9a4655561fd750bbddfc9b66fbe97ab1

Sharing

Copy URL Twitter E-mail

General

Target

9a4655561fd750bbddfc9b66fbe97ab1
Size

14KB
MD5

9a4655561fd750bbddfc9b66fbe97ab1
SHA1

e20543ec71ba34127c4ddccd4bea28d9678b0001
SHA256

5d31c67d5896bd8cc43658ab9a66779a8cf853283870d2e87496cd3d4a77424f
SHA512

57ac93486e50063c8b15406bd2a11cd28d20d03eb897f5cc8d0cbded70d86f134d7b7fee507de5c0a65632d94a7c0f88945cc5778c4a83fd39453edf5c3d4bea
SSDEEP

192:DB+gnQ1epToKHpIrELiCa8NoX2dtot23XvVlD62LOqxC5fE:DRDoCPyMoX2YtKfVlCqxuf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a4655561fd750bbddfc9b66fbe97ab1

Files

9a4655561fd750bbddfc9b66fbe97ab1
.dll windows:5 windows x86 arch:x86

c4956bd04078bdc4be7cbc0410718cc4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\httpd-2.4.10\modules\mappers\Release\mod_alias.pdb

Imports

libapr-1

_apr_array_make@12
apr_pstrcat
_apr_table_setn@12
_apr_palloc@8
_apr_array_append@12
_apr_array_push@4

libhttpd

_ap_os_escape_path@12
_ap_pregsub@20
_ap_server_root_relative@8
ap_log_rerror_
_ap_pregcomp@12
_ap_is_url@4
_ap_regexec@20
_ap_construct_url@12
_ap_hook_fixups@16
_ap_hook_translate_name@16
ap_log_error_
_ap_set_context_info@12

libaprutil-1

_apr_uri_parse@12
_apr_uri_unparse@12

msvcr90

_decode_pointer
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
atoi
isdigit
strchr
_encode_pointer
_malloc_crt
free
_encoded_null
_stricmp
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter

kernel32

GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep

Exports

Exports

alias_module

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4956bd04078bdc4be7cbc0410718cc4

Headers

File Characteristics

PDB Paths

Imports

libapr-1

libhttpd

libaprutil-1

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 924B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 676B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 924B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 676B