5db4b15752d0d982558e021088c2fcb9fad3c09aae10e4f132695fe4223d9e9a

Sharing

Copy URL Twitter E-mail

General

Target

5db4b15752d0d982558e021088c2fcb9fad3c09aae10e4f132695fe4223d9e9a
Size

447KB
MD5

f63ef8d8982b85fd16fd422d468a9403
SHA1

69d42bda7be9d97c6cdab7b97f971e0a86205cd5
SHA256

5db4b15752d0d982558e021088c2fcb9fad3c09aae10e4f132695fe4223d9e9a
SHA512

a8ab28c5630e933d23c61a7701b9557370fbf81e785f41b207ca24ac42caec810c8008fc4a067c2f52a328a62d32360589b410616265d3f90e4082683e98e45a
SSDEEP

12288:MkVAOjoXmgv59YDlx41mYXEAXmAljAURDLsTgODzaO:DVGWgv59Il21mY0FqjAURDgTgOD+

Score

N/A

Malware Config

Signatures

Files

5db4b15752d0d982558e021088c2fcb9fad3c09aae10e4f132695fe4223d9e9a
.dll windows x86

62d60651322611b79c7caaf697070a68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

php5

php_strtok_r
file_globals
_php_stream_free
_php_stream_write
php_stream_notification_notify
_zend_hash_add_or_update
_php_stream_read
_zend_hash_index_update_or_next_insert
_php_stream_fopen_tmpfile
_php_stream_alloc
php_stream_context_set
_php_stream_tell
php_trim
_php_stream_temp_create
zend_hash_find
php_stream_context_get_option
zend_rebuild_symbol_table
_php_stream_seek
_zval_dtor_func
zend_llist_get_next_ex
zend_llist_del_element
zend_llist_get_first_ex
add_assoc_resource_ex
php_file_le_pstream
add_assoc_long_ex
zend_register_list_destructors_ex
zend_call_function
gc_remove_zval_from_buffer
php_info_print_table_end
zend_register_ini_entries
php_file_le_stream
_array_init
_php_stream_flush
_convert_to_string
zend_hash_get_current_key_ex
empty_fcall_info_cache
php_output_write
add_assoc_double_ex
php_info_print_table_start
_zval_ptr_dtor
_efree
_zval_copy_ctor_func
spprintf
add_next_index_string
add_assoc_zval_ex
_emalloc
_ecalloc
executor_globals
convert_to_long
zend_ini_string_ex
add_next_index_zval
_estrdup
zval_add_ref
zend_llist_init
zend_register_resource
add_assoc_string_ex
zend_register_long_constant
zend_hash_move_forward_ex
php_error_docref0
core_globals
php_sprintf
zend_parse_parameters
zend_fetch_resource
php_check_open_basedir
zend_hash_internal_pointer_reset_ex
_zend_list_addref
php_info_print_table_row
zend_llist_clean
_zend_list_delete
_erealloc
_estrndup
zend_hash_get_current_data_ex
_php_stream_cast
zend_llist_add_element
zend_unregister_ini_entries

ws2_32

gethostname
ioctlsocket
__WSAFDIsSet
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
WSASetLastError
connect
socket
closesocket
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
WSAStartup
WSACleanup
select

libeay32

ord1336
ord123
ord498
ord315
ord509
ord399
ord1935
ord2034
ord1335
ord1334
ord497
ord495
ord396
ord400
ord110
ord256
ord3889
ord276
ord2720
ord2862
ord2644
ord275
ord3019
ord3819
ord3874
ord961
ord258
ord213
ord486
ord150
ord118
ord464
ord209
ord484
ord316
ord268
ord269
ord267
ord333
ord963
ord964
ord965
ord2784
ord140
ord341
ord342
ord340
ord156
ord111
ord161
ord323
ord1252
ord304
ord1
ord641
ord391
ord983
ord329
ord294
ord2996
ord3155
ord2927
ord82
ord2254
ord466
ord467
ord2454
ord680
ord281
ord280
ord653
ord654
ord7
ord656
ord151
ord120
ord421
ord544
ord542
ord66
ord52
ord2431
ord78
ord95
ord657
ord1015
ord2291
ord3212
ord1180
ord18
ord254
ord224
ord2604
ord298
ord979
ord248
ord556
ord625
ord223
ord227
ord958
ord2596
ord222
ord1958
ord181
ord2442
ord188
ord1951
ord566
ord578
ord579
ord1216
ord2023
ord2075
ord1653
ord1654

ssleay32

ord30
ord87
ord90
ord45
ord21
ord78
ord58
ord96
ord180
ord86
ord141
ord15
ord6
ord243
ord8
ord12
ord108
ord77
ord242
ord61
ord5
ord157
ord48
ord60
ord126
ord49
ord75
ord24
ord31
ord222
ord17
ord235
ord183
ord74
ord76
ord43
ord127
ord130
ord172
ord110
ord116

wldap32

ord46
ord41
ord27
ord301
ord33
ord200
ord79
ord35
ord32
ord30
ord26
ord50
ord60
ord143
ord211
ord22

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetLastError
FormatMessageA
SetLastError
GetFileType
GetStdHandle
Sleep
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
PeekNamedPipe
ReadFile
WaitForSingleObject
CloseHandle
GetTickCount
SleepEx
EnterCriticalSection
WaitForMultipleObjects

msvcr90

memset
_open
_fileno
_close
_strdup
_stricmp
_strnicmp
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
isgraph
isprint
isupper
islower
feof
fgetc
rewind
_difftime64
_snprintf
isalpha
_gmtime64
getenv
_lseeki64
strstr
__iob_func
_fstat64
strspn
strpbrk
isalnum
memchr
fflush
strncpy
_beginthreadex
isspace
fputc
sprintf
isdigit
fputs
qsort
fgets
strncmp
_strtoi64
fseek
memmove
strtoul
isxdigit
strchr
sscanf
fread
fwrite
atoi
strtol
calloc
realloc
free
malloc
_read
memcpy
_stat64
strrchr
fclose
fopen
strerror
__sys_nerr
_time64
_errno
tolower

Exports

Exports

get_module
libssh2_banner_set
libssh2_base64_decode
libssh2_channel_close
libssh2_channel_direct_tcpip_ex
libssh2_channel_eof
libssh2_channel_flush_ex
libssh2_channel_forward_accept
libssh2_channel_forward_cancel
libssh2_channel_forward_listen_ex
libssh2_channel_free
libssh2_channel_get_exit_signal
libssh2_channel_get_exit_status
libssh2_channel_handle_extended_data
libssh2_channel_handle_extended_data2
libssh2_channel_open_ex
libssh2_channel_process_startup
libssh2_channel_read_ex
libssh2_channel_receive_window_adjust
libssh2_channel_receive_window_adjust2
libssh2_channel_request_pty_ex
libssh2_channel_request_pty_size_ex
libssh2_channel_send_eof
libssh2_channel_set_blocking
libssh2_channel_setenv_ex
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_window_read_ex
libssh2_channel_window_write_ex
libssh2_channel_write_ex
libssh2_channel_x11_req_ex
libssh2_exit
libssh2_free
libssh2_hostkey_hash
libssh2_init
libssh2_keepalive_config
libssh2_keepalive_send
libssh2_knownhost_add
libssh2_knownhost_addc
libssh2_knownhost_check
libssh2_knownhost_checkp
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_get
libssh2_knownhost_init
libssh2_knownhost_readfile
libssh2_knownhost_readline
libssh2_knownhost_writefile
libssh2_knownhost_writeline
libssh2_poll
libssh2_poll_channel_read
libssh2_scp_recv
libssh2_scp_send64
libssh2_scp_send_ex
libssh2_session_abstract
libssh2_session_block_directions
libssh2_session_callback_set
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_get_blocking
libssh2_session_get_timeout
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_methods
libssh2_session_set_blocking
libssh2_session_set_timeout
libssh2_session_startup
libssh2_sftp_close_handle
libssh2_sftp_fstat_ex
libssh2_sftp_fstatvfs
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_tell
libssh2_sftp_tell64
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_trace
libssh2_trace_sethandler
libssh2_userauth_authenticated
libssh2_userauth_hostbased_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey
libssh2_userauth_publickey_fromfile_ex

Sections

.text
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62d60651322611b79c7caaf697070a68

Headers

DLL Characteristics

File Characteristics

Imports

php5

ws2_32

libeay32

ssleay32

wldap32

kernel32

msvcr90

Exports

Exports

Sections

.text Size: 343KB - Virtual size: 343KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 343KB - Virtual size: 343KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB