ms16-032[.]exe | Triage™

General

Target
ms16-032.exe
Size 75KB
Sample260910-ajm8hasdra
SHA256 f0b0e0548b218fb81940a4daf85c3709b2159bb357cab2f55576af3d75d47094
MD5 beac6592dbd3a479a64789e43ec20f27
SHA1 9f70e05b14ab058d03fbb6f418b922c5177943bc
SHA512 0743dca27dd4372ab27bdd93abdd7e0022495c1abd1029f8b9f1f83dcf8c14cf75702a6342a51db265f2aaee92586f240beaccf3284ded89a965adc1040dc17f
SSDEEP 1536:Q/DI6Xpu0w+yZjuow7D92zXPkHT4mkcfob7hsWjcdU/elP:qVZuggu/D9eXccwobaU/a
TLSH
T195736C03B3D180B1E4B302715868DEA20ABFFE260E71CD5B7786125E5A751D09E3AF67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ms16-032.exe

File Explorer

ms16-032.exe

.exe 75KB

ms16-032.exe

IMPHASH b0c742f785404243a3854fb05ee9e409
SHA256 f0b0e0548b218fb81940a4daf85c3709b2159bb357cab2f55576af3d75d47094
MD5 beac6592dbd3a479a64789e43ec20f27
SHA1 9f70e05b14ab058d03fbb6f418b922c5177943bc
SHA512 0743dca27dd4372ab27bdd93abdd7e0022495c1abd1029f8b9f1f83dcf8c14cf75702a6342a51db265f2aaee92586f240beaccf3284ded89a965adc1040dc17f
SSDEEP 1536:Q/DI6Xpu0w+yZjuow7D92zXPkHT4mkcfob7hsWjcdU/elP:qVZuggu/D9eXccwobaU/a
TLSH
T195736C03B3D180B1E4B302715868DEA20ABFFE260E71CD5B7786125E5A751D09E3AF67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DuplicateHandle CreatePipe CreateThread IsWow64Process GetProcAddress GetLastError GetModuleFileNameW ReadFile TerminateProcess TerminateThread GetCurrentThread GetModuleHandleW WaitForSingleObject CloseHandle GetCurrentProcess HeapAlloc EnterCriticalSection LeaveCriticalSection IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetCommandLineW GetStdHandle WriteFile GetProcessHeap DeleteCriticalSection HeapFree FlushFileBuffers GetConsoleCP GetConsoleMode UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW OutputDebugStringW HeapReAlloc SetStdHandle SetFilePointerEx WriteConsoleW RtlUnwind HeapSize LCMapStringW GetStringTypeW CreateFileW

advapi32

DuplicateTokenEx LookupPrivilegeValueW CreateProcessWithTokenW PrivilegeCheck CreateProcessAsUserW GetTokenInformation SetThreadToken OpenThreadToken CreateProcessWithLogonW OpenProcessToken AdjustTokenPrivileges

Sharing