owfs2http[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

owfs2http.exe
Size

105KB
MD5

6f8ffd59fb769106c0d90636a7fc6a2d
SHA1

939854b561837f2ca342f992d4e521947e690a6f
SHA256

6644c38e3a09e48cf099aea53a07ec63efbf81d0b38fe776bb2f7c43ac5841bb
SHA512

db2def1fd68f3f7bca94cc1d1c02fb84e513a4eb94aff43d209651ccac460b3f2a49bf3b7ce0922c9237a8b6fb9eef180cb51cfaf88bb67cb7e346c91fcc96d1
SSDEEP

1536:SeyeK2nMTBGt6K8UmhmB3eQSLFHt33AmuHNU53776Qr812fveCQCoQrU:FyeK2MTBGtORhmBrSLjdGW/w12XeCQI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
owfs2http.exe

Files

owfs2http.exe
.exe windows x64

efbd3e1ccff433dc18e7f7f6c276f6a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

owfs_w64

ord95
ord14
ord74
ord93
ord79
ord106
ord15
ord145
ord92
ord13
ord84

kernel32

IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
ReadFile
FindFirstFileW
SetHandleInformation
SetLastError
GetFullPathNameW
FindNextFileW
GetModuleHandleW
GetStdHandle
WriteFile
CreatePipe
FindClose
GetFileAttributesW
DuplicateHandle
MultiByteToWideChar
CloseHandle
GetLocalTime
SystemTimeToFileTime
CreateProcessW
WideCharToMultiByte
RtlLookupFunctionEntry
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
RtlVirtualUnwind
TerminateProcess

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ws2_32

send
getsockname
getpeername
WSAStartup
listen
shutdown
ntohl
select
closesocket
bind
accept
__WSAFDIsSet
htons
ntohs
connect
inet_ntoa
recvfrom
recv
getsockopt
socket
WSAGetLastError
setsockopt
sendto
ioctlsocket
htonl

vcruntime140

memcpy
memcmp
memchr
memmove
memset
__C_specific_handler
strrchr
strchr
wcschr

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_errno
_c_exit
_cexit
__p___argv
_crt_atexit
_beginthread
__p___argc
_exit
terminate
_initterm_e
_initterm
strerror
_get_initial_narrow_environment
exit
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fread
__stdio_common_vsscanf
__acrt_iob_func
_set_fmode
fflush
fputs
fclose
_wfopen
fwrite
_fileno
fgets
__p__commode
__stdio_common_vfprintf
fgetc
fseek
fputc
__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
realloc
calloc

api-ms-win-crt-string-l1-1-0

isspace
isdigit
_strdup
strncpy
strncmp
toupper
isalnum
isprint
isxdigit
tolower

api-ms-win-crt-filesystem-l1-1-0

_wstat64
_rmdir

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_localtime64

api-ms-win-crt-convert-l1-1-0

atoi
_atoi64
strtoul

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

rmdir

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

efbd3e1ccff433dc18e7f7f6c276f6a5

Headers

DLL Characteristics

File Characteristics

Imports

owfs_w64

kernel32

advapi32

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 328B

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 328B