1b9eba23e3cd872896b80959eb87e1af8102524dcdd379c2663fb2caf7529ed3

Sharing

Copy URL Twitter E-mail

General

Target

1b9eba23e3cd872896b80959eb87e1af8102524dcdd379c2663fb2caf7529ed3
Size

312KB
MD5

d9d0da1ba8401fd46904381a7ff755f2
SHA1

9706430df13f2da197248e81cbfc89a6dc05d88c
SHA256

1b9eba23e3cd872896b80959eb87e1af8102524dcdd379c2663fb2caf7529ed3
SHA512

2c0f2c868f60a95f4864c94d6193e55591ebb75bbe978eca333847fd218b15673d2b6572a6b9951ab1b7755bf9526ab1da12a794238d0cae46d5dbea4f9f85e4
SSDEEP

6144:K2yeVO4I+sEixmyxRNyq83lWmmZp5CAtyIR3AKPpE6wzMjOw4Qt20jSYOLfNQt:HVOP+9ixBLy93lpmZpL9jStE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b9eba23e3cd872896b80959eb87e1af8102524dcdd379c2663fb2caf7529ed3

Files

1b9eba23e3cd872896b80959eb87e1af8102524dcdd379c2663fb2caf7529ed3
.dll windows x86

506566fe365b69293ceb1f0e98b235da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

php8ts

zend_is_true@@4
php_basename
_safe_erealloc@@16
zend_hash_find@@8
php_info_print_table_end
zend_zval_type_name
zend_parse_parameters
zval_ptr_dtor
zend_list_close@@4
zend_hash_destroy@@4
php_clear_stat_cache
zend_string_init_interned
executor_globals_offset
globfree
__zend_malloc
php_pcre2_match
zend_std_read_property
_php_stream_open_wrapper_ex
_php_stream_free
zend_add_attribute
_estrdup@@4
php_stream_context_get_option
_php_stream_alloc
ap_php_snprintf
zend_known_strings
php_info_print_table_start
zend_spprintf
_emalloc@@4
zend_array_destroy@@4
zend_object_std_init@@8
_efree@@4
zend_throw_error
php_dirname
virtual_getcwd
zend_try_assign_typed_ref_long
php_stream_dirent_alphasort
zend_hash_add@@12
zend_std_get_properties
std_object_handlers
zend_declare_typed_property
zend_std_write_property
_zend_hash_init@@16
zend_wrong_parameters_count_error@@8
zend_type_error
zend_register_list_destructors_ex
zend_register_internal_class_ex
zend_wrong_parameters_none_error@@0
zend_wrong_parameter_error@@20
zend_declare_class_constant_ex
php_error_docref
zend_std_has_property
virtual_stat
object_properties_init
add_assoc_long_ex
zval_get_long_func@@8
zend_ce_countable
zend_hash_str_find@@12
zend_value_error
glob
zend_register_resource
php_pcre_create_match_data
php_unregister_url_stream_wrapper
php_check_open_basedir
zend_class_implements
zend_std_get_property_ptr_ptr
_php_stream_write
php_register_url_stream_wrapper
zend_hash_update@@12
_safe_emalloc@@12
zend_argument_value_error
pcre_get_compiled_regex
_zend_new_array@@4
virtual_file_ex
expand_filepath
tsrm_get_ls_cache
php_info_print_table_row
zend_object_std_dtor
add_next_index_string
_php_stream_mkdir
add_assoc_string_ex
zend_parse_arg_str_slow@@12
_php_stream_stat_path
zend_fetch_resource
zend_hash_index_find@@8
php_pcre_free_match_data
zend_empty_string
_call_user_function_impl
php_pcre_mctx
_php_stream_scandir

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcessId
GetLastError
SetFilePointerEx
ReadFile
GetFileTime
GetFileSizeEx
LocalFree
GetTickCount
CloseHandle
WriteFile
GetFileType
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
DeleteFileW
MoveFileExW
MultiByteToWideChar

advapi32

GetSecurityInfo

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptDeriveKeyPBKDF2
BCryptCreateHash
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptDestroyKey

vcruntime140

strstr
strchr
strrchr
_except_handler4_common
memset
memcpy
memchr
memmove
__std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

strncmp
_stricmp
_strdup
_strnicmp
isdigit
strcmp
isalpha
_wcsdup

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
calloc

api-ms-win-crt-time-l1-1-0

_localtime32
_time32
_mktime32

api-ms-win-crt-runtime-l1-1-0

_initterm
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_errno
strerror
_configure_narrow_argv
exit
_seh_filter_dll
_initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vswprintf
__acrt_iob_func
fclose
__stdio_common_vsprintf
ungetc
ferror
fflush
_setmode
fwrite
_fileno
fread
fopen
fgetc

api-ms-win-crt-math-l1-1-0

_fdopen

Exports

Exports

get_module
zip_close
zip_compression_method_supported
zip_delete
zip_dir_add
zip_discard
zip_encryption_method_supported
zip_error_clear
zip_error_code_system
zip_error_code_zip
zip_error_fini
zip_error_get
zip_error_init
zip_error_init_with_code
zip_error_set
zip_error_strerror
zip_error_system_type
zip_error_to_data
zip_fclose
zip_file_add
zip_file_attributes_init
zip_file_get_comment
zip_file_get_error
zip_file_get_external_attributes
zip_file_rename
zip_file_replace
zip_file_set_comment
zip_file_set_dostime
zip_file_set_encryption
zip_file_set_external_attributes
zip_file_set_mtime
zip_fopen
zip_fopen_index
zip_fopen_index_encrypted
zip_fread
zip_get_archive_comment
zip_get_error
zip_get_name
zip_get_num_entries
zip_libzip_version
zip_name_locate
zip_open
zip_open_from_source
zip_register_cancel_callback_with_state
zip_register_progress_callback
zip_register_progress_callback_with_state
zip_secure_random
zip_set_archive_comment
zip_set_default_password
zip_set_file_compression
zip_source_begin_write
zip_source_begin_write_cloning
zip_source_buffer
zip_source_buffer_create
zip_source_buffer_fragment
zip_source_buffer_fragment_create
zip_source_close
zip_source_commit_write
zip_source_error
zip_source_file
zip_source_file_create
zip_source_free
zip_source_function
zip_source_function_create
zip_source_get_file_attributes
zip_source_keep
zip_source_make_command_bitmap
zip_source_open
zip_source_read
zip_source_rollback_write
zip_source_seek
zip_source_seek_compute_offset
zip_source_seek_write
zip_source_stat
zip_source_tell
zip_source_tell_write
zip_source_win32handle
zip_source_win32handle_create
zip_source_win32w
zip_source_win32w_create
zip_source_write
zip_stat
zip_stat_index
zip_stat_init
zip_strerror
zip_unchange
zip_unchange_all
zip_unchange_archive

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

506566fe365b69293ceb1f0e98b235da

Headers

DLL Characteristics

File Characteristics

Imports

php8ts

kernel32

advapi32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 231KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 6KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 232KB - Virtual size: 231KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 6KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 7KB