16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6

Sharing

Copy URL Twitter E-mail

General

Target
16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6
Size 57KB
Sample260824-jcl7asdn41
SHA256 16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6
MD5 36ead8be8c223106d23e08a56181ec49
SHA1 366d8a2add9e3960fffb9c48c0d434771948e341
SHA512 424cf264d53c37b11dd6b7fa8d8ff395cea10b0c8a3df99fae8036fae35d34cbda159b7427f2d4fce5e91b2d430c4a95d6aaf6adcc6840f57e9c9c09dfd86c4f
SSDEEP 768:xLe+vIDZ5kvaCuiJnbW+tNvS+EO4m0BsmY+RxckgUNjkXlxuvR1brE1OF6NVkBH+:E+wl5kplgc9GnDrUIN+lsvRGu6NVkBe
TLSH
T10343190AF35364ECC51AC6B486FB6773EA32BD2140359F3E5750E6741E10E60BE69B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6

File Explorer

16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6

.exe 57KB

16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6

IMPHASH 0d1999462392c1371f273e85814db74b
SHA256 16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6
MD5 36ead8be8c223106d23e08a56181ec49
SHA1 366d8a2add9e3960fffb9c48c0d434771948e341
SHA512 424cf264d53c37b11dd6b7fa8d8ff395cea10b0c8a3df99fae8036fae35d34cbda159b7427f2d4fce5e91b2d430c4a95d6aaf6adcc6840f57e9c9c09dfd86c4f
SSDEEP 768:xLe+vIDZ5kvaCuiJnbW+tNvS+EO4m0BsmY+RxckgUNjkXlxuvR1brE1OF6NVkBH+:E+wl5kplgc9GnDrUIN+lsvRGu6NVkBe
TLSH
T10343190AF35364ECC51AC6B486FB6773EA32BD2140359F3E5750E6741E10E60BE69B28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext FreeSid GetUserNameA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

CloseHandle CreateFileA CreateMutexA CreatePipe CreateProcessA DeleteCriticalSection EnterCriticalSection ExitProcess ExpandEnvironmentStringsA FreeLibrary GetComputerNameA GetCurrentDirectoryW GetCurrentProcessId GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetTickCount HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess PeekNamedPipe ReadFile SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _strdup _stricmp abort calloc exit fprintf fputc free fwrite localeconv malloc memcpy realloc signal strerror strlen strncmp strncpy vfprintf wcslen

ws2_32

WSAIoctl WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send setsockopt socket

Name

.text

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

16ece214b76673441fc30f4fc47df247d26e18b818db5b2a0e3b69b92dcda2a6

advapi32

bcrypt

kernel32

msvcrt

ws2_32

generic