php-win[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

php-win.exe
Size

32KB
MD5

a8c71a4016552d41149be579bbd9b6d5
SHA1

633b19344d9131e81f4cf1b19899eba64e7cb558
SHA256

a7532febd1061e30187ac8c180b71cef5eb979a763b2ad0c922fb0c94ee44ff7
SHA512

a54c4ddda0b6068ba89a4e2b046570d1474728dccc04048656fb9d066450c5d01852973f2657c83bf4762d047c6761d9dc77a3ef25983cdf6992799a36dbd25e
SSDEEP

384:OCPz75OVTkQ9ENE7932J1nH6UFBUz55KqTeBoiQ6KDsKb:OS9QkQ9fgb0X7TQQJb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
php-win.exe

Files

php-win.exe
.exe windows x86

63a94c9ef04df7b752966a4b241864fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

php5ts

php_printf
php_print_info
php_end_ob_buffers
php_request_startup
php_body_write
compiler_globals_id
executor_globals_id
sapi_startup
ts_resource_ex
tsrm_startup
zend_hash_destroy
zend_hash_apply
zend_hash_sort
get_zend_version
zend_hash_copy
_zend_hash_init
zend_llist_destroy
zend_llist_apply
zend_llist_sort
zend_llist_copy
zend_extensions
zend_strndup
_php_stream_free
zend_register_constant
_php_stream_open_wrapper_ex
virtual_fopen
sapi_module
zend_load_extension
sapi_deactivate
zend_ini_deactivate
zend_is_auto_global
core_globals_id
php_execute_script
php_lint_script
zend_printf
open_file_for_scanning
zend_strip
php_get_highlight_struct
zend_highlight
zend_eval_string_ex
_emalloc
_zend_hash_add_or_update
_php_stream_get_line
_estrndup
reflection_extension_ptr
reflection_class_ptr
reflection_method_ptr
reflection_function_ptr
_object_init_ex
zend_call_method
_zval_ptr_dtor
zend_exception_get_default
zend_read_property
reflection_ptr
zend_str_tolower_copy
module_registry
zend_hash_find
display_ini_entries
php_info_print_module
php_ini_opened_path
php_ini_scanned_files
php_request_shutdown
php_module_shutdown
sapi_shutdown
tsrm_shutdown
php_module_startup
_efree
sapi_globals_id
php_import_environment_variables
php_register_variable
php_module_shutdown_wrapper
zend_qsort
zend_error

msvcrt

_strdup
_stricmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
fgetc
ftell
fseek
rewind
strrchr
_setjmp3
__p___argc
__p___argv
_fmode
malloc
strchr
__mb_cur_max
_isctype
_pctype
realloc
printf
fclose
strstr
getenv
exit
free
fprintf
fflush
_errno
fwrite
_iob
_setmode

kernel32

GetStartupInfoA
GetModuleHandleA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63a94c9ef04df7b752966a4b241864fb

Headers

File Characteristics

Imports

php5ts

msvcrt

kernel32

Sections

.text Size: 12KB - Virtual size: 8KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 220B

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 12KB - Virtual size: 8KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 220B

.rsrc
Size: 4KB - Virtual size: 2KB