Static task
static1
Behavioral task
behavioral1
Sample
php-cgi.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
php-cgi.exe
Resource
win10v2004-20230220-en
General
-
Target
php-cgi.exe
-
Size
40KB
-
MD5
607800f2579fc1fa3e4b1d52423c842d
-
SHA1
0dee8b4dd23a7bfab62ed6dfd39241ea4ed57619
-
SHA256
c2c8caec7a7d7867174c0cf2e2129554a8ed062dc1d9b3217c4097a421922084
-
SHA512
f099e2fd61f31eb052bb181a3751c347e260fc5c4ecaa6d8a9406963c3d60ecbd173a2b882b658686ef7ff4e90dfd7478a5e8de8af2ab9f167e058e1aa8c94a4
-
SSDEEP
768:c/cQaZ4fGufj4z/RNcZ+F8mka/hxS7RXD4Qym:cEZkG8j4zkPm1b+XD4Vm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource php-cgi.exe
Files
-
php-cgi.exe.exe windows x86
276999c788817f6b2d535fdbffc67ca4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
php5ts
zend_hash_del_key_or_index
zend_hash_find
_erealloc
zend_strndup
_zend_hash_add_or_update
php_sprintf
zend_hash_exists
tsrm_realpath
php_handle_auth_data
zend_extensions
zend_llist_copy
zend_llist_sort
zend_llist_apply_with_argument
zend_llist_destroy
_zend_hash_init
module_registry
zend_hash_copy
zend_qsort
zend_hash_sort
zend_hash_apply_with_argument
zend_hash_destroy
tsrm_startup
sapi_startup
tsrm_shutdown
php_body_write
executor_globals_id
compiler_globals_id
php_output_startup
php_output_activate
php_end_ob_buffers
_estrdup
zend_load_extension
php_strlcat
php_request_startup
php_check_open_basedir
php_fopen_primary_script
php_execute_script
php_lint_script
zend_printf
open_file_for_scanning
php_get_highlight_struct
zend_highlight
php_request_shutdown
php_printf
php_module_shutdown
php_print_info
get_zend_version
sapi_shutdown
zend_strip
display_ini_entries
zend_unregister_ini_entries
ts_allocate_id
zend_register_ini_entries
php_module_startup
ts_resource_ex
_emalloc
php_import_environment_variables
_efree
core_globals_id
zend_hash_num_elements
_zval_dtor_func
_zval_copy_ctor_func
zend_hash_internal_pointer_reset_ex
zend_hash_get_current_key_ex
zend_hash_get_current_data_ex
sapi_module
php_register_variable_safe
zend_hash_move_forward_ex
php_header_write
ap_php_slprintf
zend_llist_get_first_ex
zend_llist_get_next_ex
sapi_globals_id
php_handle_aborted_connection
php_module_shutdown_wrapper
zend_error
OnUpdateBool
OnUpdateString
ws2_32
shutdown
listen
bind
setsockopt
socket
htonl
gethostbyname
inet_addr
htons
WSAGetLastError
recv
closesocket
inet_ntoa
accept
send
kernel32
ReleaseMutex
CreateEventA
ConnectNamedPipe
GetLastError
CloseHandle
DisconnectNamedPipe
GetNamedPipeInfo
CreateNamedPipeA
WaitForSingleObject
GetStdHandle
FlushFileBuffers
CreateThread
SetNamedPipeHandleState
advapi32
RevertToSelf
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateNamedPipeClient
msvcrt
strncpy
strncmp
_open_osfhandle
strerror
strstr
strrchr
_setjmp3
_fmode
__mb_cur_max
_isctype
_pctype
realloc
atoi
printf
_get_osfhandle
fgetc
ftell
fseek
rewind
fclose
exit
malloc
free
fprintf
getenv
strchr
fflush
fwrite
_iob
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_strnicmp
_read
_strdup
_setmode
_stricmp
_stat
_putenv
_errno
_write
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 852B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ