Static task
static1
Behavioral task
behavioral1
Sample
OoklaServer.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
OoklaServer.exe
Resource
win10v2004-20230703-en
General
-
Target
OoklaServer.exe
-
Size
5.5MB
-
MD5
be8f99189fac098f0afe75a6a1f69923
-
SHA1
cd8df1f8cbdb11187cf60368906a398111e8781f
-
SHA256
d4d38b0fd4e1146df19695383e6362cb3164bceac637d05ca6ae8d131c164eb6
-
SHA512
83d7bb9b6c1d7cd84e6c521f3da17c491415b6ee1d12f6298c30620432b9f5fe2480cf1b1e288bbdfeac0c0e23a520365d306926742c142c797c3bb17f3e8c0c
-
SSDEEP
49152:0IVwASOdGtlq0oIU6iLVPuxoEDcJrNbbwwAm56EVrqTSFuox/nDiNTcN8Oh5PPdu:+X+hPl/wwFzFD7pL3luXix
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OoklaServer.exe
Files
-
OoklaServer.exe.exe windows x64
0accdf6841df4b4c4a74e48fbabb8776
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
ntohs
getservbyname
WSAStartup
WSASetLastError
socket
shutdown
setsockopt
sendto
send
recvfrom
recv
listen
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
ntohl
inet_addr
freeaddrinfo
getaddrinfo
gethostname
WSAGetLastError
select
WSACleanup
htons
bcrypt
BCryptGenRandom
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
kernel32
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateThread
CreateSemaphoreA
FreeLibrary
LoadLibraryA
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
GetLastError
GetVersionExW
GetStdHandle
SetConsoleCtrlHandler
GetModuleFileNameW
LocalFree
GetProcAddress
LoadLibraryW
InitializeCriticalSectionAndSpinCount
GetCurrentDirectoryW
GetLongPathNameW
GetTempPathW
GetSystemDirectoryW
WideCharToMultiByte
CreateDirectoryW
CreateFileW
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
SetFilePointer
CopyFileW
MoveFileExW
DuplicateHandle
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
OpenProcess
SizeofResource
GetSystemTimeAsFileTime
CreateEventW
GetCurrentThreadId
SetThreadPriority
GetExitCodeThread
CloseHandle
TlsGetValue
TlsSetValue
TlsFree
ReleaseMutex
CreateMutexW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
WaitForMultipleObjects
GetEnvironmentVariableA
GetSystemInfo
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
WriteFile
FormatMessageW
FindClose
FindFirstFileW
FindNextFileW
CreatePipe
GetTimeZoneInformation
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FlushFileBuffers
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
SwitchToFiber
DeleteFiber
RtlUnwind
MultiByteToWideChar
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
ConvertFiberToThread
ConvertThreadToFiber
RtlVirtualUnwind
RaiseException
RtlPcToFileHeader
RtlUnwindEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
LockResource
LoadResource
GetNativeSystemInfo
TryEnterCriticalSection
Sleep
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
FindResourceA
ExitProcess
SetEnvironmentVariableW
SetCurrentDirectoryW
ExitThread
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
GetFullPathNameW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
GetConsoleWindow
CreateFiber
SwitchToThread
GetTickCount
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
user32
GetUserObjectInformationW
GetProcessWindowStation
LoadStringA
MessageBoxW
advapi32
CryptAcquireContextW
RegOpenKeyExW
RegQueryValueExW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
ChangeServiceConfigW
CloseServiceHandle
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegSetValueExW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 102KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ