16ffd394246f0cb71f91a09fb51e3027

Sharing

Copy URL Twitter E-mail

General

Target

16ffd394246f0cb71f91a09fb51e3027
Size

105KB
MD5

16ffd394246f0cb71f91a09fb51e3027
SHA1

3586cd5f836f387035e474b5f311f9946ebe8c5f
SHA256

3cc1791851ae05c3879b39449ebfc2d49573bbd769556aef43c9dcb5a2a419a7
SHA512

0952050b539d55997a3695c96a14be24d7361cb8d922f72cde961b7bf4685ecf0bc7833032b04e08bd53a4794d9b022407a29109d56e5707e94bfef49cf66f0a
SSDEEP

3072:/q+m3SaUeIAzat8H3PZOK1JSQZ++1mhvteLhCGJT:BmYMzi4PZOsIC+ZIV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16ffd394246f0cb71f91a09fb51e3027

Files

16ffd394246f0cb71f91a09fb51e3027
.exe windows:4 windows x64 arch:x64

bb0bf5951f7f44120a21ccbe1db7089f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DisconnectNamedPipe
CreateFileA
WaitNamedPipeA
GetVersionExA
GetCurrentProcess
CopyFileExW
MoveFileWithProgressW
GetFileAttributesW
FindClose
FindNextFileW
CreateDirectoryW
SetFilePointer
SetVolumeLabelW
DeleteFileW
SetFileAttributesW
ConnectNamedPipe
GetCurrentThreadId
CreateThread
RemoveDirectoryW
GetModuleHandleA
CreateFileW
DeviceIoControl
CloseHandle
CreateNamedPipeA
LocalFree
GetTickCount
WriteFile
PeekNamedPipe
ReadFile
Sleep
LoadLibraryA
GetProcAddress
GetLastError
FindFirstFileW
LocalAlloc
HeapReAlloc
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExitProcess
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

MessageBoxA

advapi32

SetFileSecurityW
GetSecurityDescriptorControl
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
IsValidSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetUserNameA
LookupAccountNameA
GetFileSecurityW

shell32

SHFileOperationW

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zero
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb0bf5951f7f44120a21ccbe1db7089f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 7KB - Virtual size: 6KB

.zero Size: 8KB - Virtual size: 4KB

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 7KB - Virtual size: 6KB

.zero
Size: 8KB - Virtual size: 4KB