5216649ae5dbecb345acc25aff6a1510N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

5216649ae5dbecb345acc25aff6a1510N.exe
Size

937KB
MD5

5216649ae5dbecb345acc25aff6a1510
SHA1

0542cf3d4637d2337fa301fe8eb013a92dab0f3b
SHA256

dad5ada29fb1a640ec7fe1812f2dad8a57ad1fd0d818e7517b968167fd5c81e8
SHA512

aedf4dc4f68e66d1b50f8f9599eed54e20b3a61db9d99341c56746940b006b735b8cae869150dcee4121598a34d2d88ecf8e42d9618877ae537a0ca56a92f1f3
SSDEEP

24576:ledWzZ8zii1vp7Jnu34BohNL6VN5fjznDBIX:ledN1vVJuu9nnDB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5216649ae5dbecb345acc25aff6a1510N.exe

Files

5216649ae5dbecb345acc25aff6a1510N.exe
.dll windows:6 windows x64 arch:x64

18ff3687a3b8d44c435f2360467ef6a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release\php_imap.pdb

Imports

php8

zend_array_destroy@@8
zend_object_std_init@@16
_efree@@8
zend_throw_error
php_file_le_stream
zend_update_property
php_file_le_pstream
std_object_handlers
zend_update_property_long
_emalloc@@8
add_assoc_stringl_ex
zend_register_internal_class_ex
zend_wrong_parameters_none_error@@0
zend_hash_next_index_insert_new@@16
file_globals
display_ini_entries
php_error_docref
_estrndup@@16
object_properties_init
zend_one_char_string
add_assoc_long_ex
zend_spprintf
zend_argument_type_error
zend_fetch_resource2_ex
zval_get_long_func@@16
zend_hash_str_find@@24
php_info_print_table_start
php_check_open_basedir
_php_stream_write
_convert_to_string@@8
_estrdup@@8
executor_globals
zend_array_dup@@8
zend_error
zend_hash_next_index_insert@@16
ap_php_slprintf
php_pcre_match_impl
_safe_emalloc@@24
zend_argument_value_error
_zend_new_array@@8
zend_empty_array
zend_parse_parameters
zend_register_long_constant
_php_stream_free
_php_stream_open_wrapper_ex
zend_known_strings
__zend_malloc
php_strlcpy
_erealloc@@16
zend_ini_boolean_displayer_cb
zend_string_init_interned
ap_php_snprintf
_try_convert_to_string@@8
smart_str_erealloc@@16
pcre_get_compiled_regex_cache
zend_throw_exception
zend_ini_string_ex
zval_ptr_dtor
php_info_print_table_end
compiler_globals
_safe_erealloc@@32
zend_zval_value_name
add_next_index_long
php_strlcat
add_assoc_zval_ex
php_info_print_table_row
zend_object_std_dtor
add_next_index_string
zend_update_property_string
zend_register_ini_entries_ex
GetSMErrorText
object_init_ex
zend_hash_index_find@@16
object_init
zend_update_property_str
zend_empty_string
OnUpdateBool
zend_ce_value_error
zend_add_attribute
TSendMail

winmm

timeSetEvent
timeBeginPeriod

ws2_32

WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAGetLastError
getaddrinfo
WSAStartup
getprotobyname
getservbyname
gethostname
socket
send
freeaddrinfo
getnameinfo
WSACleanup
closesocket
connect
ioctlsocket
getpeername
getsockname
htonl
htons
ntohs
recv
select

secur32

InitializeSecurityContextA
DeleteSecurityContext
QueryContextAttributesA
FreeContextBuffer
EncryptMessage
DecryptMessage
EnumerateSecurityPackagesA
FreeCredentialsHandle
AcquireCredentialsHandleA

crypt32

CertFreeCertificateContext
CertNameToStrA
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy

kernel32

UnhandledExceptionFilter
RtlVirtualUnwind
TerminateProcess
RtlCaptureContext
QueryPerformanceCounter
GetProcAddress
RtlLookupFunctionEntry
SetUnhandledExceptionFilter
CreateFileA
LockFileEx
UnlockFileEx
CloseHandle
GetLastError
Sleep
GetCurrentProcess
GetVersionExA
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA

advapi32

OpenProcessToken
LogonUserA
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
ImpersonateLoggedOnUser
RegisterEventSourceA
ReportEventA

vcruntime140

__std_type_info_destroy_list
__intrinsic_setjmp
__C_specific_handler
strrchr
memmove
memset
memcpy
strstr
strchr
memchr

api-ms-win-crt-string-l1-1-0

isalpha
isdigit
iscntrl
isxdigit
_stricmp
strncmp
strtok_s
isalnum
strncpy
isgraph
strcmp
strpbrk

api-ms-win-crt-heap-l1-1-0

malloc
free
realloc

api-ms-win-crt-stdio-l1-1-0

rewind
getc
_chsize
_lseek
_open
_read
_fileno
__stdio_common_vfprintf
_write
ftell
fopen
fseek
__acrt_iob_func
putc
_open_osfhandle
_get_osfhandle
_setmode
_close
_tempnam
putchar
ungetc
fflush
fclose
fgets
getchar
_commit
fputs
__stdio_common_vsprintf
fwrite
fread

api-ms-win-crt-time-l1-1-0

_localtime64
_gmtime64
_time64
_utime64
clock
__tzname
__daylight
_tzset
_ctime64

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-convert-l1-1-0

strtol
atoi
atol
strtoul

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_findclose
_findfirst64i32
rename
_findnext64i32
_unlink
_rmdir
_access
_mkdir
_stat64i32

api-ms-win-crt-runtime-l1-1-0

_exit
exit
strerror
abort
_getpid
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_errno

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-conio-l1-1-0

_getch

Exports

Exports

get_module

Sections

.text
Size: 421KB - Virtual size: 421KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 402KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18ff3687a3b8d44c435f2360467ef6a4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

php8

winmm

ws2_32

secur32

crypt32

kernel32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

Exports

Exports

Sections

.text Size: 421KB - Virtual size: 421KB

.rdata Size: 402KB - Virtual size: 401KB

.data Size: 88KB - Virtual size: 94KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 421KB - Virtual size: 421KB

.rdata
Size: 402KB - Virtual size: 401KB

.data
Size: 88KB - Virtual size: 94KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB