Static task
static1
Behavioral task
behavioral1
Sample
BaiduAlgServer.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
BaiduAlgServer.exe
Resource
win10v2004-20231215-en
General
-
Target
BaiduAlgServer.exe
-
Size
550KB
-
MD5
ce2ba79eae0244dbf13dfc282001d4d0
-
SHA1
f841a94c0cc13a72ce2e7a301b89387b4222e299
-
SHA256
9e29a174c5b1df9b8e6f81f198e0b3c2c4fcd3aca406af9f1c4003f6aa69ce20
-
SHA512
38a43c3177ea46e852e795354680adf229b3bcb15c8ed815875b586651d81950687df21297ccc9c09d369e053da96e45e49f4d72af508e41ef44a52fc6f58c5b
-
SSDEEP
6144:FMJMO4x7Z3zoXNF6/mO6w3bHmCyhXCt4cpEudltofznRdVb5YJJT468qcVklDtSu:FMJDM7ZtmEyC5jAFQeVklDtSraZuVY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BaiduAlgServer.exe
Files
-
BaiduAlgServer.exe.exe windows:6 windows x86 arch:x86
7a2a2d6989982e9242e881973b43caef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
opencv_world410d
?deallocate@Mat@cv@@QAEXXZ
?imread@cv@@YA?AVMat@1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?fastFree@cv@@YAXPAX@Z
kernel32
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameA
GetLongPathNameW
CloseHandle
DuplicateHandle
SetHandleInformation
RaiseException
GetLastError
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
Sleep
GetCurrentProcess
TerminateProcess
GetCurrentThread
SetThreadPriority
FindNextFileW
TlsGetValue
TlsSetValue
TlsFree
CreateProcessA
GetVersion
GetSystemTimeAsFileTime
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
GetFileAttributesA
OutputDebugStringA
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetPrivateProfileStringA
CopyFileA
FreeConsole
AllocConsole
FindFirstFileA
FindNextFileA
LoadLibraryA
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
GetModuleFileNameA
HeapAlloc
HeapFree
GetProcessHeap
TlsAlloc
IsBadWritePtr
CreateEventW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
VirtualQuery
SetConsoleCtrlHandler
GetDiskFreeSpaceExA
FreeLibrary
GlobalMemoryStatusEx
GetProcAddress
GetSystemInfo
GlobalFree
GlobalAlloc
user32
CloseWindowStation
SetThreadDesktop
GetThreadDesktop
wsprintfA
CloseDesktop
OpenWindowStationA
OpenDesktopA
SetProcessWindowStation
GetProcessWindowStation
MessageBoxW
MessageBoxA
GetDesktopWindow
advapi32
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetServiceStatus
ole32
CoCreateGuid
msvcp140
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?good@ios_base@std@@QBE_NXZ
??7ios_base@std@@QBE_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?flags@ios_base@std@@QBEHXZ
?rdstate@ios_base@std@@QBEHXZ
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
sqlite3
sqlite3_close
sqlite3_exec
sqlite3_get_table
sqlite3_free
sqlite3_open
sqlite3_errmsg
sqlite3_prepare_v2
sqlite3_bind_blob
sqlite3_step
sqlite3_finalize
sqlite3_column_bytes
sqlite3_column_text
sqlite3_column_int
sqlite3_column_blob
face_sdk
bdface_load_detect
bdface_auth_get_local_info
bdface_feature
bdface_load_feature
bdface_align
bdface_unload_align
bdface_load_align
bdface_detect
bdface_unload_detect
bdface_create_instance
bdface_destroy_img_instance
bdface_create_img_instance
bdface_destroy_instance
bdface_auth_from_file
ws2_32
__WSAFDIsSet
accept
bind
closesocket
connect
ioctlsocket
getsockname
htonl
htons
listen
ntohl
ntohs
recv
select
send
setsockopt
shutdown
gethostbyname
socket
WSAStartup
WSACleanup
getaddrinfo
freeaddrinfo
getnameinfo
gethostname
inet_addr
pdh
PdhGetFormattedCounterValue
PdhAddCounterA
PdhOpenQueryA
PdhEnumObjectItemsA
PdhCollectQueryData
vcruntime140
_purecall
memcmp
memcpy
memmove
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memchr
strchr
strrchr
strstr
__std_terminate
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__std_type_info_destroy_list
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
_register_thread_local_exe_atexit_callback
_beginthread
_beginthreadex
_c_exit
__p___argv
__p___argc
_exit
_wassert
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
strerror
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
system
_seh_filter_dll
_errno
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
abort
exit
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
_fseeki64
_wfopen
ftell
ferror
fgets
_chsize
fwrite
setvbuf
rewind
_fsopen
freopen
fputs
__stdio_common_vswprintf
__stdio_common_vfwprintf
fputws
_fileno
_pclose
_popen
puts
_lseeki64
_read
_pipe
_get_osfhandle
_set_fmode
_close
setbuf
__stdio_common_vsscanf
ungetc
__stdio_common_vfprintf
__stdio_common_vsprintf
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
fseek
fsetpos
fread
__acrt_iob_func
fputc
fopen
fgetpos
fgetc
fclose
fflush
api-ms-win-crt-filesystem-l1-1-0
_findnext64i32
_stat32
_unlink
_findfirst64i32
rename
_access
_rmdir
_stat64i32
remove
_findclose
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
isxdigit
wcscat
strcat
isalnum
strcspn
tolower
isdigit
strncmp
_strnicmp
strlen
strcpy
strcmp
strspn
isspace
isprint
iscntrl
toupper
wcslen
strncpy
strncat
isalpha
_stricmp
isupper
api-ms-win-crt-heap-l1-1-0
calloc
realloc
_set_new_mode
_callnewh
malloc
free
api-ms-win-crt-convert-l1-1-0
mbstowcs_s
atoi
strtoul
_strtoi64
_strtoui64
strtol
_itoa
atof
wcstombs_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
modf
_dtest
_except1
_fdopen
api-ms-win-crt-time-l1-1-0
_gmtime64
_mkgmtime64
strftime
_localtime64
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
Sections
.text Size: 453KB - Virtual size: 452KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ