Static task
static1
Behavioral task
behavioral1
Sample
4WorldManagerServer2.exe
Resource
win7-20220812-es
Behavioral task
behavioral2
Sample
4WorldManagerServer2.exe
Resource
win10v2004-20221111-es
General
-
Target
4WorldManagerServer2.exe
-
Size
655KB
-
MD5
5de8490148d609887456f0fe3b592b59
-
SHA1
05d900a7dd29f374b61fdadf2bb8a4e316ae4e30
-
SHA256
903d73807b77a30f16143d036a9ff0e7073c9fc93d1d83c51243ac071f483dcd
-
SHA512
a4b4405aa490bcc8294196fd307b668b544a31e76a0355957c29ceb8c5b77b71f0993aa3decd21ae7326b92306872242367a8e0643ee3081735106672f4bd4bd
-
SSDEEP
12288:Wyze6zfJ1AfWBykBjfVdusPZdcktKtIQ7Tft10v/jB:jeQAeBykBTVd8kwF7Tw/d
Malware Config
Signatures
Files
-
4WorldManagerServer2.exe.exe windows x86
af89e4036784ca9db70af9460405c621
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getpeername
getsockopt
htons
getsockname
ioctlsocket
listen
select
__WSAFDIsSet
shutdown
closesocket
bind
ntohs
inet_addr
WSACleanup
WSAGetLastError
WSAStartup
inet_ntoa
accept
socket
connect
setsockopt
winmm
timeGetTime
kernel32
CompareStringW
SetEndOfFile
GetCurrentDirectoryW
WriteConsoleW
HeapReAlloc
GetStringTypeW
GetDriveTypeW
GetCurrentDirectoryA
GetSystemTime
GetTimeFormatA
GetDateFormatA
GetLocalTime
GetSystemInfo
Sleep
GetModuleFileNameA
CreateThread
GetTickCount
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetLastError
LoadLibraryA
FlushFileBuffers
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
SetHandleCount
HeapCreate
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetModuleFileNameW
GetStdHandle
LoadLibraryW
InitializeCriticalSectionAndSpinCount
HeapSize
IsProcessorFeaturePresent
GetTimeZoneInformation
TlsFree
TlsSetValue
TlsGetValue
ReadFile
WriteFile
SetFilePointer
SetLastError
SystemTimeToFileTime
CloseHandle
GetFileSize
CreateFileA
FormatMessageA
CreateDirectoryA
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
SetUnhandledExceptionFilter
SetCurrentDirectoryA
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetEvent
CreateEventA
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
ReadProcessMemory
GetCurrentThread
GetACP
IsBadReadPtr
CreateFileW
lstrcpynA
lstrlenA
GetModuleHandleA
HeapFree
HeapAlloc
GetProcessHeap
InterlockedExchange
SwitchToThread
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
SetEnvironmentVariableA
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetFullPathNameA
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
user32
wsprintfA
MessageBoxA
dbghelp
MakeSureDirectoryPathExists
SymInitialize
SymSetOptions
SymGetOptions
SymCleanup
SymGetLineFromAddr64
SymGetSymFromAddr64
StackWalk64
SymFunctionTableAccess64
SymGetModuleBase64
advapi32
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
QueryServiceStatus
SetServiceStatus
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
Sections
.text Size: 519KB - Virtual size: 519KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ