server[.]exe | Triage™

General

Target
server.exe
Size 192KB
Sample230308-mas4lsfc82
SHA256 2b31a64f7d221dfd8ac33edaf101a4c1ac73f36dcd7abb976517fb1e90750544
MD5 b53e7a4f7d03dc6b34760a66dc7fefdf
SHA1 e4bb248848451813b7325c001910defaf262e58a
SHA512 2a8865882cb9ed6a6f3382c7201d93c8cf9eb67377b31c56f25481dd21db5ba2c2959368e63ca4e1e916e99c87a30b875f649bcdc12c63f4a45ca572ee271aed
SSDEEP 3072:6F3QsFXipai+ZJY0glWqUeMV7oog/Mhej01QDnLjmH52c:bWX8ai+Za067UnVU/0hS01QDL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

server.exe

.exe 192KB

server.exe

IMPHASH bd539b249d1dc5b6030dd4bb1a6c6cad
SHA256 2b31a64f7d221dfd8ac33edaf101a4c1ac73f36dcd7abb976517fb1e90750544
MD5 b53e7a4f7d03dc6b34760a66dc7fefdf
SHA1 e4bb248848451813b7325c001910defaf262e58a
SHA512 2a8865882cb9ed6a6f3382c7201d93c8cf9eb67377b31c56f25481dd21db5ba2c2959368e63ca4e1e916e99c87a30b875f649bcdc12c63f4a45ca572ee271aed
SSDEEP 3072:6F3QsFXipai+ZJY0glWqUeMV7oog/Mhej01QDnLjmH52c:bWX8ai+Za067UnVU/0hS01QDL
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

18129

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetWindowsDirectoryA FindFirstVolumeMountPointW ReleaseMutex ReadConsoleInputW VerifyVersionInfoW GetCPInfoExA CreateEventA GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalAlloc DeleteFileW EnumResourceTypesA SetThreadLocale WaitCommEvent LeaveCriticalSection GetComputerNameExA GetConsoleAliasA WriteProfileSectionW GetLastError AddAtomW ReadConsoleInputA SetCalendarInfoA SetVolumeMountPointW GetModuleHandleW QueryInformationJobObject GetComputerNameA EnumTimeFormatsA AddAtomA FatalAppExitA SetSystemTime _llseek FoldStringA GetShortPathNameA EnumCalendarInfoA FindNextFileW CreateActCtxA GetConsoleCursorInfo CreateFileW HeapSize ReadFile WriteConsoleW IsProcessorFeaturePresent AssignProcessToJobObject LoadLibraryW MultiByteToWideChar HeapReAlloc DeleteFileA MoveFileA GetCommandLineW HeapSetInformation GetStartupInfoW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess SetFilePointer EnterCriticalSection HeapCreate HeapFree HeapAlloc SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte LCMapStringW GetStringTypeW Sleep SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind CloseHandle

user32

LoadMenuW GetMenuInfo GetListBoxInfo GetMenuItemID

gdi32

GetCharWidth32A

Sharing