get_module
Static task
static1
Behavioral task
behavioral1
Sample
b348fde36068b1706e6c83c5dc7900d24920e536829ba598760f137e1a907f7c.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b348fde36068b1706e6c83c5dc7900d24920e536829ba598760f137e1a907f7c.dll
Resource
win10v2004-20220812-en
General
-
Target
b348fde36068b1706e6c83c5dc7900d24920e536829ba598760f137e1a907f7c
-
Size
572KB
-
MD5
52fc1b0433bc00e33dc62d3dd81e0890
-
SHA1
2d76ff764ab46f2b4615dac3d7cb0a371e1973fd
-
SHA256
b348fde36068b1706e6c83c5dc7900d24920e536829ba598760f137e1a907f7c
-
SHA512
a6da4e15d7194e1f0fd046139b1521dd344d2e8ccc3081571dcf3855d4ead4fee550c0a17e036d5cbfb867e9bc2fdab4e6df8fe2f76c2ad34265fc4ca073af73
-
SSDEEP
6144:NGqJLrhrSvfSAzI23ekFgFhMyzfhkKiQJUwBG07HVm+0HxRBdOdlzeY:DthANzI23eHF9eKiKUwl71mRBd24Y
Malware Config
Signatures
Files
-
b348fde36068b1706e6c83c5dc7900d24920e536829ba598760f137e1a907f7c.dll windows x86
fd30b8a0759f14546201506f244498a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
php5ts
xmlCopyDoc
_zval_copy_ctor_func
valuePush
_zend_hash_add_or_update
zend_parse_method_parameters
zend_hash_get_current_key_ex
virtual_fopen
_convert_to_string
xmlNodeSetBase
_array_init
xmlXPathFreeObject
zend_hash_num_elements
gc_remove_zval_from_buffer
zend_call_function
zend_ini_long
xmlStrEqual
php_libxml_import_node
zend_hash_exists
php_libxml_increment_doc_ref
_safe_emalloc
_zval_dtor_func
php_info_print_table_start
_zval_ptr_dtor
_efree
zend_get_std_object_handlers
_emalloc
zend_hash_destroy
zend_new_interned_string
zval_add_ref
zend_hash_del_key_or_index
instanceof_function
_zend_hash_index_update_or_next_insert
dom_node_class_entry
executor_globals_id
zend_lookup_class
zend_wrong_param_count
convert_to_long
xmlXPathNewBoolean
add_next_index_zval
xmlNewDocNode
php_libxml_increment_node_ptr
zend_parse_parameters_ex
xmlXPathNewNodeSet
xmlDocGetRootElement
__xmlLoadExtDtdDefaultValue
xmlXPathCastToString
dom_object_get_node
xmlFreeDoc
zend_error
zend_hash_move_forward_ex
php_error_docref0
zend_make_callable
zend_object_store_get_object
xmlStrdup
zend_parse_parameters
ts_resource_ex
xmlXPathNewString
xmlSubstituteEntitiesDefault
zend_hash_find
php_check_open_basedir
zend_hash_internal_pointer_reset_ex
xmlStrlen
zend_is_executing
_estrndup
zend_hash_get_current_data_ex
xmlFree
xmlStrchr
php_dom_create_object
valuePop
zend_get_class_entry
zend_objects_store_put
php_info_print_table_end
zend_strndup
zend_register_ini_entries
zend_register_string_constant
xmlNewNs
zend_object_std_init
xmlMalloc
xmlHashAddEntry2
xmlHashCreate
xmlXPathRegisterFuncNS
xmlHashFree
xmlHashAddEntry
xmlMutexUnlock
xmlHashLookup
xmlMutexLock
xmlHashScan
xmlHashUpdateEntry2
xmlHashLookup2
xmlHashRemoveEntry2
xmlAddChild
xmlNewComment
xmlNewMutex
xmlFreeMutex
xmlHashScanFull
xmlRealloc
__xmlGenericErrorContext
__xmlGenericError
xmlNewRMutex
xmlFreeRMutex
xmlDictFree
xmlSearchNs
xmlValidateQName
xmlStrndup
xmlGetNsProp
xmlNodeGetSpacePreserve
xmlNodeSetContent
xmlDictLookup
xmlDictOwns
xmlFreeNode
xmlUnlinkNode
xmlHashUpdateEntry
xmlSearchNsByHref
xmlAddPrevSibling
xmlStringTextNoenc
php_libxml_decrement_doc_ref
xmlXPathStringEvalNumber
xmlStrcasecmp
xmlDictCreate
xmlDictReference
xmlBuildURI
xmlNodeGetBase
xmlDocCopyNode
xmlNewDoc
xmlFreeURI
xmlGetID
xmlParseURI
xmlNodeListGetString
xmlGetDtdAttrDesc
xmlGetProp
xmlGetLineNo
xmlXPathCmpNodes
xmlXPathConvertNumber
xmlXPathConvertString
xmlXPathCompiledEval
xmlStrcmp
xmlXPathIsNaN
xmlNodeDumpOutput
xmlGetCharEncodingName
xmlOutputBufferWriteString
htmlDocContentDumpOutput
xmlOutputBufferFlush
htmlDocContentDumpFormatOutput
htmlSetMetaEncoding
xmlOutputBufferClose
xmlFindCharEncodingHandler
xmlOutputBufferCreateFilename
xmlOutputBufferCreateFile
xmlAllocOutputBuffer
xmlNewChild
xmlXPathFreeContext
xmlXPathCtxtCompile
xmlXPathNewContext
xmlNodeAddContent
xmlStringText
xmlNewTextLen
xmlNewCDataBlock
xmlSetNsProp
xmlNewNsProp
xmlGetNsList
xmlNewDocText
xmlStrstr
xmlNewDocPI
xmlCreateIntSubset
xmlIsBlankNode
xmlDictQLookup
htmlNewDoc
htmlNewDocNoDtD
xmlURIEscapeStr
xmlXPathFreeCompExpr
xmlXPathCompile
xmlNewDocNodeEatName
xmlXPathCompiledEvalToBoolean
xmlXPathFreeNodeSet
xmlXPathNodeSetAddUnique
xmlXPathNodeSetCreate
xmlXPathOrderDocElems
xmlXPathRegisterFuncLookup
xmlXPathRegisterVariableLookup
xmlXPathContextSetCache
xmlXPathInit
xmlDictCreateSub
xmlFreeDtd
xmlGetIntSubset
xmlParserGetDirectory
xmlCreateURI
xmlRMutexUnlock
xmlRMutexLock
xmlXPathDebugDumpObject
xmlStrncat
xmlStrcat
xmlFreeRefTable
xmlFreeIDTable
xmlFreeNodeList
xmlXPathNewValueTree
xmlXPathNewCString
xmlXPathObjectCopy
xmlParseDocument
inputPush
xmlFreeParserCtxt
xmlLoadExternalEntity
xmlCtxtUseOptions
xmlNewParserCtxt
xmlXIncludeProcessFlags
xmlStrncasecmp
xmlAddID
xmlIsID
xmlNewText
xmlHasNsProp
xmlXPathEval
xmlStringCurrentChar
xmlIsExtenderGroup
xmlIsCombiningGroup
xmlIsDigitGroup
xmlCharInRange
xmlIsBaseCharGroup
xmlXPathIsNodeType
xmlHashUpdateEntry3
xmlHashLookup3
xmlHashAddEntry3
xmlXPathNodeSetAdd
xmlXPathCastNodeToString
xmlXPathEvalPredicate
xmlNodeGetContent
xmlNewDocProp
xmlStrncmp
xmlBufferCat
xmlCopyCharMultiByte
xmlBufferCCat
xmlXPathIsInf
xmlXPathFreeParserContext
xmlXPathNextAncestor
xmlXPathNextPrecedingSibling
xmlXPathNewParserContext
xmlBufferFree
xmlXPathEvalExpression
xmlBufferContent
xmlBufferCreate
xmlBufferAdd
xmlUTF8Strpos
xmlUTF8Strloc
xmlXPtrEval
xmlXPtrNewContext
xmlSaveUri
xmlXPathNodeSetMerge
xmlXPathStringFunction
xmlXPathWrapNodeSet
xmlXPathNsLookup
xmlSplitQName2
xmlGetDocEntity
xmlXPathNumberFunction
xmlXPathErr
xmlXPathFunctionLookupNS
xmlXPathRegisterFunc
xmlXPathPopString
xmlXPathCastNumberToString
xmlXPathNodeSetSort
xmlXPathPopNodeSet
xmlXPatherror
xmlXPathWrapExternal
xmlXPathPopExternal
xmlXPathNewFloat
xmlXPathNAN
xmlXPathWrapString
xmlXPathCastStringToNumber
xmlUTF8Charcmp
xmlNewDocRawNode
xmlUTF8Size
xmlXPathPopBoolean
xmlUTF8Strlen
xmlCheckUTF8
xmlURIUnescapeString
xmlUTF8Strndup
xmlXPathPopNumber
xmlUTF8Strsize
xmlBufferLength
xmlDebugDumpNode
xmlXPathDifference
xmlXPathIntersection
xmlXPathDistinctSorted
xmlXPathHasSameNodes
xmlXPathNodeLeadingSorted
xmlXPathNodeTrailingSorted
xmlXPathCastNodeToNumber
xmlStrsub
object_properties_init
zend_objects_get_address
zend_object_std_dtor
zend_register_long_constant
zend_register_internal_class_ex
zend_objects_destroy_object
_zend_hash_init
_object_init_ex
php_info_print_table_row
ap_php_snprintf
php_libxml_error_handler
xmlValidateNCName
zend_unregister_ini_entries
kernel32
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentProcessId
EnumSystemLocalesA
GetLocaleInfoA
CompareStringW
MultiByteToWideChar
GetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
msvcr90
_except_handler4_common
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_vsnprintf
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_CIexp
_CIatan2
_CIatan
_CIacos
_CIasin
_CItan
_CIcos
_CIsin
_CIlog
_CIsqrt
rand
_time64
_localtime64
_gmtime64
_CIpow
floor
_CIfmod
_snprintf
sscanf
_mkdir
_stat64i32
fopen
memcpy
sprintf
vfprintf
memset
__iob_func
fprintf
fclose
_onexit
Exports
Exports
Sections
.text Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 357KB - Virtual size: 360KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE