64ed16c64eae2a9c70cbe7fa336a657fa21e644f546904ae25e3ab29c3ca6f8d

Sharing

Copy URL

Twitter E-mail

General

Target

64ed16c64eae2a9c70cbe7fa336a657fa21e644f546904ae25e3ab29c3ca6f8d
Size

29KB
MD5

cdd5f9a3ab0b4e34d156971e64437306
SHA1

bf8904b4470bbadd72c16e7b5d6618f5e3d92ea4
SHA256

64ed16c64eae2a9c70cbe7fa336a657fa21e644f546904ae25e3ab29c3ca6f8d
SHA512

39e7ecdaad3fbfb474d304587e9449f98540eb3117b9382f11e2571b2167956a8208b4fe80a3e7930dc7d0b6e5fdb9317144a546580031582891faea8ce423ca
SSDEEP

768:nMsT0qAL7YrzY0v0ghNPvaZFmnSMLCOD3:MB2rk08QNPS+nSMLCOD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64ed16c64eae2a9c70cbe7fa336a657fa21e644f546904ae25e3ab29c3ca6f8d

Files

64ed16c64eae2a9c70cbe7fa336a657fa21e644f546904ae25e3ab29c3ca6f8d
.dll windows x86

593664a2388ae46e8400ab3b0b82d94d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

php8ts

zend_hash_find@@8
php_module_shutdown_wrapper
zend_restore_ini_entry
sapi_send_headers
php_get_highlight_struct
php_execute_script
php_handle_aborted_connection
_zend_bailout
php_request_startup
_estrdup@@4
zend_error
php_handle_auth_data
php_tsrm_startup
tsrm_get_ls_cache
php_request_shutdown
zend_ini_deactivate
zend_memory_peak_usage
php_register_variable_safe
core_globals_offset
zend_stream_init_filename
sapi_get_default_content_type
sapi_startup
php_module_startup
highlight_file
zend_execute_scripts
zend_destroy_file_handle
ts_resource_ex
tsrm_shutdown
sapi_module
sapi_shutdown
ap_php_snprintf
php_info_print_table_start
_efree@@4
php_header
php_output_write
php_info_print_table_header
zend_wrong_parameters_none_error@@0
display_ini_entries
php_error_docref
zend_unregister_ini_entries_ex
add_next_index_stringl
sapi_globals_offset
_zend_new_array@@4
zend_parse_parameters
zend_ini_boolean_displayer_cb
executor_globals_offset
smart_str_erealloc@@8
add_property_long_ex
ts_allocate_id
php_info_print_table_end
php_output_end_all
php_info_print_table_row
add_next_index_string
zend_register_ini_entries_ex
add_property_string_ex
add_assoc_string_ex
php_info_print_table_colspan_header
object_init
OnUpdateBool
_emalloc@@4
zend_hash_add@@12
zend_hash_str_update@@16
_zend_hash_init@@16
zend_alter_ini_entry_chars
__zend_malloc
zend_hash_destroy@@4
zend_hash_merge_ex@@20

libhttpd

_ap_sub_req_lookup_uri@12
_ap_get_server_banner@0
_ap_server_root_relative@8
ap_loaded_modules
_ap_destroy_sub_req@4
ap_server_root
_ap_rflush@4
_ap_run_sub_req@4
_ap_hook_pre_config@16
_ap_mpm_query@8
_ap_set_content_length@12
_ap_update_mtime@12
_ap_set_last_modified@4
_ap_get_brigade@24
_ap_hook_handler@16
_ap_rwrite@12
_ap_add_version_component@8
_ap_add_cgi_vars@4
_ap_hook_child_init@16
_ap_set_content_type@8
ap_log_error_
ap_log_rerror_
_ap_hook_post_config@16
_ap_pass_brigade@8
_ap_add_common_vars@4

libapr-1

_apr_palloc@8
_apr_pstrdup@8
apr_pool_cleanup_null
_apr_table_elts@4
apr_snprintf
_apr_table_get@8
_apr_pool_userdata_get@12
_apr_table_unset@8
apr_psprintf
_apr_pool_userdata_set@16
_apr_table_clear@4
_apr_table_add@12
_apr_strtoff@16
_apr_pool_cleanup_run@12
_apr_table_set@12
_apr_pool_cleanup_register@16

libaprutil-1

_apr_bucket_eos_create@4
_apr_brigade_create@8
_apr_brigade_cleanup@4
_apr_brigade_flatten@12

kernel32

UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId

vcruntime140

memset
_setjmp3
memcpy
_except_handler4_common
strchr
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-string-l1-1-0

_strnicmp
strncmp
_stricmp

api-ms-win-crt-convert-l1-1-0

atol
strtol

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_cexit

Exports

Exports

php_module

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

593664a2388ae46e8400ab3b0b82d94d

Headers

DLL Characteristics

File Characteristics

Imports

php8ts

libhttpd

libapr-1

libaprutil-1

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB