Behavioral task
behavioral1
Sample
server.exe
Resource
win10v2004-20231020-en
General
-
Target
server.exe
-
Size
66.9MB
-
MD5
7f559c6fec19ac71ae9bea5dfd4041bd
-
SHA1
eeadcfa61e9fac2bcf2609d70e82b8fcc568a864
-
SHA256
69ad944900232a07ad37dbb9a31ae7727c181d0c34ea65d6b54ad03676f420c9
-
SHA512
b2dd0591518779e5b9e24c0666684eeb2d72eaf20d0bd2942e5100c38b25f7f526581a0e9b77fbca97c404eee8bab985b5b53e7e5c7b6ce7651a4d199322a87f
-
SSDEEP
1572864:j7RTW5JzDBWIStE585HZRGsVAmMRuwBrWsv:j7hYn0ISjVu02Rue
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule sample pyinstaller -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource server.exe
Files
-
server.exe.exe windows:5 windows x64
88381b84da56810b869e897e6d45bd58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
EnumChildWindows
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.bxpck Size: 29.2MB - Virtual size: 29.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.main Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
server.pyc