProcess FindNextFileW WriteFile SetEnvironmentVariableW FindClose WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess CreateEventW SetEvent WaitForSingleObjectEx ResetEvent SetFilePointerEx QueryFullProcessImageNameW VirtualLock GetStdHandle GetCommandLineA FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode WriteConsoleW DecodePointer |
| RPCRT4.dll |
UuidCreate
|
| ntdll.dll |
RtlNtStatusToDosError
RtlGetVersion RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwind |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.445.113.0 |
| ProductVersion | 1.445.113.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Antimalware WU Stub |
| InternalName | AM_Delta_Patch_1.445.111.0.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | AM_Delta_Patch_1.445.111.0.exe |
| ProductName | Microsoft Malware Protection |
| FileVersion (#2) | 1.445.113.0 |
| ProductVersion (#2) | 1.445.113.0 |
| StubName | WuStubFinal |
| StubVersion | 1.1.24010.2001 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2036-Jan-17 14:41:28 |
| Version | 0.0 |
| SizeofData | 37 |
| AddressOfRawData | 0x37974 |
| PointerToRawData | 0x37974 |
| Referenced File | MpWUStub.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2036-Jan-17 14:41:28 |
| Version | 0.0 |
| SizeofData | 1204 |
| AddressOfRawData | 0x3799c |
| PointerToRawData | 0x3799c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2036-Jan-17 14:41:28 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x37e78 |
| PointerToRawData | 0x37e78 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2036-Jan-17 14:41:28 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0x37e9c |
| PointerToRawData | 0x37e9c |
| StartAddressOfRawData | 0x140037ec0 |
|---|---|
| EndAddressOfRawData | 0x140037ec8 |
| AddressOfIndex | 0x14003d188 |
| AddressOfCallbacks | 0x14002f968 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14003bc18 |
| GuardCFCheckFunctionPointer | 5368903824 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xc022b7f8 |
|---|---|
| Unmarked objects | 0 |
| C objects (32595) | 26 |
| ASM objects (32595) | 17 |
| C++ objects (32595) | 207 |
| Imports (32595) | 9 |
| Total imports | 295 |
| C++ objects (LTCG) (32595) | 74 |
| Resource objects (32595) | 1 |
| Linker (32595) | 1 |