16ed49d78af8b6be261090dbf35f0b85 | Triage

Sharing

General

Target

16ed49d78af8b6be261090dbf35f0b85
Size

28KB
MD5

16ed49d78af8b6be261090dbf35f0b85
SHA1

6f247b39a6450db9551ba50d34bac5450f2982ab
SHA256

19dbb8b5db8a7841f497fbbcea243e49e2a5decf730aec64202b4680c9bfb937
SHA512

34ff4e33822b094ac27560d5783c31acac551cf735ae154effaa5994b04471be8e7b5167582c74854f7c2190cc48bfb2b318fd1a7f6dad84bfe764881f997fea
SSDEEP

48:qZNSiXhjYZ8Oy3vNPxOXt5a6SidaaiCHczsBRj/bVfHNQ33SD1B7cdQOD9nF9dXo:uSAjYMVeFSisk8yzV1GOBgQqFLOYTY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16ed49d78af8b6be261090dbf35f0b85

Files

16ed49d78af8b6be261090dbf35f0b85
.exe windows:4 windows x86 arch:x86

2429fb4d324c02a82a62b81a54bd7043

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
OpenProcess
GetModuleHandleA
SetLastError
Sleep
VirtualFree
VirtualAlloc
CloseHandle
GetPriorityClass
ExitThread
GetCurrentProcessId
ResumeThread
CreateRemoteThread

user32

GetCursorPos
GetForegroundWindow
SetWindowTextA
GetWindowThreadProcessId
FindWindowA

advapi32

RegCreateKeyExA

msvcrt

_chkesp

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 298B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ