gdbserver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

gdbserver.exe
Size

391KB
MD5

8c2a1c5e4e66a8225bb745e60477528f
SHA1

c6c9a7e9e4b445580bd7b3ae5923b397da78f2d9
SHA256

0b723702eae9882c803ce81122b995b01a3578659d6c319e715d7ec83321cb33
SHA512

3379c06c844e5d43f3737184a67230ce8dc4ffe15b47c917100c79b20694562cb75cfd3a1c38db7b6e2d7ea3dd1dd7da51d23b725037a3ca83db846a0505ba65
SSDEEP

6144:rwo2EomBVCvXUqdfHom6nz+1OZPa0dM2KqBjc9O/4pBA3Gd8TyZI6/I9G7k5SXbG:pKjfIm6nz9M27Gp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gdbserver.exe

Files

gdbserver.exe
.exe windows x64

052521071d03b09bfe834070035ccf6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libgcc_s_seh-1

_Unwind_Resume
__emutls_get_address

kernel32

CloseHandle
ContinueDebugEvent
CreateProcessA
DebugActiveProcess
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileA
FlushInstructionCache
FormatMessageA
FormatMessageW
GetCurrentDirectoryA
GetCurrentProcess
GetFileAttributesA
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleA
GetFullPathNameA
GetHandleInformation
GetLastError
GetProcAddress
GetSystemDirectoryA
GetSystemWow64DirectoryA
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenProcess
PeekNamedPipe
ReadProcessMemory
ResumeThread
SetCurrentDirectoryA
SetLastError
SetThreadContext
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForDebugEvent
WaitForSingleObject
WideCharToMultiByte
WriteProcessMemory

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_cexit
_chdir
_close
_commode
_dup2
_environ
_errno
_fileno
_findclose
_findfirst64
_findnext64
_fmode
_fullpath
_get_osfhandle
_getcwd
_getmaxstdio
_initterm
_lock
_lseek
_mkdir
_onexit
_open
_open_osfhandle
_read
_setmaxstdio
_setmode
_stat64
_strdup
_stricmp
_strnicmp
_sys_errlist
_sys_nerr
_unlink
_unlock
_write
abort
calloc
exit
fclose
fflush
fopen
fprintf
fputc
free
fwrite
getenv
isalpha
isprint
isspace
iswctype
isxdigit
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
perror
qsort
realloc
signal
strcat
strchr
strcmp
strcoll
strcpy
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strtol
strtoul
tolower
towlower
vfprintf
wcscat
wcslen
wcstombs

user32

CharLowerBuffA

ws2_32

WSAStartup
__WSAFDIsSet
accept
bind
closesocket
freeaddrinfo
getaddrinfo
getnameinfo
getsockname
listen
recv
select
send
setsockopt
socket

libstdc++-6

_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEcy
_ZNKSt9bad_alloc4whatEv
_ZNKSt9type_infoeqERKS_
_ZNSt6chrono3_V212steady_clock3nowEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5eraseEN9__gnu_cxx17__normal_iteratorIPKcS4_EE
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8_M_eraseEyy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_mutateEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1ERKS4_
_ZNSt8__detail15_List_node_base11_M_transferEPS0_S1_
_ZNSt8__detail15_List_node_base7_M_hookEPS0_
_ZNSt8__detail15_List_node_base9_M_unhookEv
_ZNSt9bad_allocD2Ev
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt24__throw_out_of_range_fmtPKcz
_ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_
_ZSt28__throw_bad_array_new_lengthv
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt9terminatev
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdlPvy
__cxa_allocate_exception
__cxa_begin_catch
__cxa_end_catch
__cxa_free_exception
__cxa_guard_acquire
__cxa_guard_release
__cxa_rethrow
__cxa_throw
__gxx_personality_seh0

Sections

.text
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

052521071d03b09bfe834070035ccf6e

Headers

DLL Characteristics

File Characteristics

Imports

libgcc_s_seh-1

kernel32

msvcrt

user32

ws2_32

libstdc++-6

Sections

.text Size: 277KB - Virtual size: 276KB

.data Size: 1024B - Virtual size: 848B

.rdata Size: 74KB - Virtual size: 74KB

.pdata Size: 11KB - Virtual size: 11KB

.xdata Size: 14KB - Virtual size: 13KB

.bss Size: - Virtual size: 16KB

.idata Size: 8KB - Virtual size: 8KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 277KB - Virtual size: 276KB

.data
Size: 1024B - Virtual size: 848B

.rdata
Size: 74KB - Virtual size: 74KB

.pdata
Size: 11KB - Virtual size: 11KB

.xdata
Size: 14KB - Virtual size: 13KB

.bss
Size: - Virtual size: 16KB

.idata
Size: 8KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 2KB - Virtual size: 2KB