11c98fa5832714b8e3809aaaee7917d9dbd23f9d34b3667ef108d5265080bb20

Sharing

Copy URL Twitter E-mail

General

Target

11c98fa5832714b8e3809aaaee7917d9dbd23f9d34b3667ef108d5265080bb20
Size

20KB
MD5

6f7a928f5854b3ed98fc73898ba38c44
SHA1

1aec807d6a1f560d107412a156775bc2868a27c2
SHA256

11c98fa5832714b8e3809aaaee7917d9dbd23f9d34b3667ef108d5265080bb20
SHA512

7410926f2853bd551e37c9f6ed934a025d6476dd95d1e766b288f677474e3edfd0814be4c122f61074bc0e5d06fdd8ad3425dcd545e149a3de3d0e5da25c028b
SSDEEP

384:y/whyUxzYl44fCGqYekVn6UpeH2XOFc/9iqf:eUO4X+eI6UHOAIqf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11c98fa5832714b8e3809aaaee7917d9dbd23f9d34b3667ef108d5265080bb20

Files

11c98fa5832714b8e3809aaaee7917d9dbd23f9d34b3667ef108d5265080bb20
.dll windows:6 windows x64 arch:x64

c05436c48bfb568193be63aea6398821

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\VC16\Win64\httpd-2.4\x64\Release\mod_substitute.pdb

Imports

libhttpd

ap_register_output_filter
ap_varbuf_regsub
ap_varbuf_pdup
ap_varbuf_strmemcat
ap_varbuf_free
ap_varbuf_init
ap_log_rerror_
ap_save_brigade
ap_set_flag_slot
ap_pass_brigade
ap_log_assert
ap_pregsub_ex
ap_pregcomp
ap_regexec_len
ap_regcomp_get_default_cflags

libaprutil-1

apr_brigade_create
apr_strmatch_precompile
apr_bucket_pool_create
apr_brigade_cleanup
apr_brigade_pflatten
apr_bucket_flush_create
apr_bucket_transient_create
apr_bucket_type_eos

libapr-1

apr_palloc
apr_pool_clear
apr_pool_create_ex
apr_array_make
apr_array_push
apr_strtoff
apr_pstrdup
apr_table_unset
apr_array_append

vcruntime140

memset
__std_type_info_destroy_list
__C_specific_handler
memchr

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

kernel32

QueryPerformanceCounter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Exports

Exports

substitute_module

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c05436c48bfb568193be63aea6398821

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libhttpd

libaprutil-1

libapr-1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 528B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 76B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 528B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 76B