httpd[.]exe | Triage

General

Target

httpd.exe
Size

20KB
MD5

70149a8b2a9b171d07c20d5595282550
SHA1

e167cfb2969a67f9f8c78259f8f2d7f356597953
SHA256

5aa845b3df3a6a383e9628e5f6b536ac2da995864898f0f9f395637c214fea94
SHA512

e02cef06d439895c21a79a6492ce55a57662c856a329e601bbb90adcbb9ee1e26a3d0a319bd629fa146987b25d80e2754ace24baeff33c950aad9c0321a5e0e4
SSDEEP

384:Kbq+ctb2gUedrLry0DODh3RUyJuB/kqt3/s:KpPh3RU0uSqV/s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
httpd.exe

Files

httpd.exe
.exe windows x86

20f25a1f5eaaeb81b64c65e091433ea2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

libapr-1

_apr_palloc@8
_apr_filepath_name_get@4
apr_terminate
_apr_version_string@0
_apr_app_initialize@12
_apr_pool_create_ex@16
_apr_pool_tag@8
_apr_array_make@12
_apr_getopt_init@16
_apr_getopt@16
_apr_array_push@4
_apr_pstrdup@8
_apr_pool_clear@4
_apr_pool_destroy@4

libaprutil-1

_apr_hook_deregister_all@0
_apr_hook_sort_all@0
_apu_version_string@0
_apr_dynamic_fn_retrieve@4

libhttpd

ap_default_loglevel
_ap_run_rewrite_args@4
ap_log_error
_ap_setup_prelinked_modules@4
ap_server_config_defines
ap_server_post_read_config
ap_server_pre_read_config
ap_server_argv0
_ap_mpm_query@8
_ap_show_mpm@0
ap_real_exit_code
_ap_open_stderr_log@4
_ap_get_server_description@0
ap_conftree
_ap_read_config@16
_ap_run_pre_config@12
_ap_process_config_tree@16
_ap_fixup_virtual_hosts@8
_ap_fini_vhost_config@8
_ap_run_test_config@8
_ap_run_open_logs@16
_ap_run_post_config@16
ap_prelinked_modules
_ap_register_hooks@8
_ap_run_optional_fn_retrieve@0
_ap_mpm_run@12
_ap_get_server_built@0
_ap_show_modules@0
_ap_replace_stderr_log@8
ap_server_root
_ap_show_directives@0

msvcrt

_stricmp
exit
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_strnicmp
printf

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20f25a1f5eaaeb81b64c65e091433ea2

Headers

File Characteristics

Imports

libapr-1

libaprutil-1

libhttpd

msvcrt

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 3KB