D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release\php_sqlite3.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6942b236d2643d4b4a917318ece4cd60N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6942b236d2643d4b4a917318ece4cd60N.dll
Resource
win10v2004-20240802-en
General
-
Target
6942b236d2643d4b4a917318ece4cd60N.exe
-
Size
58KB
-
MD5
6942b236d2643d4b4a917318ece4cd60
-
SHA1
50dda175ffdc6816f53cc22ca773478293bc38de
-
SHA256
c23f4fa10b44ef85b47c0c415fc2ddd9bb11963d2a326eeec6b0a4f46bb392f7
-
SHA512
f00785d1de1c8fb8fd81e9ce6a1161ca91b27d8f33e6eedc8ac8d05e32296da99b91d1827a66d89a61ebe7dcbf21a0bdd6d493bd9bf0fb0f5de7be55a05ff2fe
-
SSDEEP
768:DuIeebh+O2K120CFizkBVI+e3qX5SucY5bhFl+Mgs4abDpDgQrpRsuo5ubsfVZXe:SIhdh2K1ciyHMuj+MgsxZbMu4fni
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6942b236d2643d4b4a917318ece4cd60N.exe
Files
-
6942b236d2643d4b4a917318ece4cd60N.exe.dll windows:6 windows x64 arch:x64
a173b7915cf0b10d03d3b07cc916f59c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
php8
php_info_print_table_start
zend_ce_exception
zend_spprintf
zend_get_gc_buffer_grow
_emalloc@@8
zend_object_std_init@@16
_efree@@8
zend_throw_error
php_file_le_stream
zend_hash_index_update@@24
convert_to_double@@8
zend_std_get_properties
zend_llist_init
php_file_le_pstream
std_object_handlers
zend_vspprintf
_php_stream_copy_to_mem
_zend_handle_numeric_str_ex@@24
empty_fcall_info
_zend_hash_init@@32
zend_wrong_parameters_count_error@@16
convert_to_long@@8
zend_register_internal_class_ex
zend_call_known_function
zend_wrong_parameters_none_error@@0
zend_wrong_parameter_error@@40
display_ini_entries
php_error_docref
zend_unregister_ini_entries_ex
zend_get_gc_buffer_create
zend_llist_add_element
zend_declare_typed_class_constant
object_properties_init
add_assoc_long_ex
zend_parse_arg_bool_slow@@24
zend_fetch_resource2_ex
php_check_open_basedir
tsrm_realpath
_estrdup@@8
executor_globals
zval_try_get_string_func@@8
zend_objects_store_del@@8
zend_hash_update@@24
_safe_emalloc@@24
zend_argument_value_error
gc_possible_root@@8
_zend_new_array@@8
expand_filepath
zend_empty_array
zend_parse_parameters
zend_register_long_constant
zend_std_get_gc
__zend_malloc
zend_hash_index_del@@16
zend_ini_boolean_displayer_cb
zend_string_init_interned
zend_llist_clean
zend_hash_destroy@@8
zend_throw_exception
zval_ptr_dtor
core_globals
zend_parse_arg_long_slow@@24
zend_release_fcall_info_cache
php_info_print_table_end
empty_fcall_info_cache
zend_llist_del_element
add_assoc_zval_ex
OnUpdateString
php_info_print_table_row
zend_object_std_dtor
_php_stream_alloc
zend_register_ini_entries_ex
_ecalloc@@16
add_assoc_string_ex
zval_get_string_func@@8
zend_parse_arg_str_or_long_slow@@32
object_init_ex
zend_empty_string
OnUpdateBool
zend_throw_exception_ex
zend_fcall_info_init
libsqlite3
sqlite3_libversion_number
sqlite3_extended_result_codes
sqlite3_reset
sqlite3_bind_int64
sqlite3_clear_bindings
sqlite3_column_double
sqlite3_value_double
sqlite3_backup_step
sqlite3_bind_parameter_count
sqlite3_errmsg
sqlite3_column_blob
sqlite3_step
sqlite3_blob_open
sqlite3_enable_load_extension
sqlite3_column_name
sqlite3_value_bytes
sqlite3_libversion
sqlite3_errcode
sqlite3_db_config
sqlite3_load_extension
sqlite3_column_bytes
sqlite3_bind_null
sqlite3_errstr
sqlite3_create_function
sqlite3_column_int64
sqlite3_mprintf
sqlite3_exec
sqlite3_expanded_sql
sqlite3_value_int64
sqlite3_value_type
sqlite3_result_text
sqlite3_data_count
sqlite3_blob_bytes
sqlite3_result_null
sqlite3_close
sqlite3_prepare_v2
sqlite3_extended_errcode
sqlite3_backup_finish
sqlite3_open_v2
sqlite3_stmt_readonly
sqlite3_bind_text
sqlite3_value_text
sqlite3_blob_read
sqlite3_aggregate_context
sqlite3_bind_double
sqlite3_create_collation
sqlite3_set_authorizer
sqlite3_sql
sqlite3_blob_close
sqlite3_column_text
sqlite3_last_insert_rowid
sqlite3_backup_init
sqlite3_free
sqlite3_changes
sqlite3_result_error
sqlite3_blob_write
sqlite3_finalize
sqlite3_bind_blob
sqlite3_column_count
sqlite3_bind_parameter_index
sqlite3_column_type
sqlite3_user_data
sqlite3_busy_timeout
sqlite3_result_int64
sqlite3_result_double
sqlite3_db_handle
vcruntime140
memcpy
__std_type_info_destroy_list
__C_specific_handler
memset
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initialize_narrow_environment
_execute_onexit_table
_seh_filter_dll
_initterm_e
_initterm
_configure_narrow_argv
_cexit
kernel32
GetCurrentProcessId
RtlLookupFunctionEntry
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
Exports
Exports
get_module
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ