e4f0e442c3ca18c1e3557a5aad93a863d32f815aa983a3470faacf7d4ec309d2

Sharing

Copy URL Twitter E-mail

General

Target

e4f0e442c3ca18c1e3557a5aad93a863d32f815aa983a3470faacf7d4ec309d2
Size

43KB
MD5

8e94f6e722ad97c718e8b55f6b73fc09
SHA1

e741b60c065a9236f8993028fc1ad8810e983d3c
SHA256

e4f0e442c3ca18c1e3557a5aad93a863d32f815aa983a3470faacf7d4ec309d2
SHA512

3a635b0c96baace8a25c851fcf39665b3a1808c9d53cdf7edd8499aea5395e03180ab1b42d01c6324fa4f1a5be269091c0fb898e3a3498c1bd246e93d6358497
SSDEEP

768:aPWbnfFPoOmWQLV4K/Dxc0rDRT4coShKip08xxko7a9QoIEAO7SGjgbt0n5:aP0f9oOfm4K/Nc0r9T4coShKip08AF9v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4f0e442c3ca18c1e3557a5aad93a863d32f815aa983a3470faacf7d4ec309d2

Files

e4f0e442c3ca18c1e3557a5aad93a863d32f815aa983a3470faacf7d4ec309d2
.dll windows x86

8474ce365f96bc80a0f5e634de8d42ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

php8ts

php_info_print_table_row
php_info_print_table_start
_emalloc@@4
virtual_getcwd
zend_wrong_parameters_count_error@@8
zend_wrong_parameter_error@@20
zend_argument_value_error
zend_parse_parameters
virtual_realpath
php_info_print_table_end
zend_parse_arg_str_slow@@12

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EnumResourceLanguagesA
GetModuleHandleA
GetLastError
GetProcAddress
GetThreadLocale
GetLocaleInfoA
GetCurrentProcess

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

vcruntime140

memcpy
_except_handler4_common
strchr
strstr
__std_type_info_destroy_list
memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
raise
_errno
_seh_filter_dll
_initterm_e
_initterm
_execute_onexit_table
abort
_initialize_narrow_environment
_configure_narrow_argv
_cexit

api-ms-win-crt-string-l1-1-0

_strdup
strncmp
isupper
isdigit
isalnum
isalpha
tolower
isspace

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fgets
fputs
feof
__stdio_common_vfprintf
putc
fclose
fopen
_open
_close
_read
_getcwd

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

Exports

Exports

get_module

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8474ce365f96bc80a0f5e634de8d42ee

Headers

DLL Characteristics

File Characteristics

Imports

php8ts

kernel32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 2KB