Static task
static1
Behavioral task
behavioral1
Sample
CRAServer.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
CRAServer.exe
Resource
win10v2004-20230915-en
General
-
Target
CRAServer.exe
-
Size
1.7MB
-
MD5
49c98ab6e465c3ca212d0f3394f9d4d1
-
SHA1
2c850022455768dea6f439010254593b17995db9
-
SHA256
a52eb38f97df10cdae6a89ec829cc5a8260bdb396ab7880a6cf291db017635b6
-
SHA512
3a8ba78e80a992c057ec420a2ff0dcf90e9d26aa50d7b8c8503acf2f3dc14979ddcd9d38af457e8fa01fcf43628665413aad5b3f61b82d0d4ba0252d6040666e
-
SSDEEP
12288:ZnCvWjq1rsJJyp0sp8GiTQBrKwDRBwhbtJqe2DwBMsjsRnYy0SyZwBd+2lMkgsxH:j+FCD2MsxGth+RDpGi7qrgowZxApja
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CRAServer.exe
Files
-
CRAServer.exe.exe windows:5 windows x86
f66a5dfaffd2cf611c26645a38b185d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140
ord8672
ord2250
ord274
ord1042
ord4410
ord6840
ord2459
ord7407
ord2251
ord3924
ord4869
ord2210
ord2524
ord2344
ord8426
ord5930
ord1000
ord1472
ord14571
ord12348
ord14518
ord12291
ord2376
ord8321
ord5058
ord993
ord1468
ord1064
ord7961
ord2200
ord13830
ord9422
ord8713
ord3825
ord3688
ord3689
ord890
ord1389
ord10986
ord4468
ord14149
ord5102
ord12503
ord12034
ord2992
ord7783
ord3686
ord287
ord1527
ord5094
ord290
ord8717
ord12528
ord1528
ord14336
ord7998
ord4315
ord2458
ord2472
ord12863
ord3839
ord1693
ord1142
ord458
ord7076
ord462
ord4476
ord14421
ord5401
ord14054
ord10421
ord3808
ord1109
ord1111
ord3874
ord7078
ord1140
ord2880
ord14520
ord11907
ord500
ord12850
ord1179
ord550
ord293
ord5897
ord2985
ord3841
ord311
ord1105
ord5551
ord449
ord8146
ord6936
ord934
ord1416
ord2890
ord7352
ord5059
ord443
ord14393
ord4656
ord8718
ord1692
ord286
ord5096
ord306
ord1659
ord8322
ord12826
ord4807
ord14322
ord1519
ord14319
ord2946
ord12865
ord2558
ord3005
ord5861
ord14238
ord305
ord5898
ord280
ord2378
ord12842
ord12853
ord12844
ord12854
ord12848
ord1043
ord1522
ord1521
ord296
ord1526
ord2986
ord2407
ord2241
ord2387
ord2381
ord2383
ord5565
ord5562
ord4725
ord2438
ord4705
ord503
ord12706
ord14279
ord6505
ord4210
ord3140
ord9083
ord6104
ord6464
ord8429
ord8347
ord12806
ord8285
ord5336
ord2484
ord12484
ord12485
ord14509
ord7886
ord14507
ord9353
ord4143
ord12888
ord7905
ord2027
ord11927
ord11928
ord14380
ord12474
ord7964
ord14581
ord6322
ord14583
ord6324
ord14582
ord6323
ord3844
ord5894
ord12182
ord12190
ord4580
ord8180
ord10383
ord12194
ord12162
ord12869
ord5742
ord10202
ord6831
ord7618
ord6195
ord13681
ord2759
ord12163
ord9166
ord8705
ord4218
ord6581
ord7619
ord300
ord1696
ord1529
ord316
ord1044
ord2298
ord1661
ord2477
ord310
ord6724
ord7459
ord12115
ord9213
ord7461
ord12074
ord8997
ord10963
ord11343
ord4084
ord3396
ord3395
ord3159
ord6193
ord13677
ord3298
ord3295
ord8173
ord2758
ord14699
ord10237
ord10239
ord10238
ord10236
ord10240
ord5631
ord11671
ord11672
ord9096
ord12032
ord3830
ord11881
ord14502
ord8922
ord12116
ord6947
ord10950
ord9192
ord3259
ord13798
ord12205
ord12201
ord1717
ord1739
ord1765
ord1751
ord1772
ord4920
ord4987
ord4932
ord4950
ord4944
ord4938
ord4997
ord4981
ord4926
ord5003
ord4958
ord4896
ord4911
ord4972
ord4493
ord9647
ord4485
ord3050
ord14510
ord7887
ord14508
ord6848
ord11663
ord13628
ord5911
ord2680
ord12067
ord3933
ord3364
ord3363
ord3258
ord12111
ord5228
ord5528
ord5739
ord9305
ord5504
ord5769
ord5231
ord5390
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord10207
ord9167
ord6463
ord6540
ord266
ord265
ord1507
ord4079
ord5362
ord5857
ord5855
ord12035
ord13844
ord2754
ord4002
ord11411
ord11375
ord12747
ord3843
ord4307
ord1916
ord2780
ord13846
ord8748
ord1650
ord11913
kernel32
Process32First
OpenProcess
Process32Next
GetExitCodeProcess
RemoveDirectoryA
CreateEventA
CreateProcessW
LocalFree
CreateProcessA
GetExitCodeThread
TerminateThread
LocalSize
ExitProcess
FreeLibrary
LoadLibraryA
GetConsoleScreenBufferInfo
MoveFileExA
CopyFileExA
SetConsoleCursorPosition
SetConsoleTextAttribute
ExitThread
GetVersion
CreateMutexA
MultiByteToWideChar
GetVolumePathNameA
CreateToolhelp32Snapshot
LocalAlloc
lstrlenA
FormatMessageA
WritePrivateProfileStringA
GetPrivateProfileStringA
Sleep
GetDiskFreeSpaceExA
GetCurrentThreadId
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
InitializeCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
CreateThread
WaitForSingleObject
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
DecodePointer
InitializeCriticalSectionAndSpinCount
GetSystemTime
GetLastError
CreateFileA
CreateDirectoryA
CloseHandle
ReadFile
GetCurrentProcess
user32
MsgWaitForMultipleObjects
RegisterWindowMessageA
GetSystemMetrics
KillTimer
SetTimer
UpdateWindow
GetClientRect
IsIconic
DrawIcon
TrackPopupMenu
GetCursorPos
SetMenuDefaultItem
LoadIconW
SetForegroundWindow
LoadMenuW
ModifyMenuA
GetSubMenu
GetMenuItemID
GetMenuItemCount
SendMessageA
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
SetDlgItemTextA
GetDlgItem
ExitWindowsEx
FindWindowA
TranslateMessage
PeekMessageA
PostMessageA
MessageBoxA
DispatchMessageA
EnableWindow
oleaut32
VariantTimeToSystemTime
VarDateFromStr
VarUdateFromDate
SystemTimeToVariantTime
msvcp140
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1_Lockit@std@@QAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
??0_Lockit@std@@QAE@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??Bios_base@std@@QBE_NXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fail@ios_base@std@@QBE_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
opencv_core331
cvFlip
cvCloneImage
cvReleaseImage
cvSetImageCOI
cvSetImageROI
cvCreateImage
cvCopy
?deallocate@String@cv@@AAEXXZ
vcruntime140
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
__CxxUnregisterExceptionObject
_purecall
__CxxFrameHandler3
memset
_CxxThrowException
__FrameUnwindFilter
__std_terminate
memmove
strchr
_except_handler4_common
__std_exception_destroy
__std_exception_copy
api-ms-win-crt-string-l1-1-0
_strdup
strcpy_s
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
_mktime64
strftime
clock
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
malloc
free
api-ms-win-crt-multibyte-l1-1-0
_ismbblead
api-ms-win-crt-stdio-l1-1-0
__p__commode
fwrite
_get_stream_buffer_pointers
fclose
fputc
__stdio_common_vsprintf
__stdio_common_vfprintf_s
__stdio_common_vfprintf
__acrt_iob_func
ferror
ungetc
fgetc
fread
_fseeki64
fgetpos
fsetpos
fflush
_fsopen
fgetwc
ungetwc
fseek
fputwc
_getcwd
fopen_s
feof
fopen
setvbuf
ftell
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_errno
_invalid_parameter_noinfo_noreturn
_resetstkoflw
_invalid_parameter_noinfo
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
_seh_filter_exe
_controlfp_s
_beginthreadex
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_set_app_type
_endthreadex
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
abort
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_setmbcp
msvfw32
ICClose
ICOpen
ICSendMessage
ICDecompress
odbc32
ord36
winmm
timeGetTime
advapi32
OpenProcessToken
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
Shell_NotifyIconA
comctl32
InitCommonControlsEx
shlwapi
PathRemoveFileSpecA
ole32
CoInitialize
urlmon
URLDownloadToFileA
opencv_imgcodecs331
cvSaveImage
iphlpapi
GetAdaptersInfo
GetIpAddrTable
ws2_32
setsockopt
send
closesocket
connect
WSAAccept
__WSAFDIsSet
listen
ioctlsocket
bind
htonl
freeaddrinfo
getaddrinfo
WSAGetLastError
select
WSAAddressToStringA
recv
htons
WSAStartup
socket
getpeername
ntohs
shutdown
inet_ntoa
api-ms-win-crt-convert-l1-1-0
atol
atoi
_wtoi
atof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_mkdir
_stat64
remove
_rmdir
_chdir
_unlock_file
mscoree
_CorExeMain
Sections
.text Size: 1010KB - Virtual size: 1010KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 689KB - Virtual size: 689KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ