16b5453eef1a4a30491d111eb0e17c4f | Triage

Sharing

General

Target

16b5453eef1a4a30491d111eb0e17c4f
Size

221KB
MD5

16b5453eef1a4a30491d111eb0e17c4f
SHA1

c5ffa5cc77451f927d283d64c0998ac9e31a492a
SHA256

bef8244393755618cb7399a5826f0fbbef6d2cea3ebd96ccbbb7d5f08b255132
SHA512

0be7c2736d5f534605af56f1614c8d528c50fc810f301c1d9f20620bc1cf6a3a9dcbc529faddb6a0da5301c0d588d236d78a6d4be03cf8cd33589789c0425400
SSDEEP

3072:FLhgj1KiLc3OIkSCiuYyIyu99eQH6v5pBzD05y5zU7H/Gv+hkkzD:FVa1KiLu/knijyIZ9V6v5jo5y5afIkzD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16b5453eef1a4a30491d111eb0e17c4f

Files

16b5453eef1a4a30491d111eb0e17c4f
.exe windows:5 windows x86 arch:x86

5fb34ba92ec7f5f859e799eccd01683c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

TranslateMessage

gdi32

DeleteObject

advapi32

OpenProcessToken

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 186KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE