2d246704a639bcc412e959ae08233970N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2d246704a639bcc412e959ae08233970N.exe
Size

53KB
MD5

2d246704a639bcc412e959ae08233970
SHA1

c21499304d628874846825e216c3656c6f514582
SHA256

94b67bfb698b99b14c53f1b5e707c0ef87dc4347e6222b19efb0c3d5e4eb83bf
SHA512

dde9d11664dacf44fb1d5f40e60d96fde3879819309ab6a63e4b98d69b9d89f89789db121511673bf38d924aab3d99dd737a258b49ee845aa8a1b49fb4844091
SSDEEP

768:1qI2EDaTKJnzlGRKTjgmQM8uvNB1ZjiwxJm7a4oI0AO7imkoa8gU:1qzEDaTMnXfdQMHNB1dior45waDU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d246704a639bcc412e959ae08233970N.exe

Files

2d246704a639bcc412e959ae08233970N.exe
.dll windows:6 windows x64 arch:x64

4586261d22b768757d4b6ef063768156

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_gettext.pdb

Imports

php8ts

php_info_print_table_row
php_info_print_table_start
_emalloc@@8
virtual_getcwd
zend_wrong_parameters_count_error@@16
zend_wrong_parameter_error@@40
zend_argument_value_error
zend_parse_parameters
virtual_realpath
php_info_print_table_end
zend_parse_arg_str_slow@@24

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
EnumResourceLanguagesA
GetModuleHandleA
GetLastError
GetProcAddress
GetThreadLocale
GetLocaleInfoA
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
RtlLookupFunctionEntry

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

vcruntime140

__C_specific_handler
strchr
memset
__std_type_info_destroy_list
strstr
memcpy

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
raise
_errno
_initterm
abort
_cexit

api-ms-win-crt-string-l1-1-0

tolower
isupper
isalpha
isdigit
isalnum
isspace
strncmp
_strdup

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fgets
feof
_read
_close
fputs
__stdio_common_vfprintf
putc
fclose
fopen
_getcwd
_open

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

Exports

Exports

get_module

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4586261d22b768757d4b6ef063768156

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

php8ts

kernel32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 168B

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 168B