Static task
static1
Behavioral task
behavioral1
Sample
CRAServer.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
CRAServer.exe
Resource
win10v2004-20230915-en
General
-
Target
CRAServer.exe
-
Size
1.7MB
-
MD5
3e2d12f7ffbc665e7e7d0e5488aad326
-
SHA1
8e4ff0f9e46f8c5af43355355f1313f21c6c4c4e
-
SHA256
90b4d74bb6cae2412578cbb85720af306ce71fbda1b0a262d02625659873e718
-
SHA512
a81e5cb6c3f8beb66430686dfe6d3dbcfb2ad03959434a3b492ffdc777be8bf75425a12407ed778e33973d4adbddbb475500203034302ae88004bef50f757724
-
SSDEEP
12288:RHodgq1VoJJyVKietQ77Pxu1ILfPqItTseOVypmkySQDHe1oIOWEc9426AIbQccQ:lcbPe2OQb+Pb+RDpGi7frgWFKusSc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CRAServer.exe
Files
-
CRAServer.exe.exe windows:5 windows x86
7775d4d1a2b0c03f3f3665761ac36e36
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140
ord2250
ord274
ord1042
ord4410
ord6840
ord2459
ord7407
ord2251
ord3924
ord4869
ord2210
ord2524
ord2344
ord8426
ord5930
ord1000
ord1472
ord14571
ord12348
ord14518
ord12291
ord2376
ord8321
ord5058
ord993
ord1468
ord1064
ord7961
ord2200
ord13830
ord9422
ord8713
ord3825
ord3688
ord3689
ord890
ord1389
ord10986
ord4468
ord14149
ord5102
ord12503
ord12034
ord2992
ord7783
ord3686
ord287
ord1527
ord503
ord12706
ord5094
ord290
ord8717
ord12528
ord1528
ord14336
ord7998
ord4315
ord2458
ord2472
ord12863
ord3839
ord1693
ord14279
ord458
ord7076
ord462
ord4476
ord14421
ord5401
ord14054
ord10421
ord3808
ord1109
ord1111
ord3874
ord7078
ord1140
ord2880
ord14520
ord11907
ord500
ord12850
ord1179
ord550
ord293
ord5897
ord2985
ord3841
ord311
ord1105
ord5551
ord449
ord2890
ord6936
ord934
ord1416
ord7352
ord5059
ord443
ord4656
ord8718
ord1650
ord1692
ord286
ord5096
ord306
ord1659
ord8322
ord12826
ord4807
ord8146
ord14322
ord1519
ord14319
ord2946
ord12865
ord2558
ord3005
ord5861
ord14238
ord305
ord5898
ord280
ord2378
ord12842
ord12853
ord12844
ord12854
ord12848
ord1043
ord1522
ord1521
ord296
ord1526
ord2986
ord2407
ord2241
ord2387
ord2381
ord2383
ord8672
ord1142
ord5565
ord5562
ord4725
ord2438
ord4705
ord6505
ord4210
ord3140
ord9083
ord6104
ord6464
ord8429
ord8347
ord12806
ord8285
ord5336
ord2484
ord12484
ord12485
ord14509
ord7886
ord14507
ord9353
ord4143
ord12888
ord7905
ord2027
ord11927
ord11928
ord14380
ord12474
ord7964
ord14581
ord6322
ord14583
ord6324
ord14582
ord6323
ord3844
ord5894
ord12182
ord12190
ord4580
ord8180
ord10383
ord12194
ord12162
ord12869
ord5742
ord10202
ord6831
ord7618
ord6195
ord13681
ord2759
ord12163
ord9166
ord8705
ord4218
ord6581
ord7619
ord300
ord1696
ord1529
ord316
ord1044
ord2298
ord1661
ord2477
ord310
ord6724
ord7459
ord12115
ord9213
ord7461
ord12074
ord8997
ord10963
ord11343
ord4084
ord3396
ord3395
ord3159
ord6193
ord13677
ord3298
ord3295
ord8173
ord2758
ord14699
ord10237
ord10239
ord10238
ord10236
ord10240
ord5631
ord11671
ord11672
ord9096
ord12032
ord3830
ord11881
ord14502
ord8922
ord12116
ord6947
ord10950
ord9192
ord3259
ord13798
ord12205
ord12201
ord1717
ord1739
ord1765
ord1751
ord1772
ord4920
ord4987
ord4932
ord4950
ord4944
ord4938
ord4997
ord4981
ord4926
ord5003
ord4958
ord4896
ord4911
ord4972
ord4493
ord9647
ord4485
ord3050
ord14510
ord7887
ord14508
ord6848
ord11663
ord13628
ord5911
ord2680
ord12067
ord3933
ord3364
ord3363
ord3258
ord12111
ord5228
ord5528
ord5739
ord9305
ord5504
ord5769
ord5231
ord5390
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord10207
ord9167
ord6463
ord6540
ord266
ord265
ord1507
ord4079
ord5362
ord5857
ord5855
ord12035
ord13844
ord2754
ord4002
ord11411
ord11375
ord12747
ord3843
ord4307
ord1916
ord2780
ord13846
ord8748
ord14393
ord11913
kernel32
CreateEventA
CreateProcessW
LocalFree
CreateProcessA
GetExitCodeThread
TerminateThread
GetDiskFreeSpaceExA
GetExitCodeProcess
FreeLibrary
LoadLibraryA
GetConsoleScreenBufferInfo
MoveFileExA
CopyFileExA
SetConsoleCursorPosition
SetConsoleTextAttribute
ExitThread
GetVersion
CreateMutexA
GetVolumePathNameA
RemoveDirectoryA
Process32Next
OpenProcess
Process32First
LocalSize
CreateToolhelp32Snapshot
LocalAlloc
lstrlenA
MultiByteToWideChar
FormatMessageA
WritePrivateProfileStringA
GetPrivateProfileStringA
InitializeCriticalSection
ExitProcess
GetStartupInfoW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
Sleep
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
CreateThread
WaitForSingleObject
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
DecodePointer
InitializeCriticalSectionAndSpinCount
GetSystemTime
GetLastError
CreateFileA
CreateDirectoryA
CloseHandle
ReadFile
GetCurrentProcess
user32
GetClientRect
UpdateWindow
IsIconic
DrawIcon
TrackPopupMenu
GetCursorPos
SetMenuDefaultItem
SetTimer
SetForegroundWindow
LoadMenuW
ModifyMenuA
GetSubMenu
GetMenuItemID
GetMenuItemCount
SendMessageA
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
SetDlgItemTextA
GetDlgItem
ExitWindowsEx
FindWindowA
TranslateMessage
KillTimer
GetSystemMetrics
RegisterWindowMessageA
LoadIconW
EnableWindow
DispatchMessageA
MessageBoxA
PostMessageA
MsgWaitForMultipleObjects
PeekMessageA
oleaut32
VarDateFromStr
VariantTimeToSystemTime
VarUdateFromDate
SystemTimeToVariantTime
msvcp140
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1_Lockit@std@@QAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
??0_Lockit@std@@QAE@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??Bios_base@std@@QBE_NXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fail@ios_base@std@@QBE_NXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
opencv_core331
cvFlip
cvCloneImage
cvReleaseImage
cvSetImageCOI
cvSetImageROI
cvCreateImage
cvCopy
?deallocate@String@cv@@AAEXXZ
vcruntime140
__CxxQueryExceptionSize
__CxxDetectRethrow
__CxxExceptionFilter
__FrameUnwindFilter
__CxxRegisterExceptionObject
__CxxFrameHandler3
memset
_CxxThrowException
_except_handler4_common
__std_exception_destroy
__std_exception_copy
strchr
memmove
__std_terminate
_purecall
__CxxUnregisterExceptionObject
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fputc
fclose
_get_stream_buffer_pointers
__stdio_common_vfprintf_s
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
fgetc
ferror
fwrite
fread
_fseeki64
fgetpos
fsetpos
_getcwd
__stdio_common_vsprintf
ungetwc
fputwc
_fsopen
fseek
setvbuf
fgetwc
ungetc
fopen_s
feof
fopen
fflush
ftell
api-ms-win-crt-string-l1-1-0
strcpy_s
_strdup
api-ms-win-crt-time-l1-1-0
strftime
clock
_time64
_mktime64
_localtime64_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
free
calloc
api-ms-win-crt-multibyte-l1-1-0
_ismbblead
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
_beginthreadex
_controlfp_s
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
abort
_invalid_parameter_noinfo
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_endthreadex
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_setmbcp
msvfw32
ICSendMessage
ICOpen
ICDecompress
ICClose
odbc32
ord36
winmm
timeGetTime
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
shell32
Shell_NotifyIconA
comctl32
InitCommonControlsEx
shlwapi
PathRemoveFileSpecA
ole32
CoInitialize
urlmon
URLDownloadToFileA
opencv_imgcodecs331
cvSaveImage
iphlpapi
GetAdaptersInfo
GetIpAddrTable
ws2_32
ioctlsocket
WSAGetLastError
closesocket
connect
send
WSAAddressToStringA
recv
getaddrinfo
freeaddrinfo
select
setsockopt
htonl
bind
listen
htons
__WSAFDIsSet
WSAAccept
WSAStartup
getpeername
ntohs
shutdown
inet_ntoa
socket
api-ms-win-crt-convert-l1-1-0
atol
atoi
atof
_wtoi
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_chdir
remove
_stat64
_mkdir
_rmdir
_lock_file
mscoree
_CorExeMain
Sections
.text Size: 1015KB - Virtual size: 1014KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 693KB - Virtual size: 692KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ