Static task
static1
Behavioral task
behavioral1
Sample
MS16-032_x64.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
MS16-032_x64.exe
Resource
win10v2004-20230703-en
General
-
Target
MS16-032_x64.exe
-
Size
86KB
-
MD5
ae3e7304122469f2de3ecbd920a768d1
-
SHA1
d92186b699f81ac7875a57e464eec7f300638dee
-
SHA256
33a584a0d4907b063af867fd33cc39362b74e96e72d2ad97db7748131364eab1
-
SHA512
46c8f5ad88c7d4f1796080e8a2caafe2a8113c94aa3ff2ffe8c1edeebd1f8e1f3e8a8d85ba7f221ba33eb4a59784da99e1105a4717c5726d4e0124ca079efda0
-
SSDEEP
1536:yIGMPf+1Qs3oGTtJv/mKup2xInR1JuWzovQU7Ezd8n3AsW4d9u6zR:bff+1QIoGTvv/mKuUxIR1JiNpP9u6t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MS16-032_x64.exe
Files
-
MS16-032_x64.exe.exe windows x64
3caf9b5e0d279ede620adcad0b496971
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DuplicateHandle
CreatePipe
CreateThread
IsWow64Process
GetProcAddress
GetLastError
GetModuleFileNameW
ReadFile
TerminateProcess
TerminateThread
GetCurrentThread
GetModuleHandleW
WaitForSingleObject
CloseHandle
GetCurrentProcess
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
GetStdHandle
WriteFile
GetProcessHeap
DeleteCriticalSection
HeapFree
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
HeapReAlloc
SetStdHandle
SetFilePointerEx
WriteConsoleW
HeapSize
LCMapStringW
GetStringTypeW
CreateFileW
advapi32
DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessWithTokenW
PrivilegeCheck
CreateProcessAsUserW
GetTokenInformation
SetThreadToken
OpenThreadToken
CreateProcessWithLogonW
OpenProcessToken
AdjustTokenPrivileges
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ