raserver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

raserver.exe
Size

108KB
MD5

58893b271b5fea2fda87a813e9cd938d
SHA1

c144f42fc259183736f1e827565e1ae92a3c6b4f
SHA256

c6858ebd9b1b077f7861ece82acb3f79f9a4579d542437f0c36964f6ee380422
SHA512

24ea9326f414378b4a64cd17a12838c62ab72f75b40befae6d984ff1bc8af5fe9bd37a1a2ffbd725e96bd9fdff850ec4279cb158bf256c3f259c526f1426730d
SSDEEP

3072:Tl++z+ZysJwhxdpiPtUsfIaq2FXQV30qVz4:pF1nJsthfIaqEXQV31

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
raserver.exe

Files

raserver.exe
.exe windows:10 windows x86

fd21e9f3f02b850ec30431ff4c162756

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
IsValidRelativeSecurityDescriptor
MakeAbsoluteSD
InitializeSecurityDescriptor
InitializeAcl
MakeSelfRelativeSD
IsValidSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
FreeSid
GetSecurityDescriptorDacl
IsValidAcl
GetAclInformation
GetAce
EqualSid
AddAccessDeniedAce
DeleteAce
RegEnumValueW
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CryptGetUserKey
CryptGenKey
CryptExportKey
CryptImportKey
CryptDecrypt
CryptEncrypt
EventWrite
EventUnregister
EventRegister

kernel32

CloseHandle
RaiseException
FindResourceExW
LoadResource
GetProcAddress
GetLastError
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
LoadLibraryW
CreateThread
WaitForSingleObject
GetACP
HeapSetInformation
CompareStringW
GetCommandLineW
SetEvent
GetCurrentThreadId
Sleep
ResetEvent
SetLastError
GetSystemDirectoryW
ResolveDelayLoadedAPI
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
MultiByteToWideChar
CreateEventW
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
SizeofResource
DeleteCriticalSection
DelayLoadFailureHook

user32

PostThreadMessageW
GetMessageW
LoadStringW
DispatchMessageW
UnregisterClassA
CharUpperW
TranslateMessage
CharNextW

msvcrt

__p__fmode
??0exception@@QAE@ABQBD@Z
memmove
_cexit
_exit
__setusermatherr
_initterm
_wcmdln
_errno
realloc
??0exception@@QAE@ABV0@@Z
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_lock
_unlock
__dllonexit
_onexit
_controlfp
_except_handler4_common
wcsncmp
_wtol
iswdigit
exit
__set_app_type
__wgetmainargs
??0exception@@QAE@ABQBDH@Z
_callnewh
memset
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
wcsncpy_s
malloc
free
_purecall
memcpy_s
??_V@YAXPAX@Z
??3@YAXPAX@Z
__p__commode
_XcptFilter
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
_amsg_exit
memcmp

shlwapi

StrCmpIW

oleaut32

RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysAllocStringByteLen
SafeArrayCreateVector
LoadRegTypeLi
LoadTypeLi
SysFreeString
SysStringLen
VarUI4FromStr
SysStringByteLen
VarBstrCmp
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayAccessData
VarBstrCat
SysAllocStringLen

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory

shell32

ShellExecuteW
SHGetSpecialFolderPathW

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

api-ms-win-core-com-l1-1-1

CoWaitForMultipleHandles
CoSuspendClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

samcli

NetLocalGroupDelMembers
NetLocalGroupDel
NetLocalGroupAdd
NetLocalGroupGetInfo
NetLocalGroupGetMembers
NetLocalGroupAddMembers

netutils

NetApiBufferFree

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd21e9f3f02b850ec30431ff4c162756

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

oleaut32

wtsapi32

shell32

crypt32

api-ms-win-core-com-l1-1-1

samcli

netutils

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 6KB - Virtual size: 6KB