Overview
overview
3Static
static
3nginx/cont...inx.pl
ubuntu-18.04-amd64
1nginx/cont...inx.pl
debian-9-armhf
1nginx/cont...inx.pl
debian-9-mips
1nginx/cont...inx.pl
debian-9-mipsel
1nginx/cont...inx.pl
ubuntu-18.04-amd64
1nginx/cont...inx.pl
debian-9-armhf
1nginx/cont...inx.pl
debian-9-mips
1nginx/cont...inx.pl
debian-9-mipsel
1nginx/html/50x.html
windows7-x64
1nginx/html/50x.html
windows10-2004-x64
1nginx/html/index.html
windows7-x64
1nginx/html/index.html
windows10-2004-x64
1nginx/nginx.exe
windows7-x64
1nginx/nginx.exe
windows10-2004-x64
1nginx/nginxClose.bat
windows7-x64
1nginx/nginxClose.bat
windows10-2004-x64
1nginx/nginxlive.bat
windows7-x64
1nginx/nginxlive.bat
windows10-2004-x64
1nginx/配置.exe
windows7-x64
1nginx/配置.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
nginx/contrib/geo2nginx.pl
Resource
ubuntu1804-amd64-20230621-en
Behavioral task
behavioral2
Sample
nginx/contrib/geo2nginx.pl
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral3
Sample
nginx/contrib/geo2nginx.pl
Resource
debian9-mipsbe-20221125-en
Behavioral task
behavioral4
Sample
nginx/contrib/geo2nginx.pl
Resource
debian9-mipsel-20221111-en
Behavioral task
behavioral5
Sample
nginx/contrib/unicode2nginx/unicode-to-nginx.pl
Resource
ubuntu1804-amd64-20230712-en
Behavioral task
behavioral6
Sample
nginx/contrib/unicode2nginx/unicode-to-nginx.pl
Resource
debian9-armhf-20221125-en
Behavioral task
behavioral7
Sample
nginx/contrib/unicode2nginx/unicode-to-nginx.pl
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral8
Sample
nginx/contrib/unicode2nginx/unicode-to-nginx.pl
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral9
Sample
nginx/html/50x.html
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
nginx/html/50x.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
nginx/html/index.html
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
nginx/html/index.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
nginx/nginx.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
nginx/nginx.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
nginx/nginxClose.bat
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
nginx/nginxClose.bat
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
nginx/nginxlive.bat
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
nginx/nginxlive.bat
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
nginx/配置.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
nginx/配置.exe
Resource
win10v2004-20230703-en
General
-
Target
f55c3a760514fc61dd0f8486ec6172998e8fc21ad23ee1feff4493495191b15f
-
Size
2.3MB
-
MD5
eeb82114c0b8f42308c457d4bc2520e6
-
SHA1
82c3f845694665d5bb8c5fe3d563a59a1d0acabd
-
SHA256
f55c3a760514fc61dd0f8486ec6172998e8fc21ad23ee1feff4493495191b15f
-
SHA512
00b5351095b59f70dcead72a88c250d95e0d905d28e34ee0b8bb5c6691067b45c1b32dee61e1c23a9b0799dcd24ca9ba71131b951e2c0623ed13e863277cf52e
-
SSDEEP
49152:i5cNV0B0m8e3/G89xc4sAWEKu4cvJ6ippwe5Ws6pG8hYqCFwtMi0+k8c1:iuVQP8ADfcDAWEKu4I6ipqess6LLyiPI
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/nginx/nginx.exe unpack001/nginx/配置.exe
Files
-
f55c3a760514fc61dd0f8486ec6172998e8fc21ad23ee1feff4493495191b15f.zip
-
nginx/bill/123.txt
-
nginx/conf/fastcgi.conf
-
nginx/conf/fastcgi_params
-
nginx/conf/koi-utf
-
nginx/conf/koi-win
-
nginx/conf/mime.types
-
nginx/conf/nginx.conf
-
nginx/conf/scgi_params
-
nginx/conf/uwsgi_params
-
nginx/conf/win-utf
-
nginx/contrib/README
-
nginx/contrib/geo2nginx.pl.pl .sh linux
-
nginx/contrib/unicode2nginx/koi-utf
-
nginx/contrib/unicode2nginx/unicode-to-nginx.pl.pl .sh linux
-
nginx/contrib/unicode2nginx/win-utf
-
nginx/contrib/vim/ftdetect/nginx.vim
-
nginx/contrib/vim/ftplugin/nginx.vim
-
nginx/contrib/vim/indent/nginx.vim
-
nginx/contrib/vim/syntax/nginx.vim
-
nginx/docs/123.txt
-
nginx/docs/CHANGES
-
nginx/docs/CHANGES.ru
-
nginx/docs/LICENSE
-
nginx/docs/OpenSSL.LICENSE
-
nginx/docs/PCRE.LICENCE
-
nginx/docs/README
-
nginx/docs/zlib.LICENSE
-
nginx/html/123.txt
-
nginx/html/50x.html.html
-
nginx/html/index.html.html
-
nginx/logs/nginx.pid
-
nginx/nginx.exe.exe windows x86
366db7e407ce1223c3d14e086468d1b5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLongPathNameW
CreateFileW
GetFileAttributesExW
MapViewOfFile
CreateFileMappingA
SetEndOfFile
SetFilePointerEx
MapViewOfFileEx
GetSystemTimeAsFileTime
GetTimeZoneInformation
CreateProcessA
TerminateProcess
ResetEvent
OpenEventA
GetExitCodeProcess
WaitForMultipleObjects
GetCommandLineA
GetModuleFileNameA
CreateThread
GetEnvironmentVariableA
GetModuleHandleA
GetSystemInfo
GetVersionExA
SetEvent
CreateEventA
WaitForSingleObject
GetDiskFreeSpaceExA
FreeConsole
ReleaseMutex
OpenMutexA
CreateMutexA
SetEnvironmentVariableA
CreateIoCompletionPort
GetQueuedCompletionStatus
RemoveDirectoryA
GetDiskFreeSpaceA
FindClose
FindNextFileA
FindFirstFileA
UnmapViewOfFile
SetFileTime
WriteFile
ReadFile
FormatMessageA
Sleep
SwitchToThread
InterlockedCompareExchange
CreateFileA
SetLastError
GetFileInformationByHandle
CreateDirectoryA
DeleteFileA
SetStdHandle
GetCurrentThreadId
InterlockedExchangeAdd
LoadLibraryA
GetProcAddress
GetProcessHeap
GetDriveTypeW
WriteConsoleW
CompareStringW
RtlUnwind
HeapSize
SetCurrentDirectoryW
GetCurrentDirectoryW
PeekNamedPipe
GetFullPathNameA
SetFilePointer
FlushFileBuffers
GetConsoleCP
GetTickCount
GetStartupInfoW
SetHandleCount
MoveFileA
GetCurrentProcessId
CloseHandle
FreeLibrary
GetCurrentDirectoryA
GetLastError
GetStdHandle
SetConsoleCtrlHandler
SystemTimeToFileTime
GetSystemTime
DeleteFiber
SwitchToFiber
CreateFiber
WideCharToMultiByte
FindNextFileW
FindFirstFileW
MultiByteToWideChar
GetModuleHandleExW
GetModuleHandleW
GetVersion
GetFileType
FormatMessageW
QueryPerformanceCounter
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetEnvironmentVariableW
HeapFree
ExitProcess
DecodePointer
HeapAlloc
InterlockedDecrement
InterlockedIncrement
GetTimeFormatA
GetDateFormatA
HeapSetInformation
InterlockedExchange
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
EncodePointer
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FatalAppExitA
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThread
GetModuleFileNameW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
user32
GetProcessWindowStation
MessageBoxW
CharToOemBuffA
GetUserObjectInformationW
advapi32
CryptGetProvParam
CryptCreateHash
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegCloseKey
RegSetValueExA
ReportEventW
RegisterEventSourceW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptEnumProvidersW
CryptDestroyKey
CryptDecrypt
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
RegCreateKeyExA
ws2_32
__WSAFDIsSet
WSAStartup
WSAIoctl
WSASend
WSAGetOverlappedResult
WSARecv
ioctlsocket
accept
connect
gethostname
WSASocketW
select
recv
shutdown
setsockopt
bind
closesocket
listen
getsockname
WSAGetLastError
getsockopt
getaddrinfo
freeaddrinfo
htons
ntohs
ntohl
htonl
WSASetLastError
send
getnameinfo
gethostbyname
WSACleanup
socket
crypt32
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 656KB - Virtual size: 656KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 119KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
nginx/nginxClose.bat
-
nginx/nginxlive.bat
-
nginx/配置.exe.exe windows x86
8761c794d4f52de4e3326deb8d05a6f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
FindClose
FindFirstFileA
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
GetACP
HeapSize
TerminateProcess
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RaiseException
RtlUnwind
GetStartupInfoA
CreateEventA
CreateThread
WritePrivateProfileStringA
GetVersionExA
GetLastError
FileTimeToSystemTime
FormatMessageA
LocalFree
InterlockedDecrement
SuspendThread
TerminateThread
ReleaseMutex
CreateMutexA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
lstrlenW
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GetProfileIntA
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
CopyFileA
CreateDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
CreateProcessA
WaitForSingleObject
CloseHandle
FileTimeToLocalFileTime
SetLastError
lstrcpynA
DuplicateHandle
SetFilePointer
FlushFileBuffers
LockFile
InterlockedIncrement
user32
GetMenuItemCount
WaitForInputIdle
wsprintfA
CloseClipboard
GetClipboardData
OpenClipboard
SetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetSystemMetrics
GetCursorPos
MessageBoxA
MessageBeep
SetWindowPos
SendMessageA
DestroyCursor
SetParent
IsWindow
PostMessageA
GetTopWindow
GetParent
GetFocus
GetClientRect
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
GetWindowRect
SetForegroundWindow
DestroyMenu
IsChild
ReleaseDC
IsRectEmpty
InvertRect
FillRect
GetDC
SetCursor
LoadCursorA
SetCursorPos
SetActiveWindow
GetSysColor
SetWindowLongA
GetWindowLongA
RedrawWindow
EnableWindow
IsWindowVisible
OffsetRect
PtInRect
DestroyIcon
IntersectRect
InflateRect
SetRect
SetScrollPos
SetScrollRange
GetScrollRange
SetCapture
GetCapture
ReleaseCapture
SetTimer
KillTimer
WinHelpA
LoadBitmapA
UnregisterHotKey
RegisterHotKey
CreateWindowExA
CallWindowProcA
GetForegroundWindow
FrameRect
GetDoubleClickTime
GetCursor
ClipCursor
GrayStringA
DrawTextA
TabbedTextOutA
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetLastActivePopup
GetMessageTime
RemovePropA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
GetMenuItemID
UnregisterClassA
RegisterClassA
GetScrollPos
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
wvsprintfA
LoadStringA
GetSysColorBrush
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
gdi32
SetBrushOrgEx
CreateFontA
AbortDoc
Escape
GetTextMetricsA
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetBkColor
CreateRectRgnIndirect
SetStretchBltMode
GetClipRgn
CreatePolygonRgn
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette
GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
CreatePatternBrush
SelectObject
GetObjectA
CreatePen
PatBlt
CombineRgn
CreateRectRgn
FillRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
TranslateCharsetInfo
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
CopyMetaFileA
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
winmm
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutRestart
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegCreateKeyExA
RegQueryValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
Shell_NotifyIconA
DragAcceptFiles
DragFinish
DragQueryFileA
ole32
OleSetClipboard
CoTaskMemFree
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
RevokeDragDrop
CoLockObjectExternal
DoDragDrop
OleGetClipboard
OleIsCurrentClipboard
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CLSIDFromString
OleFlushClipboard
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarDateFromStr
comctl32
ImageList_Create
ImageList_BeginDrag
ImageList_Add
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_Draw
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ws2_32
WSACleanup
closesocket
WSAAsyncSelect
recvfrom
ioctlsocket
recv
inet_ntoa
getpeername
accept
ntohl
comdlg32
PrintDlgA
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
GetFileTitleA
Sections
.text Size: 756KB - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ