16177b9f938a40e5189b24e78fc16e6e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16177b9f938a40e5189b24e78fc16e6e
Size

901KB
MD5

16177b9f938a40e5189b24e78fc16e6e
SHA1

cb4a6471c019b39d6bebd1f92727faf12bc9e3f0
SHA256

f7de92be923eb959f9d30fc1bee4a9202f82f7d2a6939a958e5b711565fc4c7e
SHA512

e14c129743b3817d9278e164dff91249e449359b60c1cf84f08f9bc4eab1cb5b95b2f946cb0d4a791f8ee45a0b06cfc020f154c6dfbd06cdae9dab5c489aac55
SSDEEP

12288:WHjcoe9PH96vB/fAuBcm9TyOE/xG3muGx44MG4Yx:WDgINfAuBcgcZG2uG24MG4Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16177b9f938a40e5189b24e78fc16e6e

Files

16177b9f938a40e5189b24e78fc16e6e
.exe windows:5 windows x86 arch:x86

b36eb9a4c6fca2002f3fab21d6da4be8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.MPRESS1
Size: 438KB - Virtual size: 828KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zz
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_MEM_READ