Static task
static1
Behavioral task
behavioral1
Sample
OoklaServer.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
OoklaServer.exe
Resource
win10v2004-20231020-en
General
-
Target
OoklaServer.exe
-
Size
5.6MB
-
MD5
1a6e9da331fb622623f10d93273b65dc
-
SHA1
bd0bdf54aeba4361fafbb535c88ce9b6c7b1abd7
-
SHA256
8e749238670b3046f5538e0f78b8b451e2c94bb4d378e56210960ccb4b4e5dbd
-
SHA512
3bd75370a992bc21c9c51dab99b3a624a3f0017beb7ce85b5b9ddaafa2ce600e6baff2b66a391eb97d87a3ada2c167be1aae37af13308852ae266921ac54d070
-
SSDEEP
49152:9fVwASOwGtlqPqIU6iZOeOGCzQS/prEGqr7CNH2work9swJU5FVvTxV4DwYEQsg9:+9+Hm/RewJoj1sqt0QEE2kBUIwpE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OoklaServer.exe
Files
-
OoklaServer.exe.exe windows:6 windows x64
75768fcfc185763d404417ff69c336c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
ntohs
getservbyname
WSAStartup
WSASetLastError
WSAPoll
WSASendTo
WSASend
WSARecvFrom
WSARecv
socket
shutdown
setsockopt
sendto
send
recvfrom
recv
listen
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
ntohl
inet_addr
freeaddrinfo
getaddrinfo
gethostname
WSAGetLastError
WSACleanup
htons
bcrypt
BCryptGenRandom
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
kernel32
GetNativeSystemInfo
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateThread
CreateSemaphoreA
FreeLibrary
LoadLibraryA
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
GetLastError
GetVersionExW
GetStdHandle
SetConsoleCtrlHandler
GetModuleFileNameW
LocalFree
GetProcAddress
LoadLibraryW
InitializeCriticalSectionAndSpinCount
GetCurrentDirectoryW
GetLongPathNameW
GetTempPathW
GetSystemDirectoryW
WideCharToMultiByte
CreateDirectoryW
CreateFileW
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
SetFilePointer
CopyFileW
MoveFileExW
DuplicateHandle
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LockResource
GetConsoleWindow
GetSystemTimeAsFileTime
CreateEventW
FindResourceA
SetThreadPriority
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReleaseMutex
CreateMutexW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
WaitForMultipleObjects
GetEnvironmentVariableW
SetEnvironmentVariableW
GetSystemInfo
GetComputerNameW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
WriteFile
FormatMessageW
LoadLibraryExW
FindClose
FindFirstFileW
FindNextFileW
CreatePipe
GetTimeZoneInformation
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FlushFileBuffers
SetLastError
RtlUnwind
SystemTimeToFileTime
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
MultiByteToWideChar
GetFileType
GetModuleHandleW
ConvertFiberToThread
ConvertThreadToFiber
RtlVirtualUnwind
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualFree
VirtualProtect
LoadResource
Sleep
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
SizeofResource
UnregisterWaitEx
CreateTimerQueue
RtlUnwindEx
RtlPcToFileHeader
RaiseException
ExitProcess
SetCurrentDirectoryW
ExitThread
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
GetFullPathNameW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
OpenProcess
GetSystemTime
SwitchToThread
GetTickCount
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeSListHead
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualAlloc
user32
GetUserObjectInformationW
GetProcessWindowStation
LoadStringA
MessageBoxW
advapi32
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
ChangeServiceConfigW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegCloseKey
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 107KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 205KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ