7bcbb8e10c9c7ab5f63a1836807b77c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7bcbb8e10c9c7ab5f63a1836807b77c0N.exe
Size

7.7MB
MD5

7bcbb8e10c9c7ab5f63a1836807b77c0
SHA1

c7b7dcc3438c9e05dec202464458e1805f6b7e2c
SHA256

85cb92770a1b4f564d73335551bfa51d006d1d198b48ac356183ecb98c331e9b
SHA512

9adf2d238db98affb757ffc43330cc8497d735bd3cbb8d9bf1ac6bb32e8a28c442bdd9a057613283cc2ee7974b97058519d1722a04da7ce4776c7e42f63c2b98
SSDEEP

24576:ofGlM9dNoMUfDlx1W7vnPLO0MCh22c84I4RwHvdEMbEUW4xTJBMWb4rvibItrKsK:osM99rDC

Score

8^/10

Malware Config

Signatures

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7bcbb8e10c9c7ab5f63a1836807b77c0N.exe

Files

7bcbb8e10c9c7ab5f63a1836807b77c0N.exe
.dll windows:6 windows x64 arch:x64

cb42b4c17551c2986ec139ac94770ebc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release\php_fileinfo.pdb

Imports

php8

zend_hash_index_find@@16
php_pcre_free_match_data
php_pcre_mctx
zend_str_tolower_dup@@16
php_localtime_r
php_gmtime_r
ap_php_vasprintf
php_asctime_r
zend_vspprintf
php_pcre_replace_impl
_php_stream_cast
pcre_get_compiled_regex_cache_ex
php_strlcpy
php_ctime_r
php_win32_ioutil_fstat
php_win32_ioutil_normalize_path_w
zval_ptr_dtor
zend_spprintf
php_win32_cp_conv_utf8_to_w
php_win32_code_to_errno
php_win32_cp_conv_cur_to_w
zend_error_noreturn
_estrndup@@16
_php_stream_opendir
_php_stream_get_line
php_pcre2_match
php_win32_cp_get_by_id
_php_stream_read
_erealloc@@16
php_win32_cp_use_unicode
php_pcre_match_impl
php_win32_cp_conv_ascii_to_w
tsrm_win32_access
_ecalloc@@16
php_pcre_create_match_data
php_win32_ioutil_stat_ex_w
_php_stream_readdir
php_win32_cp_conv_to_w
_php_stream_stat_path
ap_php_snprintf
php_stream_locate_url_wrapper
php_info_print_table_start
_php_stream_tell
_emalloc@@8
zend_object_std_init@@16
_efree@@8
zend_throw_error
php_file_le_stream
expand_filepath_with_mode
php_stream_context_alloc
php_file_le_pstream
std_object_handlers
zend_restore_error_handling
php_pcre_pce_re
zend_register_internal_class_ex
file_globals
_estrdup@@8
php_error_docref
object_properties_init
pcre_get_compiled_regex_cache
zend_argument_type_error
zend_parse_method_parameters
zend_fetch_resource2_ex
php_check_open_basedir
zend_replace_error_handling
_php_stream_seek
php_le_stream_context
executor_globals
zend_argument_value_error
zend_parse_parameters
zend_register_long_constant
_php_stream_free
_php_stream_open_wrapper_ex
zend_string_init_interned
zend_throw_exception
php_info_print_table_end
zend_zval_value_name
_php_stream_stat
php_info_print_table_row
zend_object_std_dtor
zend_fetch_resource_ex

kernel32

SetLastError
GetACP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

vcruntime140

memcpy
memmove
memcmp
memchr
strchr
strrchr
__C_specific_handler
__std_type_info_destroy_list
memset
strstr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
_read
_lseeki64
fputc
__stdio_common_vsscanf
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

isupper
isspace
tolower
wcsncmp
strncmp
isalpha
isdigit
strncpy
isprint
isalnum
strcmp
strcspn
toupper
islower

api-ms-win-crt-convert-l1-1-0

_strtoui64
strtod
strtol
strtoul

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_cexit
strerror
_initterm
_initterm_e
_initialize_onexit_table
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv
_execute_onexit_table
_errno
_set_errno

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

strftime
_mktime64

Exports

Exports

finfo_objects_new
get_module

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb42b4c17551c2986ec139ac94770ebc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

php8

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 69KB

.rdata Size: 7.6MB - Virtual size: 7.6MB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 492B

.text
Size: 70KB - Virtual size: 69KB

.rdata
Size: 7.6MB - Virtual size: 7.6MB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 492B