server[.]exe | Triage™

General

Target
server.exe
Size 300KB
Sample230315-rlg8psff5z
SHA256 38befee4c4513de47e667544d9f705f56c195393b116fcd154755c1f7815ae55
MD5 d966642aac4f23e0ec3cb978b949fd9d
SHA1 c841e25cf191d5a327d6917731333d61f7b4ad0d
SHA512 03f49e1eeb72b3786fe207cc688439f66877cd6afb2ecc1b60e32aaa25fe6992c663ebb970a7e53cf9bb13ccff1b2471ff1be2280ff292e237b30ee487f23be1
SSDEEP 3072:+QbWTLHiq9HunZr2ADhW8c/S9OC1hE/uJuP8QrW7SNlfo:pbiL31uAKR9p02p9ae
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

server.exe

.exe 300KB

server.exe

IMPHASH 02bcb533fc6eab16fabdf3b7ff49a9d9
SHA256 38befee4c4513de47e667544d9f705f56c195393b116fcd154755c1f7815ae55
MD5 d966642aac4f23e0ec3cb978b949fd9d
SHA1 c841e25cf191d5a327d6917731333d61f7b4ad0d
SHA512 03f49e1eeb72b3786fe207cc688439f66877cd6afb2ecc1b60e32aaa25fe6992c663ebb970a7e53cf9bb13ccff1b2471ff1be2280ff292e237b30ee487f23be1
SSDEEP 3072:+QbWTLHiq9HunZr2ADhW8c/S9OC1hE/uJuP8QrW7SNlfo:pbiL31uAKR9p02p9ae
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19992

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateHardLinkA CallNamedPipeW GetCommConfig GetConsoleAliasesA GetWindowsDirectoryA FindResourceExA GlobalAlloc WideCharToMultiByte LoadLibraryW GetStringTypeExW GetExitCodeProcess lstrcpynW GetFileAttributesW LocalReAlloc WriteConsoleW GetBinaryTypeA SetLastError GetProcAddress VirtualAlloc FindCloseChangeNotification EnumSystemCodePagesW GetFileType CreateEventW EnumDateFormatsA FreeEnvironmentStringsW GetPrivateProfileSectionA GetStringTypeW FindAtomW DeleteTimerQueueTimer GlobalAddAtomW OpenFileMappingA LCMapStringW HeapSize OpenJobObjectA GetStartupInfoW HeapAlloc GetLastError HeapFree SetUnhandledExceptionFilter GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection HeapReAlloc RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetModuleHandleA LCMapStringA MultiByteToWideChar GetStringTypeA GetLocaleInfoA

user32

CreateMDIWindowA LoadMenuW GetMenuInfo ValidateRect NotifyWinEvent

gdi32

GetGlyphIndicesA

advapi32

MapGenericMask

Sharing