a4064c3cfbb9bacd9d75e40c5e75d08fc11fd1dbcf0b0ab6aff9594dc91a701d

Sharing

Copy URL Twitter E-mail

General

Target

a4064c3cfbb9bacd9d75e40c5e75d08fc11fd1dbcf0b0ab6aff9594dc91a701d
Size

2.0MB
MD5

f4425bba7c5a5214894f15eaa5888c13
SHA1

a9da4ffddf688ed980c0553954687924a9ba67b9
SHA256

a4064c3cfbb9bacd9d75e40c5e75d08fc11fd1dbcf0b0ab6aff9594dc91a701d
SHA512

111fb9fca158de9328fe7e2c12f9ff8e763639e22015fd0de4a6192b374e7a87cdb73601c4b5b544ac52888bb8bd38ffe69910b671264d6b2e1cd89ae31f75a4
SSDEEP

49152:rh5kBRDlAwS3RcC3uEihrFiZlc52ZqGSR5zIAkZo2phuJaFvJQ/+n9:rh5kBRDlAwS3RcC3uEMFiZKUHS509ZfZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4064c3cfbb9bacd9d75e40c5e75d08fc11fd1dbcf0b0ab6aff9594dc91a701d

Files

a4064c3cfbb9bacd9d75e40c5e75d08fc11fd1dbcf0b0ab6aff9594dc91a701d
.dll windows:5 windows x86 arch:x86

9bcbf6671bff2c955daf7796c620cf11

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

php5

call_user_function_ex
executor_globals
add_assoc_string_ex
add_assoc_null_ex
_array_init
convert_to_long
zend_hash_find
zend_register_list_destructors_ex
zend_register_string_constant
php_info_print_table_end
php_info_print_table_row
php_info_print_table_start
zend_register_resource
_convert_to_string
add_assoc_long_ex
add_assoc_stringl_ex
_zval_ptr_dtor
_estrndup
zend_wrong_param_count
zend_is_callable
_emalloc
zend_parse_parameters
zend_error
zend_fetch_resource
gc_remove_zval_from_buffer
_efree
_zval_copy_ctor_func
_zval_dtor_func

ws2_32

sendto
WSAIoctl
getsockname
ntohs
htons
htonl
WSAIsBlocking
inet_addr
gethostbyname
gethostname
send
WSAStartup
WSAGetLastError
select
__WSAFDIsSet
getpeername
getsockopt
WSAAsyncSelect
ioctlsocket
WSACancelBlockingCall
WSACleanup
closesocket
recvfrom
recv
connect
bind
socket
inet_ntoa
WSACancelAsyncRequest
listen
ntohl
WSASetLastError
WSAAsyncGetHostByName
accept
setsockopt

kernel32

GetStringTypeW
GetStringTypeA
GetLocaleInfoA
RtlUnwind
InitializeCriticalSectionAndSpinCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
GetModuleHandleA
RaiseException
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
Sleep
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsDebuggerPresent
CloseHandle
GetComputerNameA
lstrcpyA
GetSystemTime
lstrcpynA
lstrlenA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcmpA
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime
GetTickCount
SetLastError
GetLastError
GetFileSize
SetFilePointer
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateFileA
CreateFileW
WriteFile
ReadFile
GetACP
GetLocalTime
GetFileAttributesW
GetFullPathNameW
GetVersion
FormatMessageA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapReAlloc
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

MessageBeep
wsprintfA
DefWindowProcA
GetWindowLongA
UnregisterClassA
RegisterClassA
MsgWaitForMultipleObjects
IsWindow
DispatchMessageA
TranslateMessage
PostQuitMessage
PeekMessageA
SetWindowLongA
CreateWindowExA
DestroyWindow
PostMessageA
MessageBoxA

advapi32

CryptImportKey
CryptGetProvParam
CryptGetKeyParam
CryptExportKey
CryptAcquireContextA
CryptReleaseContext
CryptGenKey
CryptDestroyKey
CryptGetUserKey
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

_IPWorksSNMP_CertMgr_CheckIndex@12
_IPWorksSNMP_CertMgr_Create@12
_IPWorksSNMP_CertMgr_Destroy@4
_IPWorksSNMP_CertMgr_Do@20
_IPWorksSNMP_CertMgr_Get@16
_IPWorksSNMP_CertMgr_GetLastError@4
_IPWorksSNMP_CertMgr_GetLastErrorCode@4
_IPWorksSNMP_CertMgr_Set@20
_IPWorksSNMP_CertMgr_StaticDestroy@0
_IPWorksSNMP_CertMgr_StaticInit@4
_IPWorksSNMP_MibBrowser_CheckIndex@12
_IPWorksSNMP_MibBrowser_Create@12
_IPWorksSNMP_MibBrowser_Destroy@4
_IPWorksSNMP_MibBrowser_Do@20
_IPWorksSNMP_MibBrowser_Get@16
_IPWorksSNMP_MibBrowser_GetLastError@4
_IPWorksSNMP_MibBrowser_GetLastErrorCode@4
_IPWorksSNMP_MibBrowser_Set@20
_IPWorksSNMP_MibBrowser_StaticDestroy@0
_IPWorksSNMP_MibBrowser_StaticInit@4
_IPWorksSNMP_SNMPAgent_CheckIndex@12
_IPWorksSNMP_SNMPAgent_Create@12
_IPWorksSNMP_SNMPAgent_Destroy@4
_IPWorksSNMP_SNMPAgent_Do@20
_IPWorksSNMP_SNMPAgent_Get@16
_IPWorksSNMP_SNMPAgent_GetLastError@4
_IPWorksSNMP_SNMPAgent_GetLastErrorCode@4
_IPWorksSNMP_SNMPAgent_Set@20
_IPWorksSNMP_SNMPAgent_StaticDestroy@0
_IPWorksSNMP_SNMPAgent_StaticInit@4
_IPWorksSNMP_SNMPMgr_CheckIndex@12
_IPWorksSNMP_SNMPMgr_Create@12
_IPWorksSNMP_SNMPMgr_Destroy@4
_IPWorksSNMP_SNMPMgr_Do@20
_IPWorksSNMP_SNMPMgr_Get@16
_IPWorksSNMP_SNMPMgr_GetLastError@4
_IPWorksSNMP_SNMPMgr_GetLastErrorCode@4
_IPWorksSNMP_SNMPMgr_Set@20
_IPWorksSNMP_SNMPMgr_StaticDestroy@0
_IPWorksSNMP_SNMPMgr_StaticInit@4
_IPWorksSNMP_SNMPTCPAgent_CheckIndex@12
_IPWorksSNMP_SNMPTCPAgent_Create@12
_IPWorksSNMP_SNMPTCPAgent_Destroy@4
_IPWorksSNMP_SNMPTCPAgent_Do@20
_IPWorksSNMP_SNMPTCPAgent_Get@16
_IPWorksSNMP_SNMPTCPAgent_GetLastError@4
_IPWorksSNMP_SNMPTCPAgent_GetLastErrorCode@4
_IPWorksSNMP_SNMPTCPAgent_Set@20
_IPWorksSNMP_SNMPTCPAgent_StaticDestroy@0
_IPWorksSNMP_SNMPTCPAgent_StaticInit@4
_IPWorksSNMP_SNMPTCPMgr_CheckIndex@12
_IPWorksSNMP_SNMPTCPMgr_Create@12
_IPWorksSNMP_SNMPTCPMgr_Destroy@4
_IPWorksSNMP_SNMPTCPMgr_Do@20
_IPWorksSNMP_SNMPTCPMgr_Get@16
_IPWorksSNMP_SNMPTCPMgr_GetLastError@4
_IPWorksSNMP_SNMPTCPMgr_GetLastErrorCode@4
_IPWorksSNMP_SNMPTCPMgr_Set@20
_IPWorksSNMP_SNMPTCPMgr_StaticDestroy@0
_IPWorksSNMP_SNMPTCPMgr_StaticInit@4
_IPWorksSNMP_SNMPTCPTrapMgr_CheckIndex@12
_IPWorksSNMP_SNMPTCPTrapMgr_Create@12
_IPWorksSNMP_SNMPTCPTrapMgr_Destroy@4
_IPWorksSNMP_SNMPTCPTrapMgr_Do@20
_IPWorksSNMP_SNMPTCPTrapMgr_Get@16
_IPWorksSNMP_SNMPTCPTrapMgr_GetLastError@4
_IPWorksSNMP_SNMPTCPTrapMgr_GetLastErrorCode@4
_IPWorksSNMP_SNMPTCPTrapMgr_Set@20
_IPWorksSNMP_SNMPTCPTrapMgr_StaticDestroy@0
_IPWorksSNMP_SNMPTCPTrapMgr_StaticInit@4
_IPWorksSNMP_SNMPTrapMgr_CheckIndex@12
_IPWorksSNMP_SNMPTrapMgr_Create@12
_IPWorksSNMP_SNMPTrapMgr_Destroy@4
_IPWorksSNMP_SNMPTrapMgr_Do@20
_IPWorksSNMP_SNMPTrapMgr_Get@16
_IPWorksSNMP_SNMPTrapMgr_GetLastError@4
_IPWorksSNMP_SNMPTrapMgr_GetLastErrorCode@4
_IPWorksSNMP_SNMPTrapMgr_Set@20
_IPWorksSNMP_SNMPTrapMgr_StaticDestroy@0
_IPWorksSNMP_SNMPTrapMgr_StaticInit@4
get_module

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 359KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9bcbf6671bff2c955daf7796c620cf11

Headers

File Characteristics

Imports

php5

ws2_32

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 359KB - Virtual size: 359KB

.data Size: 84KB - Virtual size: 201KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 99KB - Virtual size: 98KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 359KB - Virtual size: 359KB

.data
Size: 84KB - Virtual size: 201KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 99KB - Virtual size: 98KB