Static task
static1
Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
server.exe
Resource
win10v2004-20231025-en
General
-
Target
server.exe
-
Size
131KB
-
MD5
05bb242cdd01b528cdde29d6c216688e
-
SHA1
3b10c68f5e6358a04be047230d19f2ddd6005767
-
SHA256
d0d3660b554b88d89abd1c7d379f0aaefaeff077bb3adbcc5608679d87a1b7ca
-
SHA512
f0c9235e4af1e831cf1f247a2b3d9c4680c6454a3ff1d920f2c03d9ba6ec66c7eb752ec7a35b7a5bb5e0a583791ca63b843ac8e6143e93c1738572a75ee553b1
-
SSDEEP
1536:DAiricn/9FjGRwck/6O4hd5UOocQt88vOZHMYhU4TFPJ:Ddricn/jS7VVhd5UOYtNvosK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource server.exe
Files
-
server.exe.exe windows:4 windows x86
e69cf7806dbf28b87b5b3a423c26faa7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CancelIo
CloseHandle
CreateEventA
CreateFileA
CreateNamedPipeA
CreateProcessA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetLastError
GetModuleHandleA
GetOverlappedResult
GetProcAddress
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LocalFree
MultiByteToWideChar
ReadFile
ResetEvent
SetConsoleCtrlHandler
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TerminateProcess
WaitForMultipleObjects
WideCharToMultiByte
WriteFile
msvcrt
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_onexit
_setmode
atexit
calloc
exit
fprintf
fputc
fputs
free
fwrite
getenv
localeconv
malloc
memcmp
memcpy
memmove
memset
rand
realloc
signal
strlen
time
vfprintf
wcslen
ws2_32
WSAAddressToStringA
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
htonl
listen
ntohl
ntohs
recv
send
setsockopt
socket
wtsapi32
WTSFreeMemory
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelQuery
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 448B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/35 Size: 30KB - Virtual size: 30KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/47 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/61 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/73 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/86 Size: 512B - Virtual size: 72B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/97 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/108 Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ