D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release\php_sqlite3.pdb
Static task
static1
Behavioral task
behavioral1
Sample
08870d36cf2db963b716f1bac56bc9b0N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
08870d36cf2db963b716f1bac56bc9b0N.dll
Resource
win10v2004-20240709-en
General
-
Target
08870d36cf2db963b716f1bac56bc9b0N.exe
-
Size
56KB
-
MD5
08870d36cf2db963b716f1bac56bc9b0
-
SHA1
6d0b1036b89affa6ffc8d4cbfe50fc5edc2eef0a
-
SHA256
11d64cb71567d7456ad0c7f1e2b8c1b57c088fa9ecb53872028c4942e8167c77
-
SHA512
532e42a49135f97222bd3efbb8180e9b00ba92c688f8d625aabff58048e089c6014d94cc52711b1eeef0873cf7487857775bd0d1657921541c3cbdaacb799fba
-
SSDEEP
768:Gi1nArOgBQ160tnW4/CX4ewEMlAKhJjXPl+Mgsj8rQXNAL4SqbnOp/5IuZl47T6:Gy+zBeWupEojX9+Mgsj8rMeF5ZZlq6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08870d36cf2db963b716f1bac56bc9b0N.exe
Files
-
08870d36cf2db963b716f1bac56bc9b0N.exe.dll windows:6 windows x64 arch:x64
1248c74f84aaaa92826162693c5c869f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
php8
php_info_print_table_start
zend_ce_exception
zend_spprintf
zend_get_gc_buffer_grow
_emalloc@@8
zend_object_std_init@@16
_efree@@8
zend_throw_error
php_file_le_stream
zend_hash_index_update@@24
convert_to_double@@8
zend_std_get_properties
zend_llist_init
php_file_le_pstream
std_object_handlers
zend_vspprintf
_php_stream_copy_to_mem
_zend_handle_numeric_str_ex@@24
_zend_hash_init@@32
zend_wrong_parameters_count_error@@16
convert_to_long@@8
zend_register_internal_class_ex
zend_call_known_function
zend_wrong_parameters_none_error@@0
zend_wrong_parameter_error@@40
zend_declare_class_constant_ex
display_ini_entries
php_error_docref
zend_unregister_ini_entries_ex
zend_get_gc_buffer_create
zend_llist_add_element
object_properties_init
add_assoc_long_ex
zend_parse_arg_bool_slow@@24
zend_fetch_resource2_ex
php_check_open_basedir
tsrm_realpath
zend_is_callable_ex
_estrdup@@8
executor_globals
zval_try_get_string_func@@8
zend_objects_store_del@@8
zend_hash_update@@24
_safe_emalloc@@24
zend_argument_value_error
gc_possible_root@@8
_zend_new_array@@8
expand_filepath
zend_empty_array
zend_parse_parameters
zend_register_long_constant
zend_std_get_gc
__zend_malloc
zend_hash_index_del@@16
zend_ini_boolean_displayer_cb
zend_string_init_interned
zend_llist_clean
zend_hash_destroy@@8
zend_throw_exception
zval_ptr_dtor
core_globals
zend_parse_arg_long_slow@@24
zend_release_fcall_info_cache
php_info_print_table_end
empty_fcall_info_cache
zend_llist_del_element
add_assoc_zval_ex
OnUpdateString
php_info_print_table_row
zend_object_std_dtor
_php_stream_alloc
zend_register_ini_entries_ex
_ecalloc@@16
add_assoc_string_ex
zval_get_string_func@@8
zend_parse_arg_str_or_long_slow@@32
object_init_ex
zend_empty_string
OnUpdateBool
zend_throw_exception_ex
zend_fcall_info_init
libsqlite3
sqlite3_libversion_number
sqlite3_extended_result_codes
sqlite3_reset
sqlite3_bind_int64
sqlite3_clear_bindings
sqlite3_column_double
sqlite3_value_double
sqlite3_backup_step
sqlite3_bind_parameter_count
sqlite3_errmsg
sqlite3_column_blob
sqlite3_step
sqlite3_blob_open
sqlite3_enable_load_extension
sqlite3_column_name
sqlite3_value_bytes
sqlite3_libversion
sqlite3_errcode
sqlite3_db_config
sqlite3_load_extension
sqlite3_column_bytes
sqlite3_bind_null
sqlite3_errstr
sqlite3_create_function
sqlite3_column_int64
sqlite3_mprintf
sqlite3_exec
sqlite3_expanded_sql
sqlite3_value_int64
sqlite3_value_type
sqlite3_result_text
sqlite3_data_count
sqlite3_blob_bytes
sqlite3_result_null
sqlite3_close
sqlite3_prepare_v2
sqlite3_extended_errcode
sqlite3_backup_finish
sqlite3_open_v2
sqlite3_stmt_readonly
sqlite3_aggregate_context
sqlite3_bind_double
sqlite3_create_collation
sqlite3_set_authorizer
sqlite3_sql
sqlite3_blob_close
sqlite3_column_text
sqlite3_last_insert_rowid
sqlite3_backup_init
sqlite3_free
sqlite3_changes
sqlite3_result_error
sqlite3_blob_write
sqlite3_finalize
sqlite3_bind_blob
sqlite3_column_count
sqlite3_bind_parameter_index
sqlite3_column_type
sqlite3_user_data
sqlite3_busy_timeout
sqlite3_result_int64
sqlite3_result_double
sqlite3_db_handle
sqlite3_blob_read
sqlite3_value_text
sqlite3_bind_text
vcruntime140
memmove
memcpy
__std_type_info_destroy_list
__C_specific_handler
memset
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initialize_narrow_environment
_execute_onexit_table
_seh_filter_dll
_initterm_e
_initterm
_configure_narrow_argv
_cexit
kernel32
GetCurrentProcessId
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Exports
Exports
get_module
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ