9e003161e2c1c85f4414e27b1dc4f24f6fb9e166cd32ddab7da9b73c72d03924

Sharing

Copy URL Twitter E-mail

General

Target

9e003161e2c1c85f4414e27b1dc4f24f6fb9e166cd32ddab7da9b73c72d03924
Size

1.4MB
MD5

b99fd8a8707b47c577a4a0bb5dc09dfb
SHA1

2f7d36f633189b6f2d78b34308fd40f8b29e12ec
SHA256

9e003161e2c1c85f4414e27b1dc4f24f6fb9e166cd32ddab7da9b73c72d03924
SHA512

17defe5b455c4697bfe315a6e81934c73d6a0bbb20d85d1dd2fa9ab83f42e91a82ac71f301a1762ffdf3571160b64100d5f79c89d066303a81b052404eba9285
SSDEEP

24576:OmkkX1dbX6tjXF7JUN4BcSIPjuEfNgzPDkkqW6j:D6UN4j1oNgPwW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9e003161e2c1c85f4414e27b1dc4f24f6fb9e166cd32ddab7da9b73c72d03924

Files

9e003161e2c1c85f4414e27b1dc4f24f6fb9e166cd32ddab7da9b73c72d03924
.dll windows x86

d162ac1e3b528377827b93e514c04d06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

php8ts

zend_alter_ini_entry
zend_multibyte_set_functions
php_internal_encoding_changed
php_pcre_create_match_data
zend_value_error
php_pcre_cctx
zend_hash_str_find@@12
sapi_read_standard_form_data
zval_get_long_func@@8
php_std_post_handler
php_pcre2_code_free
zend_parse_arg_bool_slow@@12
zend_register_string_constant
add_assoc_long_ex
zend_one_char_string
php_trim
php_get_internal_encoding
zend_unregister_ini_entries_ex
display_ini_entries
zend_wrong_parameter_error@@20
zend_wrong_parameters_none_error@@0
sapi_add_header_ex
zend_wrong_parameters_count_error@@8
_zend_hash_init@@16
sapi_unregister_post_entry
php_get_input_encoding
zend_hash_add@@12
zend_parse_arg_str_or_long_slow@@16
php_pcre2_get_error_message
php_info_print_table_header
php_pcre2_compile
php_pcre2_match
sapi_register_post_entries
_emalloc@@4
zend_spprintf
php_info_print_table_start
ap_php_snprintf
add_next_index_stringl
zend_memnrstr_ex@@16
zend_memnstr_ex@@16
add_assoc_bool_ex
add_next_index_long
zend_make_compiled_string_description
smart_str_erealloc@@8
zend_parse_parameters
add_index_stringl
_convert_to_string@@4
zend_call_function
add_assoc_stringl_ex
zend_hash_str_update@@16
zend_throw_error
zend_array_destroy@@4
add_index_bool
rfc1867_post_handler
php_pcre_free_match_data
php_mail_build_headers
zend_empty_string
OnUpdateBool
php_mail
php_pcre_mctx
zval_try_get_string_func@@4
_efree@@4
__zend_malloc
_erealloc@@8
zend_ini_boolean_displayer_cb
zend_array_dup@@4
zend_hash_update@@12
_safe_emalloc@@12
zend_argument_value_error
executor_globals_offset
zend_empty_array
zend_try_assign_typed_ref_arr
OnUpdateLong
zend_hash_destroy@@4
zend_ini_string_ex
zval_ptr_dtor
zend_multibyte_restore_functions
tsrm_get_ls_cache
zend_parse_arg_long_slow@@12
zend_error_noreturn
zend_hash_index_add@@12
__zend_calloc
zend_multibyte_set_internal_encoding
php_info_print_table_end
zend_ini_string
php_escape_shell_cmd
zend_binary_strcasecmp@@16
add_assoc_zval_ex
OnUpdateString
php_info_print_table_row
add_next_index_string
php_get_output_encoding
zend_register_ini_entries_ex
sapi_register_treat_data
add_assoc_string_ex
zend_register_long_constant
php_rfc1867_set_multibyte_callbacks
zend_parse_arg_str_slow@@12
sapi_handle_post
_php_stream_copy_to_mem
php_url_decode
php_error_docref
_estrndup@@8
php_strtok_r
_php_stream_seek
_estrdup@@4
sapi_globals_offset
_zend_new_array@@4
php_register_variable_safe
php_default_treat_data
core_globals_offset
_ecalloc@@8
zend_str_tolower@@8
sapi_module

vcruntime140

_except_handler4_common
__std_type_info_destroy_list
memmove
memset
memcpy
strchr
memchr
memcmp

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
realloc

api-ms-win-crt-convert-l1-1-0

strtol
strtoul

api-ms-win-crt-string-l1-1-0

strcat_s
isdigit
strncmp
isspace
_stricmp
iscntrl
strcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
fflush
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_cexit
_initialize_narrow_environment

kernel32

GetCurrentThreadId
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter

Exports

Exports

OnigDefaultCaseFoldFlag
OnigDefaultSyntax
OnigEncodingASCII
OnigEncodingBIG5
OnigEncodingEUC_CN
OnigEncodingEUC_JP
OnigEncodingEUC_KR
OnigEncodingEUC_TW
OnigEncodingISO_8859_1
OnigEncodingISO_8859_10
OnigEncodingISO_8859_11
OnigEncodingISO_8859_13
OnigEncodingISO_8859_14
OnigEncodingISO_8859_15
OnigEncodingISO_8859_16
OnigEncodingISO_8859_2
OnigEncodingISO_8859_3
OnigEncodingISO_8859_4
OnigEncodingISO_8859_5
OnigEncodingISO_8859_6
OnigEncodingISO_8859_7
OnigEncodingISO_8859_8
OnigEncodingISO_8859_9
OnigEncodingKOI8_R
OnigEncodingSJIS
OnigEncodingUTF16_BE
OnigEncodingUTF16_LE
OnigEncodingUTF32_BE
OnigEncodingUTF32_LE
OnigEncodingUTF8
OnigSyntaxASIS
OnigSyntaxEmacs
OnigSyntaxGnuRegex
OnigSyntaxGrep
OnigSyntaxJava
OnigSyntaxOniguruma
OnigSyntaxPerl
OnigSyntaxPerl_NG
OnigSyntaxPosixBasic
OnigSyntaxPosixExtended
OnigSyntaxPython
OnigSyntaxRuby
get_module
mb_fast_convert
mb_illegal_output
mbfl_buffer_converter_delete
mbfl_buffer_converter_feed
mbfl_buffer_converter_feed_result
mbfl_buffer_converter_flush
mbfl_buffer_converter_illegal_mode
mbfl_buffer_converter_illegal_substchar
mbfl_buffer_converter_new
mbfl_buffer_converter_result
mbfl_buffer_illegalchars
mbfl_convert_encoding
mbfl_convert_filter_copy
mbfl_convert_filter_delete
mbfl_convert_filter_devcat
mbfl_convert_filter_feed
mbfl_convert_filter_feed_string
mbfl_convert_filter_flush
mbfl_convert_filter_get_vtbl
mbfl_convert_filter_new
mbfl_convert_filter_new2
mbfl_convert_filter_reset
mbfl_convert_filter_strcat
mbfl_encoding_detector_delete
mbfl_encoding_detector_feed
mbfl_encoding_detector_judge
mbfl_encoding_detector_new
mbfl_encoding_pass
mbfl_encoding_preferred_mime_name
mbfl_filt_conv_common_ctor
mbfl_filt_conv_common_flush
mbfl_filt_conv_illegal_output
mbfl_filt_conv_pass
mbfl_filter_output_null
mbfl_filter_output_pipe
mbfl_get_supported_encodings
mbfl_identify_encoding
mbfl_memory_device_clear
mbfl_memory_device_devcat
mbfl_memory_device_init
mbfl_memory_device_output
mbfl_memory_device_realloc
mbfl_memory_device_reset
mbfl_memory_device_result
mbfl_memory_device_strcat
mbfl_memory_device_strncat
mbfl_memory_device_unput
mbfl_mime_header_decode
mbfl_mime_header_encode
mbfl_name2encoding
mbfl_name2language
mbfl_name2no_encoding
mbfl_name2no_language
mbfl_no2encoding
mbfl_no2language
mbfl_no2preferred_mime_name
mbfl_no_encoding2name
mbfl_no_language2name
mbfl_strcut
mbfl_string_clear
mbfl_string_init
mbfl_string_init_set
mbfl_strlen
mbfl_strpos
mbfl_substr
mbfl_substr_count
mbfl_wchar_device_clear
mbfl_wchar_device_init
mbfl_wchar_device_output
mbstr_treat_data
mime_header_decoder_delete
mime_header_decoder_new
mime_header_decoder_result
mime_header_encoder_delete
mime_header_encoder_new
mime_header_encoder_result
onig_builtin_cmp
onig_builtin_count
onig_builtin_error
onig_builtin_fail
onig_builtin_max
onig_builtin_mismatch
onig_builtin_total_count
onig_callout_tag_is_exist_at_callout_num
onig_copy_encoding
onig_copy_syntax
onig_end
onig_error_code_to_str
onig_foreach_name
onig_free
onig_free_body
onig_free_match_param
onig_free_match_param_content
onig_get_arg_by_callout_args
onig_get_args_num_by_callout_args
onig_get_callback_each_match
onig_get_callout_data
onig_get_callout_data_by_callout_args
onig_get_callout_data_by_callout_args_self
onig_get_callout_data_by_callout_args_self_dont_clear_old
onig_get_callout_data_by_tag
onig_get_callout_data_by_tag_dont_clear_old
onig_get_callout_data_dont_clear_old
onig_get_callout_in_by_callout_args
onig_get_callout_name_by_name_id
onig_get_callout_num_by_callout_args
onig_get_callout_num_by_tag
onig_get_callout_tag_end
onig_get_callout_tag_start
onig_get_capture_range_in_callout
onig_get_capture_tree
onig_get_case_fold_flag
onig_get_contents_by_callout_args
onig_get_contents_end_by_callout_args
onig_get_current_by_callout_args
onig_get_default_case_fold_flag
onig_get_encoding
onig_get_match_stack_limit_size
onig_get_name_id_by_callout_args
onig_get_options
onig_get_parse_depth_limit
onig_get_passed_args_num_by_callout_args
onig_get_progress_callout
onig_get_regex_by_callout_args
onig_get_retraction_callout
onig_get_retry_counter_by_callout_args
onig_get_retry_limit_in_match
onig_get_retry_limit_in_search
onig_get_right_range_by_callout_args
onig_get_start_by_callout_args
onig_get_string_by_callout_args
onig_get_string_end_by_callout_args
onig_get_subexp_call_limit_in_search
onig_get_subexp_call_max_nest_level
onig_get_syntax
onig_get_syntax_behavior
onig_get_syntax_op
onig_get_syntax_op2
onig_get_syntax_options
onig_get_used_stack_size_in_callout
onig_init
onig_initialize
onig_initialize_encoding
onig_initialize_match_param
onig_is_error_code_needs_param
onig_match
onig_match_with_param
onig_name_to_backref_number
onig_name_to_group_numbers
onig_new
onig_new_match_param
onig_noname_group_capture_is_active
onig_number_of_capture_histories
onig_number_of_captures
onig_number_of_names
onig_reg_init
onig_region_clear
onig_region_copy
onig_region_free
onig_region_init
onig_region_new
onig_region_resize
onig_region_set
onig_regset_add
onig_regset_free
onig_regset_get_regex
onig_regset_get_region
onig_regset_new
onig_regset_number_of_regex
onig_regset_replace
onig_regset_search
onig_regset_search_with_param
onig_scan
onig_search
onig_search_with_param
onig_set_callback_each_match
onig_set_callout_data
onig_set_callout_data_by_callout_args
onig_set_callout_data_by_callout_args_self
onig_set_callout_data_by_tag
onig_set_callout_of_name
onig_set_callout_user_data_of_match_param
onig_set_capture_num_limit
onig_set_default_case_fold_flag
onig_set_default_syntax
onig_set_match_stack_limit_size
onig_set_match_stack_limit_size_of_match_param
onig_set_meta_char
onig_set_parse_depth_limit
onig_set_progress_callout
onig_set_progress_callout_of_match_param
onig_set_retraction_callout
onig_set_retraction_callout_of_match_param
onig_set_retry_limit_in_match
onig_set_retry_limit_in_match_of_match_param
onig_set_retry_limit_in_search
onig_set_retry_limit_in_search_of_match_param
onig_set_subexp_call_limit_in_search
onig_set_subexp_call_max_nest_level
onig_set_syntax_behavior
onig_set_syntax_op
onig_set_syntax_op2
onig_set_syntax_options
onig_set_verb_warn_func
onig_set_warn_func
onig_setup_builtin_monitors_by_ascii_encoded_name
onig_unicode_define_user_property
onigenc_get_default_encoding
onigenc_get_left_adjust_char_head
onigenc_get_prev_char_head
onigenc_get_right_adjust_char_head
onigenc_get_right_adjust_char_head_with_prev
onigenc_init
onigenc_is_valid_mbc_string
onigenc_set_default_caseconv_table
onigenc_set_default_encoding
onigenc_step_back
onigenc_str_bytelen_null
onigenc_strdup
onigenc_strlen
onigenc_strlen_null
php_mb_check_encoding
php_mb_convert_encoding
php_mb_convert_encoding_ex
php_mb_convert_encoding_recursive
php_mb_mbchar_bytes
php_mb_safe_strrchr
php_mb_stripos
php_unicode_convert_case
php_unicode_is_prop
php_unicode_is_prop1
vtbl_pass

Sections

.text
Size: 338KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d162ac1e3b528377827b93e514c04d06

Headers

DLL Characteristics

File Characteristics

Imports

php8ts

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 338KB - Virtual size: 338KB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 52KB - Virtual size: 53KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 338KB - Virtual size: 338KB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 52KB - Virtual size: 53KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 18KB - Virtual size: 17KB