Resubmissions

11/10/2023, 22:38

231011-2kefjabb95 8

11/10/2023, 22:33

231011-2gt2taah25 8

General

  • Target

    php-8.2.11-nts-Win32-vs16-x64.zip

  • Size

    30.2MB

  • MD5

    fe0f0e5c1ad453cc5964fe38c459961a

  • SHA1

    d184277dcb6a7e09c27964e7d9edc93857003d5f

  • SHA256

    2f603db80f0e4ffd0330140d12926a822e47f9825fd0adbb55611857aa1b4109

  • SHA512

    aa884828803ad94e394cf6521fda6eb48f0a39cbc7de18b3e0a5d6265c9441211d104376a39a9c57bf5838cc09d0fb12f4b13651a903ab02dbb88b1f46bbcd2c

  • SSDEEP

    786432:CewP7E6emRNmRicVSpmv9+0/NyvLkuPO/oNGtbogIOMlzGFai2ES3K/:mP7EfmRvpaYOYKMzGMi2ES3K/

Score
8/10

Malware Config

Signatures

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Unsigned PE 64 IoCs

    Checks for missing Authenticode signature.

Files

  • php-8.2.11-nts-Win32-vs16-x64.zip
    .zip
  • README.md
  • deplister.exe
    .exe windows:6 windows x64

    998b5ac1ce55cd48fbbea8f2bc89769c


    Headers

    Imports

    Sections

  • dev/php8.lib
  • ext/php_bz2.dll
    .dll windows:6 windows x64

    858bcb047f0c9c701270f0ad49b2d546


    Headers

    Imports

    Exports

    Sections

  • ext/php_com_dotnet.dll
    .dll windows:6 windows x64

    f623687e33b5cb80c0846ed4a6787e6c


    Headers

    Imports

    Exports

    Sections

  • ext/php_curl.dll
    .dll windows:6 windows x64

    c0b7cbf073ea7c81b74a6caf33fffcf0


    Headers

    Imports

    Exports

    Sections

  • ext/php_dba.dll
    .dll windows:6 windows x64

    29231f19319ab4f9239da1e07bef2752


    Headers

    Imports

    Exports

    Sections

  • ext/php_dl_test.dll
    .dll windows:6 windows x64

    85e568245b32d849bfb57a1240f1877c


    Headers

    Imports

    Exports

    Sections

  • ext/php_enchant.dll
    .dll windows:6 windows x64

    4e9b52e9fb19520739812d2e25a7f266


    Headers

    Imports

    Exports

    Sections

  • ext/php_exif.dll
    .dll windows:6 windows x64

    5de243cf1335bd037423faa84cc57f02


    Headers

    Imports

    Exports

    Sections

  • ext/php_ffi.dll
    .dll windows:6 windows x64

    4b55a06a1e0f3d3dbbc3105e085d5c86


    Headers

    Imports

    Exports

    Sections

  • ext/php_fileinfo.dll
    .dll windows:6 windows x64

    c3cde8843de0806ba41c8cb2de7d9a84


    Headers

    Imports

    Exports

    Sections

  • ext/php_ftp.dll
    .dll windows:6 windows x64

    fb4f6d213741c49d94e1990f7a793ea6


    Headers

    Imports

    Exports

    Sections

  • ext/php_gd.dll
    .dll windows:6 windows x64

    cf39ff985ff12d4c40a3e0757c156fef


    Headers

    Imports

    Exports

    Sections

  • ext/php_gettext.dll
    .dll windows:6 windows x64

    669ea68ad0c0c0ecaaf29ecbac403d72


    Headers

    Imports

    Exports

    Sections

  • ext/php_gmp.dll
    .dll windows:6 windows x64

    7a9b89a03cea33e02e7d85acea575850


    Headers

    Imports

    Exports

    Sections

  • ext/php_imap.dll
    .dll windows:6 windows x64

    de1fb7b1f149de859862e003cccfa536


    Headers

    Imports

    Exports

    Sections

  • ext/php_intl.dll
    .dll windows:6 windows x64

    5e38334654afe2e708a90705f2f36934


    Headers

    Imports

    Exports

    Sections

  • ext/php_ldap.dll
    .dll windows:6 windows x64

    f96ac03cb20a91f7a38e796e17506081


    Headers

    Imports

    Exports

    Sections

  • ext/php_mbstring.dll
    .dll windows:6 windows x64

    70ee46c662bb1c472a25db0141d8ebfa


    Headers

    Imports

    Exports

    Sections

  • ext/php_mysqli.dll
    .dll windows:6 windows x64

    9c746a6af242ed7c95dddb021907bebb


    Headers

    Imports

    Exports

    Sections

  • ext/php_oci8_19.dll
    .dll windows:6 windows x64

    70a3f68992867d40685b49a2ca66c8b1


    Headers

    Imports

    Exports

    Sections

  • ext/php_odbc.dll
    .dll windows:6 windows x64

    50d0f535d3e345548013c58cd35958a5


    Headers

    Imports

    Exports

    Sections

  • ext/php_opcache.dll
    .dll windows:6 windows x64

    e4a89e72e508a08144ed1ecee9e46d93


    Headers

    Imports

    Exports

    Sections

  • ext/php_openssl.dll
    .dll windows:6 windows x64

    bce83f0f00e24638c5c3107c60e29ba2


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_firebird.dll
    .dll windows:6 windows x64

    f93ec0205739ce5e0ec80e923bd7965e


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_mysql.dll
    .dll windows:6 windows x64

    1dd214c2edffe02e3b172e209ec1dc14


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_oci.dll
    .dll windows:6 windows x64

    c1aa0dfc8cd92f04740523ced35dce87


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_odbc.dll
    .dll windows:6 windows x64

    3adc6866d8fa98f65291cc6126611322


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_pgsql.dll
    .dll windows:6 windows x64

    62dec38d00837d8ddfa58c0f0c943175


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_sqlite.dll
    .dll windows:6 windows x64

    f032a4a27888b8344ad86e859386a1eb


    Headers

    Imports

    Exports

    Sections

  • ext/php_pgsql.dll
    .dll windows:6 windows x64

    8b3766e0a704ccce9076e9d80dd04be3


    Headers

    Imports

    Exports

    Sections

  • ext/php_shmop.dll
    .dll windows:6 windows x64

    18d92d2fee3614b2d3c451c9905d34d1


    Headers

    Imports

    Exports

    Sections

  • ext/php_snmp.dll
    .dll windows:6 windows x64

    5c6d5a817612e30555bb766cd9061f7d


    Headers

    Imports

    Exports

    Sections

  • ext/php_soap.dll
    .dll windows:6 windows x64

    4b10bc461c4424f80ecad36a5799747f


    Headers

    Imports

    Exports

    Sections

  • ext/php_sockets.dll
    .dll windows:6 windows x64

    ac354f838d3bc68c045249952f1a0691


    Headers

    Imports

    Exports

    Sections

  • ext/php_sodium.dll
    .dll windows:6 windows x64

    3bc4e0a55fa9116eed21192d0e8018ad


    Headers

    Imports

    Exports

    Sections

  • ext/php_sqlite3.dll
    .dll windows:6 windows x64

    45a67ebb345662698482d1f19edc2efa


    Headers

    Imports

    Exports

    Sections

  • ext/php_sysvshm.dll
    .dll windows:6 windows x64

    6c2fb134bff5d6f600c390f889e0d3d6


    Headers

    Imports

    Exports

    Sections

  • ext/php_tidy.dll
    .dll windows:6 windows x64

    e1b7cad4d9697c49418f10461529c60b


    Headers

    Imports

    Exports

    Sections

  • ext/php_xsl.dll
    .dll windows:6 windows x64

    1263e1c973b4b95dfbc6f1996eaa0dd4


    Headers

    Imports

    Exports

    Sections

  • ext/php_zend_test.dll
    .dll windows:6 windows x64

    ba210e730fe9c9a7fd3ada9864351e35


    Headers

    Imports

    Exports

    Sections

  • ext/php_zip.dll
    .dll windows:6 windows x64

    69f7f7c9783b9d34a27876e355fabb60


    Headers

    Imports

    Exports

    Sections

  • extras/ssl/legacy.dll
    .dll windows:6 windows x64

    783fb5c6bcd5fe061f884daa1823e53f


    Headers

    Imports

    Exports

    Sections

  • extras/ssl/openssl.cnf
  • glib-2.dll
    .dll windows:6 windows x64

    f97499326d070979651d83a0a6ca0500


    Headers

    Imports

    Exports

    Sections

  • gmodule-2.dll
    .dll windows:6 windows x64

    dd3969e7102609331d83594201dc28c2


    Headers

    Imports

    Exports

    Sections

  • icudt71.dll
    .dll windows:6 windows x64


    Headers

    Exports

    Sections

  • icuin71.dll
    .dll windows:6 windows x64

    34c9337a87558e7d2464c70de0832e4e


    Headers

    Imports

    Exports

    Sections

  • icuio71.dll
    .dll windows:6 windows x64

    a4deaacad12ec6d8ca09900284ce35ec


    Headers

    Imports

    Exports

    Sections

  • icuuc71.dll
    .dll windows:6 windows x64

    8155fe4683646ed9da197807c0eb1aad


    Headers

    Imports

    Exports

    Sections

  • lib/enchant/libenchant2_hunspell.dll
    .dll windows:6 windows x64

    836b9c0311d383d9ef0028dacb290303


    Headers

    Imports

    Exports

    Sections

  • libcrypto-3-x64.dll
    .dll windows:6 windows x64

    bc56edce1c9c476b634393247734974c


    Headers

    Imports

    Exports

    Sections

  • libenchant2.dll
    .dll windows:6 windows x64

    7fac286fbec49af426309c8b3956cf61


    Headers

    Imports

    Exports

    Sections

  • libpq.dll
    .dll windows:6 windows x64

    dfa7590ef54ae078f2a7a7fd1eebc6f8


    Headers

    Imports

    Exports

    Sections

  • libsasl.dll
    .dll windows:6 windows x64

    e6a6094de54bf05759b47e854fc02b59


    Headers

    Imports

    Exports

    Sections

  • libsodium.dll
    .dll windows:6 windows x64

    d78711e4cfc87f248be0c106a2086e2d


    Headers

    Imports

    Exports

    Sections

  • libsqlite3.dll
    .dll windows:6 windows x64

    0bb598215ca79504fb9890ac13be41b9


    Headers

    Imports

    Exports

    Sections

  • libssh2.dll
    .dll windows:6 windows x64

    86a9876db9afdd5968217368a793f5b7


    Headers

    Imports

    Exports

    Sections

  • libssl-3-x64.dll
    .dll windows:6 windows x64

    a5db4944ca4c6446f5fbd8bbdc2b1577


    Headers

    Imports

    Exports

    Sections

  • license.txt
  • news.txt
  • nghttp2.dll
    .dll windows:6 windows x64

    06a324d48b897630c544dbbdc07cc94b


    Headers

    Imports

    Exports

    Sections

  • phar.phar.bat
  • pharcommand.phar
    .js
  • php-cgi.exe
    .exe windows:6 windows x64

    f2fc6af711aea088601938cad0bf67ca


    Headers

    Imports

    Exports

    Sections

  • php-win.exe
    .exe windows:6 windows x64

    bca4e3493c8cdbd07b6a706b0d839166


    Headers

    Imports

    Exports

    Sections

  • php.exe
    .exe windows:6 windows x64

    7d82461880c440e62583bc0e80f851b5


    Headers

    Imports

    Exports

    Sections

  • php.ini-development
  • php.ini-production
  • php8.dll
    .dll windows:6 windows x64

    d9e6befdebc6e31a18163e4a8d88559f


    Headers

    Imports

    Exports

    Sections

  • php8embed.lib
  • php8phpdbg.dll
    .dll windows:6 windows x64

    a8b625a35415488ff85c7767f0c3131e


    Headers

    Imports

    Exports

    Sections

  • phpdbg.exe
    .exe windows:6 windows x64

    682388d07e62bf51776026c8c902a9d9


    Headers

    Imports

    Exports

    Sections

  • readme-redist-bins.txt
  • snapshot.txt