C:\php-sdk\php53dev\Release_TS\php_soap.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6565820b4bd1f933871d8d840abe12432fa5d4ec0b05317b80c7d5d84b0405c8.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6565820b4bd1f933871d8d840abe12432fa5d4ec0b05317b80c7d5d84b0405c8.dll
Resource
win10v2004-20240704-en
General
-
Target
6565820b4bd1f933871d8d840abe12432fa5d4ec0b05317b80c7d5d84b0405c8
-
Size
247KB
-
MD5
a05eeae35502e19fbd0d1e42ed79611f
-
SHA1
61839d38013383006502b1596af22954366b4d89
-
SHA256
6565820b4bd1f933871d8d840abe12432fa5d4ec0b05317b80c7d5d84b0405c8
-
SHA512
027b6205e986dfa30c9432843ae65483e9a46083b7ed91254639d6bcfba7f1c05a1704bc3024c491e1dee4eae2b14aff99860dc6434f8ec3b55958f663aab1c2
-
SSDEEP
3072:peMAJkrH4nhoajaQNohuspbCvc2n4vjj4zASNZCuG8oLGRMcRAPGcCX:ps+Hbaj76pbOc2n4LPSSuIgAPGJX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6565820b4bd1f933871d8d840abe12432fa5d4ec0b05317b80c7d5d84b0405c8
Files
-
6565820b4bd1f933871d8d840abe12432fa5d4ec0b05317b80c7d5d84b0405c8.dll windows:5 windows x86 arch:x86
904cab4036ba6565d21b95245dc2c96f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
php5ts
zend_standard_class_def
_estrdup
add_property_string_ex
add_property_long_ex
zend_binary_strncasecmp
xmlFreeDoc
xmlDocCopyNode
xmlNewTextLen
php_libxml_xmlCheckUTF8
xmlCharEncInFunc
_convert_to_string
php_base64_encode
xmlNodeSetContentLen
convert_to_long
ap_php_snprintf
php_gcvt
convert_to_double
zend_is_true
zend_unmangle_property_name
xmlUnlinkNode
add_index_zval
instanceof_function
zend_ce_traversable
php_localtime_r
xmlStringTextNoenc
zend_hash_exists
php_stream_context_get_option
_php_stream_eof
_php_stream_getc
_php_stream_read
_php_stream_get_line
php_stream_xport_crypto_enable
php_stream_xport_crypto_setup
_php_stream_free
_php_stream_write
_php_stream_xport_create
spprintf
php_url_free
add_assoc_string_ex
add_index_string
zend_hash_index_exists
add_index_bool
add_index_stringl
add_property_stringl_ex
add_assoc_long_ex
make_digest
PHP_MD5Final
PHP_MD5Update
php_rand
PHP_MD5Init
zend_list_insert
add_property_resource_ex
php_stream_locate_url_wrapper
core_globals_id
php_stream_context_alloc
file_globals_id
php_le_stream_context
php_url_parse
zend_fetch_resource
php_file_le_stream
php_file_le_pstream
compiler_globals_id
gc_remove_zval_from_buffer
xmlGetIntSubset
xmlStrcmp
zend_hash_copy
zend_hash_get_current_key_type_ex
xmlFree
xmlBuildURI
xmlNodeGetBase
php_stream_context_set_option
zend_fetch_class
xmlGetLastError
zend_strndup
php_strtolower
php_error_docref0
_zend_list_addref
php_get_current_user
virtual_realpath
xmlFreeParserCtxt
xmlCharStrdup
xmlParseDocument
php_libxml_disable_entity_loader
xmlCreateFileParserCtxt
xmlCreateMemoryParserCtxt
OnUpdateLong
OnUpdateBool
OnUpdateString
php_check_open_basedir
php_checkuid
zend_unregister_ini_entries
zend_error_cb
display_ini_entries
php_info_print_table_end
php_info_print_table_row
php_info_print_table_start
zend_parse_parameters
add_property_bool_ex
zend_call_function
zend_read_property
zval_add_ref
zval_property_ctor
xmlFindCharEncodingHandler
zend_parse_parameters_ex
zend_lookup_class
add_next_index_string
zend_str_tolower_copy
zend_clear_exception
php_write
zend_alter_ini_entry
zend_ini_long
sapi_add_header_ex
zend_is_auto_global
xmlDocDumpMemory
_zend_bailout
xmlCharEncCloseFunc
add_property_null_ex
zend_update_property_string
zend_exception_get_default
add_next_index_stringl
php_end_ob_buffer
php_ob_get_buffer
php_ob_get_length
zend_throw_exception_object
ap_php_vslprintf
sapi_globals_id
xmlNewChild
xmlBuildQName
php_escape_html_entities
xmlDocSetRootElement
xmlNewDocNode
xmlNewDoc
php_session_start
ps_globals_id
php_start_ob_buffer
zend_register_string_constant
zend_register_long_constant
zend_register_list_destructors
zend_register_internal_class_ex
zend_register_internal_class
zend_register_ini_entries
ts_allocate_id
_object_init_ex
xmlNewText
xmlNodeSetContent
_array_init
add_next_index_zval
add_string_to_string
add_assoc_zval_ex
xmlNewNode
xmlAddChild
zend_objects_get_address
xmlNodeSetName
xmlSetNs
xmlSetProp
zend_hash_get_current_key_ex
zend_hash_destroy
_zend_hash_init
xmlSetNsProp
xmlSearchNsByHref
xmlNewNs
xmlStrEqual
_safe_emalloc
zend_hash_num_elements
zend_hash_del_key_or_index
zend_get_property_info
zend_hash_quick_exists
zend_get_class_entry
add_property_zval_ex
convert_to_boolean
php_get_nan
php_get_inf
php_base64_decode
xmlStrlen
xmlBufferCreateStatic
xmlCharEncOutFunc
xmlCopyNode
xmlBufferCreate
xmlNodeDump
_emalloc
xmlBufferContent
_estrndup
xmlBufferFree
xmlFreeNode
zval_used_for_init
executor_globals_id
call_user_function
ts_resource_ex
_erealloc
zend_hash_find
_efree
xmlSearchNs
_zval_ptr_dtor
zend_hash_index_find
zend_hash_internal_pointer_reset_ex
zend_hash_get_current_data_ex
zend_hash_move_forward_ex
_zval_copy_ctor_func
_zval_dtor_func
zend_strtod
zend_hex_strtod
zend_error
_zend_hash_index_update_or_next_insert
php_libxml_switch_context
_zend_hash_add_or_update
msvcr90
_stricmp
_timezone
_close
_write
_open
_strdup
_read
_strnicmp
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_setjmp3
memchr
_time32
_fstat32
malloc
__iob_func
fprintf
exit
strstr
strncpy
atoi
sscanf
strchr
strftime
strncmp
floor
strrchr
free
memset
_errno
memcpy
strtol
_unlink
kernel32
GetCurrentThreadId
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
InterlockedExchange
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
Exports
Exports
get_module
Sections
.text Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ