Static task
static1
Behavioral task
behavioral1
Sample
php-cgi.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
php-cgi.exe
Resource
win10v2004-20230220-en
General
-
Target
php-cgi.exe
-
Size
42KB
-
MD5
11dd92ea47ca981f412ee01437e5d146
-
SHA1
d02cb62b433a9c0cf76dcd100cfcdd2b3af258c9
-
SHA256
9cf8fc7a303aaf3c8244280189d640c8a0efcceebeba67ae2aa41f53999e63c3
-
SHA512
6938475dadc38adb3061f555c5955d2ac633606e55c6467ab0c165f068dd946b87314d31cfda389f0b9772a11057e365c703d03fcbcd3d536ccd8c2ecad2afca
-
SSDEEP
768:SkwCnBANDZy6PE2XmGALa5znZMdY5CUvYhuWrMNqEap+fxuBwOo25:JlnH6cfGAe5NM65CVzMhap+fx8jo2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource php-cgi.exe
Files
-
php-cgi.exe.exe windows x86
80940abfc12fa5262aae53858513d4e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
php5
zend_strndup
zend_hash_del_key_or_index
_erealloc
sapi_startup
php_getopt
executor_globals
php_body_write
php_output_startup
php_output_activate
php_end_ob_buffers
gettimeofday
compiler_globals
zend_load_extension
php_strlcat
php_request_startup
php_fopen_primary_script
php_execute_script
php_lint_script
zend_printf
open_file_for_scanning
php_get_highlight_struct
zend_highlight
php_request_shutdown
php_module_shutdown
php_print_info
get_zend_version
sapi_shutdown
zend_strip
zend_file_handle_dtor
display_ini_entries
zend_unregister_ini_entries
zend_register_ini_entries
_estrdup
php_handle_auth_data
php_module_startup
php_ini_has_per_host_config
_estrndup
zend_str_tolower
php_ini_activate_per_host_config
php_ini_has_per_dir_config
zend_dirname
php_ini_activate_per_dir_config
sapi_get_request_time
zend_hash_find
config_zval_dtor
_zend_hash_add_or_update
zend_hash_clean
tsrm_realpath
php_parse_user_ini_file
php_ini_activate_config
php_import_environment_variables
_emalloc
_efree
core_globals
zend_hash_num_elements
zend_hash_internal_pointer_reset_ex
zend_hash_get_current_key_ex
zend_hash_get_current_data_ex
sapi_module
php_register_variable_safe
zend_hash_move_forward_ex
zend_llist_get_first_ex
php_header_write
ap_php_slprintf
zend_llist_get_next_ex
php_handle_aborted_connection
sapi_globals
zend_extensions
zend_llist_copy
zend_llist_sort
zend_llist_apply_with_argument
zend_llist_destroy
_zend_hash_init
module_registry
zend_hash_copy
zend_qsort
zend_hash_sort
zend_hash_apply_with_argument
php_printf
zend_hash_destroy
_zval_copy_ctor_func
_zval_dtor_func
php_module_shutdown_wrapper
zend_error
zif_dl
OnUpdateBool
OnUpdateString
ws2_32
inet_addr
gethostbyname
htonl
socket
setsockopt
bind
listen
accept
inet_ntoa
shutdown
closesocket
recv
send
WSAGetLastError
htons
kernel32
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetCurrentThreadId
InterlockedExchange
CreateEventA
ReleaseMutex
CreateThread
SetNamedPipeHandleState
GetStdHandle
CreateNamedPipeA
GetCurrentProcessId
GetSystemTimeAsFileTime
ConnectNamedPipe
GetLastError
CloseHandle
FlushFileBuffers
DisconnectNamedPipe
GetNamedPipeInfo
Sleep
WaitForSingleObject
advapi32
SetSecurityDescriptorDacl
ImpersonateNamedPipeClient
RevertToSelf
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
msvcr90
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
strncpy
_open_osfhandle
strerror
memset
_get_osfhandle
__setusermatherr
_fmode
_fileno
isalnum
realloc
printf
_errno
fgetc
ftell
fseek
rewind
strncmp
atol
strstr
strrchr
isalpha
memcpy
getenv
strchr
atoi
fflush
fwrite
free
_stat32
malloc
__iob_func
fprintf
exit
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_stricmp
_strnicmp
_read
_putenv
_strdup
_setmode
_setjmp3
_write
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ