php-win[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

php-win.exe
Size

32KB
MD5

2ef122a444a5c846bdf5f7222a138bc2
SHA1

77910f9da94407e22c1c0a993b64f0632c35ffb6
SHA256

f0e0bb72b171676747f5aded25ae54d5db44e0d79ed7ff79df3f4788ea3f4000
SHA512

e85265117abbd678133d254be42f299295c609adb9321a46b9dd8fd7ce9e530210e0e37a8c75f3b75595c2c90d83929a15164dfde139a8ed9c4ca7e49ce0a9c2
SSDEEP

384:jCPz75OVTkQ9ENE7932c1nH6FFBFVOF+mvUeBoiQ6KD1Kl:jS9QkQ9fgoaC3vUQQGl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
php-win.exe

Files

php-win.exe
.exe windows:4 windows x86 arch:x86

63a94c9ef04df7b752966a4b241864fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

php5ts

php_printf
php_print_info
php_end_ob_buffers
php_request_startup
php_body_write
compiler_globals_id
executor_globals_id
sapi_startup
ts_resource_ex
tsrm_startup
zend_hash_destroy
zend_hash_apply
zend_hash_sort
get_zend_version
zend_hash_copy
_zend_hash_init
zend_llist_destroy
zend_llist_apply
zend_llist_sort
zend_llist_copy
zend_extensions
zend_strndup
_php_stream_free
zend_register_constant
_php_stream_open_wrapper_ex
virtual_fopen
sapi_module
zend_load_extension
sapi_deactivate
zend_ini_deactivate
zend_is_auto_global
core_globals_id
php_execute_script
php_lint_script
zend_printf
open_file_for_scanning
zend_strip
php_get_highlight_struct
zend_highlight
zend_eval_string_ex
_emalloc
_zend_hash_add_or_update
_php_stream_get_line
_estrndup
reflection_extension_ptr
reflection_class_ptr
reflection_method_ptr
reflection_function_ptr
_object_init_ex
zend_call_method
_zval_ptr_dtor
zend_exception_get_default
zend_read_property
reflection_ptr
zend_str_tolower_copy
module_registry
zend_hash_find
display_ini_entries
php_info_print_module
php_ini_opened_path
php_ini_scanned_files
php_request_shutdown
php_module_shutdown
sapi_shutdown
tsrm_shutdown
php_module_startup
_efree
sapi_globals_id
php_import_environment_variables
php_register_variable
php_module_shutdown_wrapper
zend_qsort
zend_error

msvcrt

_strdup
_stricmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
fgetc
ftell
fseek
rewind
strrchr
_setjmp3
__p___argc
__p___argv
_fmode
malloc
strchr
__mb_cur_max
_isctype
_pctype
realloc
printf
fclose
strstr
getenv
exit
free
fprintf
fflush
_errno
fwrite
_iob
_setmode

kernel32

GetStartupInfoA
GetModuleHandleA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63a94c9ef04df7b752966a4b241864fb

Headers

File Characteristics

Imports

php5ts

msvcrt

kernel32

Sections

.text Size: 12KB - Virtual size: 8KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 220B

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 12KB - Virtual size: 8KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 220B

.rsrc
Size: 4KB - Virtual size: 2KB