16c6af84e16dbb1206fa0e87237b2269[.]exe

General

Target
16c6af84e16dbb1206fa0e87237b2269.exe
Size 10.3MB
Sample260312-e15w4abs8n
SHA256 6fd1bae6a00bc4f5b4cdae0ddcae52389d337424d6ad035c9cde3b6ea948ffdb
MD5 16c6af84e16dbb1206fa0e87237b2269
SHA1 bd8888e30bfab6e8e3d7018c51034abd7b3dbc40
SHA512 31ce5821b489f2869ef597bd88d5b7ce6755caa21ee01681aac4277d7fed0c578459d62dc98d268fe5fa6268255e2f47fba5437989e65c2e509a6b3c30dcb94d
SSDEEP 98304:tr99u4kc8Hao8eRjYBU4UAir2Y5uh4oSTy6kGc3NEj0ayISaBgwjZcI92tLTMc6W:f9upko8Rr6rYyc3Lay+gRHB6MgU6S+W
TLSH
T114B69D21B54AC13AE66E51B2592CEB6B61797FB20B7140DB73DC3DAE0B704C21236E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16c6af84e16dbb1206fa0e87237b2269.exe

File Explorer

16c6af84e16dbb1206fa0e87237b2269.exe

.exe 10.3MB

16c6af84e16dbb1206fa0e87237b2269.exe

IMPHASH 608505ff1e7e27ff4a42ea9c4e9f4192
SHA256 6fd1bae6a00bc4f5b4cdae0ddcae52389d337424d6ad035c9cde3b6ea948ffdb
MD5 16c6af84e16dbb1206fa0e87237b2269
SHA1 bd8888e30bfab6e8e3d7018c51034abd7b3dbc40
SHA512 31ce5821b489f2869ef597bd88d5b7ce6755caa21ee01681aac4277d7fed0c578459d62dc98d268fe5fa6268255e2f47fba5437989e65c2e509a6b3c30dcb94d
SSDEEP 98304:tr99u4kc8Hao8eRjYBU4UAir2Y5uh4oSTy6kGc3NEj0ayISaBgwjZcI92tLTMc6W:f9upko8Rr6rYyc3Lay+gRHB6MgU6S+W
TLSH
T114B69D21B54AC13AE66E51B2592CEB6B61797FB20B7140DB73DC3DAE0B704C21236E17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2028553

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent RemoveDirectoryW GetProcAddress GetModuleHandleW GetWindowsDirectoryW CreateDirectoryW GetTempPathW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CreateThread LoadLibraryExW GetCurrentProcess Sleep WideCharToMultiByte GetDiskFreeSpaceExW DecodePointer GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW LoadLibraryW GetDriveTypeW CompareStringW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW GetFinalPathNameByHandleW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersionExW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW LocalFree LocalAlloc SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetEnvironmentStringsW InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID GetLocalTime ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW CreateNamedPipeW ConnectNamedPipe TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW GetProcessAffinityMask GetModuleHandleA GlobalMemoryStatus ReleaseSemaphore CreateSemaphoreW

Sharing