HikServer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

HikServer.exe
Size

223KB
MD5

0eb7c46dacb864a15b0c2a77db9bb4ae
SHA1

ad630a9cdaa679de008ed2ec867e93fb74010842
SHA256

72206858e280a3a7972dda7415c68a0fcacc21797bb74b92e4ac831eafb4d133
SHA512

53bc095375b9b0f3a8e764ccfb142c8b375fa54359a3ed6aeb960457f6665cb9deddf59879c8dbbad832351c6790e71fe20c01faeee6a657c15c9f96e02f4662
SSDEEP

6144:dLpg4rDvQ3KWq/FLVDPJ9VjALBcx+979i4tOSBLa4:dLfrDfL9P3d3xm1s4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HikServer.exe

Files

HikServer.exe
.exe windows x86

09531cf95273c1199a09742eb5a7bcac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc100

ord11172
ord11180
ord4078
ord7355
ord9449
ord11184
ord11153
ord11787
ord5098
ord9281
ord6112
ord888
ord9399
ord6835
ord890
ord1290
ord1479
ord5215
ord14120
ord1011
ord2409
ord13280
ord3431
ord2614
ord7862
ord3743
ord2776
ord8227
ord5444
ord5857
ord13136
ord868
ord10915
ord13348
ord2538
ord1266
ord7322
ord1483
ord7206
ord12440
ord4283
ord12868
ord3254
ord7211
ord1012
ord3744
ord5534
ord12535
ord2417
ord8228
ord11154
ord5302
ord8304
ord5858
ord895
ord3390
ord11646
ord4870
ord4868
ord5827
ord417
ord13045
ord5242
ord305
ord2626
ord7871
ord4464
ord1480
ord1313
ord300
ord5207
ord4498
ord5238
ord3409
ord13481
ord13484
ord13482
ord13485
ord13480
ord13483
ord7144
ord11413
ord13181
ord10922
ord14075
ord1732
ord7091
ord11806
ord3618
ord3676
ord8486
ord13299
ord7073
ord13301
ord11439
ord11421
ord1294
ord265
ord11511
ord826
ord871
ord12094
ord2061
ord2063
ord2067
ord266
ord5788
ord1269
ord13219
ord13131
ord13137
ord1982
ord310
ord6259
ord10007
ord3373
ord1448
ord11420
ord2163
ord4724
ord13767
ord11726
ord1296
ord7510
ord7584
ord2611
ord9475
ord8137
ord6678
ord1288
ord1929
ord915
ord4144
ord7832
ord7837
ord11461
ord1890
ord4785
ord12719
ord11067
ord10360
ord3620
ord2974
ord2973
ord2752
ord5532
ord12531
ord2881
ord2878
ord7349
ord2416
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8235
ord11025
ord3395
ord10883
ord13294
ord8070
ord11107
ord6217
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord4341
ord5875
ord3746
ord7863
ord3475
ord2187
ord5777
ord8222
ord2742
ord3738
ord1900
ord917
ord11941
ord341
ord6131
ord10030
ord1210
ord788
ord12962
ord3491
ord13095
ord976
ord415
ord7487
ord2944
ord2846
ord11103
ord4622
ord4903
ord5095
ord8439
ord4881
ord5123
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9286
ord8305
ord5803
ord381
ord316
ord1316
ord946
ord901
ord7876
ord7875
ord4505
ord306
ord3406
ord3253
ord3361
ord4143
ord11744
ord6970
ord13129
ord1231
ord13135
ord2088

msvcr100

_stricmp
_strnicmp
_setmbcp
isalnum
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
rand
srand
isalpha
toupper
_ismbcspace
tolower
isspace
strchr
_mbsnbicmp
_mbspbrk
_mbschr
_recalloc
_resetstkoflw
memcpy_s
free
malloc
_mbsstr
_mbsnbcpy_s
atol
sscanf
memmove
strstr
sprintf
printf
strncpy
memset
atoi
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_time64
memcpy
__CxxFrameHandler3

kernel32

LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
TerminateThread
WaitForSingleObject
CloseHandle
IsDBCSLeadByte
lstrcmpiA
lstrlenA
InterlockedIncrement
GetModuleHandleA
FreeLibrary
SizeofResource
EnterCriticalSection
LocalFree
GetProcAddress
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
RaiseException
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
CreateFileA
SetLocalTime
CreateDirectoryA
GetModuleFileNameA
CreateMutexA
OutputDebugStringA
CreateEventA
ResetEvent
SetEvent
GetLocalTime
CreateThread
Sleep
GetExitCodeThread
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
SetupComm
SetCommTimeouts
ClearCommError
ReadFile
GetOverlappedResult
GetCommState
SetCommState
SetCommMask
EscapeCommFunction
PurgeComm
GetTickCount
LoadLibraryA
GetCurrentThreadId
LoadLibraryExA
FindResourceA
LoadResource

user32

CreatePopupMenu
AppendMenuA
IsIconic
GetClientRect
SetForegroundWindow
LoadIconW
GetSystemMetrics
DrawIcon
GetCursorPos
FindWindowA
RegisterWindowMessageA
CharNextA
PostThreadMessageA
MessageBoxA
KillTimer
SetTimer
LoadIconA
EnableWindow
SendMessageA

gdi32

GetTextExtentPoint32A

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyExA

shell32

SHGetPathFromIDListA
ShellExecuteA
Shell_NotifyIconA
SHBrowseForFolderA

ole32

StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid

oleaut32

VarUI4FromStr
VariantClear

hikworkmodule

ord29
ord32
ord2
ord5
ord31
ord8
ord7
ord21
ord18
ord16
ord13
ord19
ord34
ord33
ord30
ord27
ord28
ord10
ord3
ord14
ord4
ord1
ord6
ord12
ord20

cltworkmodule

ord35
ord1
ord13
ord38
ord7
ord6
ord2
ord4

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z

ws2_32

gethostbyname
shutdown
htonl
bind
listen
accept
WSAStartup
send
WSAGetLastError
closesocket
recv
__WSAFDIsSet
select
socket
ioctlsocket
setsockopt
inet_addr
getsockopt
connect
htons
inet_ntoa

winmm

timeGetTime

hcnetsdk

NET_DVR_RealPlay_V30
NET_DVR_SetRealDataCallBack
NET_DVR_SetStandardDataCallBack
NET_DVR_Cleanup
NET_DVR_Init
NET_DVR_SetConnectTime
NET_DVR_SetReconnect
NET_DVR_StopRealPlay
NET_DVR_Logout_V30
NET_DVR_Login_V30
NET_DVR_MakeKeyFrame
NET_DVR_MakeKeyFrameSub
NET_DVR_SetDVRConfig

hcehomesdk

ord1
ord6
ord5
ord3
ord7
ord19
ord4
ord2
ord8
ord9

dhnetsdk

ord133
ord44
ord88
ord20
ord5
ord89
ord157
ord6
ord54
ord63
ord1
ord127
ord46
ord2

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09531cf95273c1199a09742eb5a7bcac

Headers

DLL Characteristics

File Characteristics

Imports

mfc100

msvcr100

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

hikworkmodule

cltworkmodule

msvcp100

ws2_32

winmm

hcnetsdk

hcehomesdk

dhnetsdk

Sections

.text Size: 159KB - Virtual size: 159KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 159KB - Virtual size: 159KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 19KB - Virtual size: 18KB