server[.]exe | Triage™

General

Target
server.exe
Size 359KB
Sample230322-rgpf8abb3s
SHA256 07f1cd7945372b991c0757e24fe9d44d98dbcb3dfb9bea6bd80449c00ea06504
MD5 e29f2dc79fa2f8043bb0cfef152b332c
SHA1 aea54be8143e26083e55a311be2583c45b9f3214
SHA512 697937461b2f6171e1639c5088c57a0b7e16aee8ff13e5c8661aa5459c4de4cec89733ee95a49b97187847bf58312ecae7bc60a09c9644811473567e7c52685a
SSDEEP 3072:lxaUlSs5UHSj4YNSOAzG/0llNgQZiqrnpvbDCpAN08UqI1ngo8jBJJ:mvcNSxHgajFbDQAN9UpnV8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

server.exe

.exe 359KB

server.exe

IMPHASH 314565592a4a5f015f9741680eeed0ec
SHA256 07f1cd7945372b991c0757e24fe9d44d98dbcb3dfb9bea6bd80449c00ea06504
MD5 e29f2dc79fa2f8043bb0cfef152b332c
SHA1 aea54be8143e26083e55a311be2583c45b9f3214
SHA512 697937461b2f6171e1639c5088c57a0b7e16aee8ff13e5c8661aa5459c4de4cec89733ee95a49b97187847bf58312ecae7bc60a09c9644811473567e7c52685a
SSDEEP 3072:lxaUlSs5UHSj4YNSOAzG/0llNgQZiqrnpvbDCpAN08UqI1ngo8jBJJ:mvcNSxHgajFbDQAN9UpnV8
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

16701

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumCalendarInfoA GlobalCompact _llseek VerSetConditionMask GetCurrentProcess WritePrivateProfileSectionA SetDefaultCommConfigW InterlockedCompareExchange WriteConsoleInputA BackupSeek FreeEnvironmentStringsA GetModuleHandleW EnumCalendarInfoExW EnumTimeFormatsA EnumResourceTypesA ActivateActCtx GlobalAlloc LoadLibraryW TerminateThread GetSystemWindowsDirectoryA GetFileAttributesA GetConsoleAliasW IsDBCSLeadByte lstrcmpW GlobalUnlock FindFirstFileA SetLastError GetProcAddress GetFirmwareEnvironmentVariableW EnterCriticalSection ResetEvent OpenWaitableTimerA LocalAlloc SetCalendarInfoW BuildCommDCBAndTimeoutsW SetCurrentDirectoryW GlobalGetAtomNameW AddAtomA WaitForMultipleObjects FindNextFileA FindFirstVolumeMountPointA GetCPInfoExA ReadConsoleInputW DeleteFileW CopyFileExA DeleteFileA CloseHandle HeapSize GetLastError WideCharToMultiByte GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetCurrentThreadId GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess LeaveCriticalSection SetFilePointer SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection ExitProcess WriteFile GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW FatalAppExitA HeapFree Sleep IsProcessorFeaturePresent GetLocaleInfoW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetConsoleCtrlHandler FreeLibrary InterlockedExchange HeapAlloc HeapReAlloc WriteConsoleW CreateFileW

user32

LoadMenuA

Sharing