16c131505d9fecef2c5301544eecd61ffcd004a1ade8f5029479d9df287e0dda | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16c131505d9fecef2c5301544eecd61ffcd004a1ade8f5029479d9df287e0dda
Size

62KB
MD5

0156aeb3261073ba00028d38f2e90c3b
SHA1

83e7b2a13eec504c3ced64fb1082452772183f07
SHA256

16c131505d9fecef2c5301544eecd61ffcd004a1ade8f5029479d9df287e0dda
SHA512

b934c48d0cd691719e2b199d1e5f22a4e616d7db09827fa2fc1c5b594f21c33a149158d186e2c41ca9beec3e95eef36eb85aeeb9125d3b71e555f05b98ae3913
SSDEEP

768:diRs6zC8LNF88CqJG/l8UfmjIiJgdDkMNBdbYfECy/oHH48BO6CwGhz5w+DaNZC5:diRs6vLidDkeYK/H8BbWhnaL+7vFDIm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16c131505d9fecef2c5301544eecd61ffcd004a1ade8f5029479d9df287e0dda

Files

16c131505d9fecef2c5301544eecd61ffcd004a1ade8f5029479d9df287e0dda
.exe windows:4 windows x86 arch:x86

b954c9c3ceb80933b55958e2c226c6c6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFirmwareEnvironmentVariableA
GetProcessHeaps
ConvertThreadToFiber
FlushFileBuffers
BasepReleaseAppXContext
SetFileAttributesA
FreeUserPhysicalPages
HeapWalk
TerminateProcess
GetProfileStringW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE