MS16-016_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MS16-016_x64.exe
Size

97KB
MD5

561255ad508d9b663fae27d6f8496b61
SHA1

5050578853359da2dd81032b24c17bb1c0d7c043
SHA256

92fdca4b33faa3fc2efc393159039a76686e470a299794f1a8bdc9ac7e37f214
SHA512

2ecabb360c006038ae879106ce9c4aa19cec0eac4567f010c01d0445f09b0db84fd0fe2f63265ca30e43e0668e12c2c4ecc4b18dd94e54eba69e9a75060a4660
SSDEEP

1536:uZY3JNea58aJOTb2QSDNYQF5B8MsYnfJfQb7lNaH8Aqk6qsW4dP+aDj2oZ:vKa5HOTbZS5YQFz8MsSJOKqk6FPtj2y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MS16-016_x64.exe

Files

MS16-016_x64.exe
.exe windows x64

81193c8acaf23efa514d84cf7982e068

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExitProcess
GetCommandLineW
lstrlenA
CreateProcessW
GetCurrentProcess
GetModuleHandleW
VirtualFree
GlobalAlloc
GetVersionExW
ReadFile
CreateFileW
GetStartupInfoW
GetProcAddress
VirtualAlloc
LoadLibraryA
CreatePipe
CloseHandle
GetCurrentProcessId
CreateThread
LCMapStringW
HeapSize
GetStringTypeW
OutputDebugStringW
WriteConsoleW
SetStdHandle
LoadLibraryExW
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
DeleteCriticalSection
GetLastError
HeapFree
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
RtlUnwindEx
GetStdHandle
GetFileType
SetLastError
GetCurrentThreadId
GetProcessHeap
GetModuleFileNameA
GetModuleFileNameW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc

shell32

CommandLineToArgvW

ws2_32

inet_addr
htons
recv
WSAStartup
closesocket
send
listen
accept
socket
inet_ntoa
bind

mpr

WNetAddConnection2W

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81193c8acaf23efa514d84cf7982e068

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

ws2_32

mpr

Sections

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB