dfb9a4987404a60c2fc72397efbc29b6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dfb9a4987404a60c2fc72397efbc29b6_JaffaCakes118
Size

2.0MB
MD5

dfb9a4987404a60c2fc72397efbc29b6
SHA1

0e4eee3c87c917a7a07983f0b305313a59dd51d3
SHA256

4b8a23f88539ca9a3d0c959802f20706553d4507b5d39e69024eef9d3d38ee3d
SHA512

46648bd134e934ddaa710cca0035a1565f0d283ad4a957018275ee090ad94749ac8a6ed5f696087c9424d23ba8f568598d33dc1db0946e2808dea8c033140524
SSDEEP

49152:iynitcplvpel1nnkycW4AaioGiVzt1mxda+FrkU81acdnv3PTefv:iynXpknkfP/4qzmQ+FAvaivfA

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/phpddoszysmq/skin/SkinH_EL.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/phpddoszysmq/skin/SkinH_EL.dll	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/phpddoszysmq/php.exe
unpack001/phpddoszysmq/php5ts.dll
unpack001/phpddoszysmq/skin/SkinH_EL.dll
unpack001/phpddoszysmq/扫phpddos.exe

Files

dfb9a4987404a60c2fc72397efbc29b6_JaffaCakes118
.rar
phpddoszysmq/php.exe
.exe windows:4 windows x86 arch:x86

13c2eeb9e271560a71898c4998eb0d9f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

php5ts

php_print_info
php_end_ob_buffers
php_request_startup
php_body_write
core_globals_id
executor_globals_id
compiler_globals_id
ts_resource_ex
sapi_startup
tsrm_startup
zend_hash_destroy
zend_hash_apply_with_argument
zend_hash_sort
php_printf
zend_hash_copy
module_registry
_zend_hash_init
zend_llist_destroy
zend_llist_apply_with_argument
zend_llist_sort
zend_llist_copy
zend_extensions
zend_strndup
_php_stream_free
zend_register_constant
_php_stream_open_wrapper_ex
virtual_fopen
get_zend_version
sapi_module
zend_load_extension
sapi_deactivate
zend_ini_deactivate
zend_is_auto_global
php_execute_script
php_lint_script
zend_printf
open_file_for_scanning
zend_strip
php_get_highlight_struct
zend_highlight
zend_eval_string_ex
_emalloc
_zend_hash_add_or_update
_php_stream_get_line
_estrndup
reflection_extension_ptr
reflection_class_ptr
reflection_method_ptr
reflection_function_ptr
_object_init_ex
zend_call_method
_zval_ptr_dtor
zend_exception_get_default
zend_read_property
reflection_ptr
php_request_shutdown
php_module_shutdown
sapi_shutdown
tsrm_shutdown
php_module_startup
_efree
sapi_globals_id
php_import_environment_variables
php_register_variable
php_handle_aborted_connection
php_module_shutdown_wrapper
zend_qsort
zend_error

msvcrt

_stricmp
_strdup
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
fgetc
ftell
fseek
rewind
strrchr
_setjmp3
_fmode
malloc
strchr
__mb_cur_max
_isctype
_pctype
realloc
printf
fclose
strstr
exit
free
fflush
_errno
fwrite
_iob
fprintf
_setmode

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
phpddoszysmq/php5ts.dll
.dll windows:4 windows x86 arch:x86

df5520e35226d651d139f376913b9dfd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
VarRound
VarAbs
VarFix
VarInt
VarNeg
VarNot
VarAdd
VarCat
VarSu
VarMul
VarAnd
VarDiv
VarEqv
VarIdiv
VarImp
VarMod
VarOr
VarPow
VarXor
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringByteLen
LoadRegTypeLi
LoadTypeLi
SafeArrayGetElement
VariantCopyInd
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopy
VarCmp
LHashValOfNameSys
SafeArrayGetVartype
VariantChangeType
SafeArrayPutElement
SafeArrayGetDim
VariantInit
VariantClear
SysFreeString
GetActiveObject

odbc32

ord70
ord53
ord52
ord67
ord66
ord65
ord47
ord60
ord56
ord40
ord54
ord42
ord61
ord20
ord2
ord1
ord50
ord41
ord7
ord59
ord13
ord43
ord11
ord57
ord17
ord21
ord58
ord72
ord12
ord48
ord49
ord3
ord45
ord51
ord19
ord63
ord18
ord6
ord4
ord10
ord9
ord23
ord14
ord15
ord16

kernel32

SetLastError
GetACP
GetModuleHandleA
ReleaseMutex
CreateMutexA
GetCurrentProcessId
SetErrorMode
TerminateProcess
GetComputerNameA
Sleep
SetEnvironmentVariableA
GetTimeZoneInformation
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
GetFullPathNameA
OpenFileMappingA
MapViewOfFileEx
GetExitCodeProcess
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessA
GetBinaryTypeA
GetFileAttributesExA
GetCurrentDirectoryA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
CreateWaitableTimerA
SetWaitableTimer
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FindClose
FindNextFileA
IsDBCSLeadByte
FindFirstFileA
GetLastError
UnlockFileEx
LockFileEx
CreateFileMappingA
GetFileSize
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
GetFileType
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
GetWindowsDirectoryA
LocalFree
FormatMessageA
GetSystemDirectoryA
OutputDebugStringA
GetVersion
LoadLibraryA
GetProcAddress
InterlockedIncrement
GetCurrentThreadId
CloseHandle
SetEvent
CreateEventA
WaitForSingleObject
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
FreeLibrary
HeapCreate
GetDiskFreeSpaceA

ole32

CLSIDFromProgID
CoDisconnectObject
OleLoadFromStream
CoTaskMemAlloc
CoCreateGuid
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CreateBindCtx
MkParseDisplayName
CoCreateInstanceEx
CoCreateInstance
CoInitialize
CoUninitialize

user32

KillTimer
DestroyWindow
SendMessageA
GetMessageA
CreateWindowExA
RegisterClassA
DefWindowProcA
SetTimer
PostQuitMessage
PostThreadMessageA
MessageBoxA
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageA
PeekMessageA
UnregisterClassA

advapi32

RegEnumKeyA
RegQueryValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegQueryValueExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegNotifyChangeKeyValue
RegCloseKey
GetUserNameA

ws2_32

ntohs
gethostbyaddr
getservbyname
inet_addr
gethostbyname
htonl
inet_ntoa
WSASetLastError
socket
getservbyport
setsockopt
bind
closesocket
ioctlsocket
connect
getsockopt
WSACleanup
WSAStartup
WSAGetLastError
getpeername
getsockname
accept
__WSAFDIsSet
select
send
recv
shutdown
recvfrom
sendto
listen
gethostname
ntohl
getprotobyname
getprotobynumber
htons

msvcrt

_CIcosh
_CIsinh
_CIasin
ceil
getc
mblen
strcspn
atof
strtod
_atoi64
floor
_CIacos
sscanf
strlen
fgets
mktime
putchar
_open_osfhandle
_fdopen
_strdup
rename
_mbstok
atoi
sprintf
malloc
fopen
calloc
free
longjmp
exit
realloc
_setjmp3
strtol
_ftol
strstr
fprintf
_iob
getenv
strncmp
memmove
memchr
_pctype
_isctype
__mb_cur_max
_beginthreadex
strpbrk
fclose
_errno
printf
toupper
_CIpow
strcoll
tolower
_finite
fread
ftell
_HUGE
strchr
time
strftime
strrchr
setlocale
strncpy
strtoul
strerror
fwrite
qsort
vsprintf
__p__environ
localtime
ctime
asctime
gmtime
atol
memcpy
_dup
_umask
_putenv
_rmdir
_mkdir
_creat
_chmod
_utime
_getcwd
_stat
_open
_chsize
_fstat
_read
_lseek
_unlink
_write
_fileno
_isatty
_strnicmp
_stricmp
localeconv
_hypot
_adjust_fdiv
_initterm
memcmp
strcmp
memset
_fpclass
_isnan
rewind
_get_osfhandle
fflush
fseek
setvbuf
strtok
_daylight
_timezone
_tzset
_access
_getpid
_CItanh
abort
_wfopen
_wstat
_snprintf
vfprintf
fputc
_vsnprintf
strspn
strncat
_close
_CIfmod
_memicmp

Exports

Exports

GetSMErrorText
OnUpdateBool
OnUpdateLong
OnUpdateLongGEZero
OnUpdateReal
OnUpdateString
OnUpdateStringUnempty
PHP_3HAVAL128Init
PHP_3HAVAL160Init
PHP_3HAVAL192Init
PHP_3HAVAL224Init
PHP_3HAVAL256Init
PHP_3TIGERInit
PHP_4HAVAL128Init
PHP_4HAVAL160Init
PHP_4HAVAL192Init
PHP_4HAVAL224Init
PHP_4HAVAL256Init
PHP_4TIGERInit
PHP_5HAVAL128Init
PHP_5HAVAL160Init
PHP_5HAVAL192Init
PHP_5HAVAL224Init
PHP_5HAVAL256Init
PHP_ADLER32Final
PHP_ADLER32Init
PHP_ADLER32Update
PHP_CRC32BUpdate
PHP_CRC32Final
PHP_CRC32Init
PHP_CRC32Update
PHP_GOSTFinal
PHP_GOSTInit
PHP_GOSTUpdate
PHP_HAVAL128Final
PHP_HAVAL160Final
PHP_HAVAL192Final
PHP_HAVAL224Final
PHP_HAVAL256Final
PHP_HAVALUpdate
PHP_MD2Final
PHP_MD2Init
PHP_MD2Update
PHP_MD4Final
PHP_MD4Update
PHP_MD5Final
PHP_MD5Init
PHP_MD5Update
PHP_RIPEMD128Final
PHP_RIPEMD128Init
PHP_RIPEMD128Update
PHP_RIPEMD160Final
PHP_RIPEMD160Init
PHP_RIPEMD160Update
PHP_RIPEMD256Final
PHP_RIPEMD256Init
PHP_RIPEMD256Update
PHP_RIPEMD320Final
PHP_RIPEMD320Init
PHP_RIPEMD320Update
PHP_SHA1Final
PHP_SHA1Init
PHP_SHA1Update
PHP_SHA256Final
PHP_SHA256Init
PHP_SHA256Update
PHP_SHA384Final
PHP_SHA384Init
PHP_SHA384Update
PHP_SHA512Final
PHP_SHA512Init
PHP_SHA512Update
PHP_SNEFRUFinal
PHP_SNEFRUInit
PHP_SNEFRUUpdate
PHP_TIGER128Final
PHP_TIGER160Final
PHP_TIGER192Final
PHP_TIGERUpdate
PHP_WHIRLPOOLFinal
PHP_WHIRLPOOLInit
PHP_WHIRLPOOLUpdate
TSMClose
TSendMail
UTF8ToHtml
UTF8Toisolat1
ValidateFormat
XML_GetUserData
_DllMain@12
__docbDefaultSAXHandler
__htmlDefaultSAXHandler
__oldXMLWDcompatibility
__xmlBufferAllocScheme
__xmlDefaultBufferSize
__xmlDefaultSAXHandler
__xmlDefaultSAXLocator
__xmlDeregisterNodeDefaultValue
__xmlDoValidityCheckingDefaultValue
__xmlGenericError
__xmlGenericErrorContext
__xmlGetWarningsDefaultValue
__xmlIndentTreeOutput
__xmlKeepBlanksDefaultValue
__xmlLineNumbersDefaultValue
__xmlLoadExtDtdDefaultValue
__xmlParserDebugEntities
__xmlParserVersion
__xmlPedanticParserDefaultValue
__xmlRegisterNodeDefaultValue
__xmlSaveNoEmptyTags
__xmlSubstituteEntitiesDefaultValue
__xmlTreeIndentString
_array_init
_convert_to_string
_ecalloc
_efree
_emalloc
_erealloc
_estrdup
_estrndup
_libiconv_version
_object_and_properties_init
_object_init
_object_init_ex
_php_emit_fd_setsize_warning
_php_error_log
_php_find_ps_module
_php_find_ps_serializer
_php_get_stream_filters_hash
_php_math_basetolong
_php_math_basetozval
_php_math_longtobase
_php_math_number_format
_php_math_zvaltobase
_php_stream_alloc
_php_stream_cast
_php_stream_copy_to_mem
_php_stream_copy_to_stream
_php_stream_eof
_php_stream_filter_alloc
_php_stream_filter_append
_php_stream_filter_flush
_php_stream_filter_prepend
_php_stream_flush
_php_stream_fopen
_php_stream_fopen_from_fd
_php_stream_fopen_from_file
_php_stream_fopen_from_pipe
_php_stream_fopen_temporary_file
_php_stream_fopen_tmpfile
_php_stream_fopen_with_path
_php_stream_free
_php_stream_get_line
_php_stream_get_url_stream_wrappers_hash
_php_stream_getc
_php_stream_make_seekable
_php_stream_memory_create
_php_stream_memory_get_buffer
_php_stream_memory_open
_php_stream_mkdir
_php_stream_mmap_range
_php_stream_mmap_unmap
_php_stream_open_wrapper_as_file
_php_stream_open_wrapper_ex
_php_stream_opendir
_php_stream_passthru
_php_stream_printf
_php_stream_putc
_php_stream_puts
_php_stream_read
_php_stream_readdir
_php_stream_rmdir
_php_stream_scandir
_php_stream_seek
_php_stream_set_option
_php_stream_sock_open_from_socket
_php_stream_sock_open_host
_php_stream_stat
_php_stream_stat_path
_php_stream_tell
_php_stream_temp_create
_php_stream_temp_open
_php_stream_truncate_set_size
_php_stream_write
_php_stream_xport_create
_regcomp@12
_regerror@16
_regexec@20
_regfree@4
_safe_emalloc
_safe_malloc
_xml_zval_strdup
_zend_bailout
_zend_get_parameters_array
_zend_get_parameters_array_ex
_zend_hash_add_or_update
_zend_hash_index_update_or_next_insert
_zend_hash_init
_zend_hash_init_ex
_zend_hash_merge
_zend_hash_quick_add_or_update
_zend_list_addref
_zend_list_delete
_zend_list_find
_zend_mem_block_size
_zend_mm_alloc
_zend_mm_block_size
_zend_mm_free
_zend_mm_realloc
_zend_ts_hash_add_or_update
_zend_ts_hash_index_update_or_next_insert
_zend_ts_hash_init
_zend_ts_hash_init_ex
_zend_ts_hash_quick_add_or_update
_zval_copy_ctor_func
_zval_dtor_func
_zval_internal_dtor
_zval_internal_ptr_dtor
_zval_ptr_dtor
add_assoc_bool_ex
add_assoc_double_ex
add_assoc_function
add_assoc_long_ex
add_assoc_null_ex
add_assoc_resource_ex
add_assoc_string_ex
add_assoc_stringl_ex
add_assoc_zval_ex
add_char_to_string
add_function
add_get_assoc_string_ex
add_get_assoc_stringl_ex
add_get_index_double
add_get_index_long
add_get_index_string
add_get_index_stringl
add_index_bool
add_index_double
add_index_long
add_index_null
add_index_resource
add_index_string
add_index_stringl
add_index_zval
add_next_index_bool
add_next_index_double
add_next_index_long
add_next_index_null
add_next_index_resource
add_next_index_string
add_next_index_stringl
add_next_index_zval
add_property_bool_ex
add_property_double_ex
add_property_long_ex
add_property_null_ex
add_property_resource_ex
add_property_string_ex
add_property_stringl_ex
add_property_zval_ex
add_string_to_string
ap_php_snprintf
ap_php_vsnprintf
attribute
attributeDecl
basic_globals_id
bitwise_and_function
bitwise_not_function
bitwise_or_function
bitwise_xor_function
boolean_not_function
boolean_xor_function
call_user_function
call_user_function_ex
cdataBlock
cfg_get_double
cfg_get_long
cfg_get_string
characters
checkNamespace
comment
compare_function
compile_file
compile_filename
compile_string
compiler_globals_id
compress
compress2
concat_function
convert_scalar_to_number
convert_to_array
convert_to_boolean
convert_to_double
convert_to_long
convert_to_long_base
convert_to_null
convert_to_object
core_globals_id
crc32
crypt
decrement_function
deflate
deflateEnd
deflateInit2_
deflateInit_
deflateReset
destroy_op_array
destroy_zend_class
destroy_zend_function
display_ini_entries
display_link_numbers
div_function
do_bind_class
do_bind_function
do_bind_inherited_class
docbCreateFileParserCtxt
docbCreatePushParserCtxt
docbDefaultSAXHandlerInit
docbEncodeEntities
docbFreeParserCtxt
docbParseChunk
docbParseDoc
docbParseDocument
docbParseFile
docbSAXParseDoc
docbSAXParseFile
dom_node_class_entry
dom_object_get_node
dummy_indent
elementDecl
empty_fcall_info_cache
endDocument
endElement
entityDecl
execute
execute_internal
executor_globals_id
expand_filepath
externalSubset
file_globals_id
flock
free_estring
function_add_ref
getColumnNumber
getEntity
getLineNumber
getNamespace
getParameterEntity
getPublicId
getSystemId
get_active_class_name
get_active_function_name
get_binary_op
get_timezone_info
get_unary_op
get_zend_version
gettimeofday
globalNamespace
hasExternalSubset
hasInternalSubset
highlight_file
highlight_string
htmlAttrAllowed
htmlAutoCloseTag
htmlCreateFileParserCtxt
htmlCreateMemoryParserCtxt
htmlCreatePushParserCtxt
htmlCtxtReadDoc
htmlCtxtReadFd
htmlCtxtReadFile
htmlCtxtReadIO
htmlCtxtReadMemory
htmlCtxtReset
htmlCtxtUseOptions
htmlDefaultSAXHandlerInit
htmlDocContentDumpFormatOutput
htmlDocContentDumpOutput
htmlDocDump
htmlDocDumpMemory
htmlElementAllowedHere
htmlElementStatusHere
htmlEncodeEntities
htmlEntityLookup
htmlEntityValueLookup
htmlFreeParserCtxt
htmlGetMetaEncoding
htmlHandleOmittedElem
htmlInitAutoClose
htmlIsAutoClosed
htmlIsBooleanAttr
htmlIsScriptAttribute
htmlNewDoc
htmlNewDocNoDtD
htmlNodeDump
htmlNodeDumpFile
htmlNodeDumpFileFormat
htmlNodeDumpFormatOutput
htmlNodeDumpOutput
htmlNodeStatus
htmlParseCharRef
htmlParseChunk
htmlParseDoc
htmlParseDocument
htmlParseElement
htmlParseEntityRef
htmlParseFile
htmlReadDoc
htmlReadFd
htmlReadFile
htmlReadIO
htmlReadMemory
htmlSAXParseDoc
htmlSAXParseFile
htmlSaveFile
htmlSaveFileEnc
htmlSaveFileFormat
htmlSetMetaEncoding
htmlTagLookup
ignorableWhitespace
increment_function
inflate
inflateEnd
inflateInit2_
inflateInit_
inflateReset
ini_scanner_globals_id
initGenericErrorDefaultFunc
init_op_array
initdocbDefaultSAXHandler
inithtmlDefaultSAXHandler
initxmlDefaultSAXHandler
inputPop
inputPush
instanceof_function
instanceof_function_ex
internalSubset
isStandalone
is_equal_function
is_identical_function
is_not_equal_function
is_not_identical_function
is_smaller_function
is_smaller_or_equal_function
is_zend_mm
isolat1ToUTF8
language_scanner_globals_id
le_index_ptr
lex_scan
libiconv
libiconv_close
libiconv_open
libiconv_set_relocation_prefix
localeconv_r
make_digest
make_sha1_digest
mod_function
module_registry
mul_function
multi_convert_to_double_ex
multi_convert_to_long_ex
multi_convert_to_string_ex
namePop
namePush
namespaceDecl
nodePop
nodePush
notationDecl
numeric_compare_function
open_file_for_scanning
output_globals_id
pclose
pcre_get_compiled_regex
pcre_get_compiled_regex_cache
pcre_get_compiled_regex_ex
php_XML_ErrorString
php_XML_ExpatVersion
php_XML_GetCurrentByteCount
php_XML_GetCurrentByteIndex
php_XML_GetCurrentColumnNumber
php_XML_GetCurrentLineNumber
php_XML_GetErrorCode
php_XML_Parse
php_XML_ParserCreate
php_XML_ParserCreateNS
php_XML_ParserCreate_MM
php_XML_ParserFree
php_XML_SetCharacterDataHandler
php_XML_SetCommentHandler
php_XML_SetDefaultHandler
php_XML_SetElementHandler
php_XML_SetEndNamespaceDeclHandler
php_XML_SetExternalEntityRefHandler
php_XML_SetNotationDeclHandler
php_XML_SetProcessingInstructionHandler
php_XML_SetStartNamespaceDeclHandler
php_XML_SetUnparsedEntityDeclHandler
php_XML_SetUserData
php_add_session_var
php_add_tick_function
php_addcslashes

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 280KB - Virtual size: 571KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
phpddoszysmq/skin/SkinH_EL.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

SkinH_Adjust_HSV
SkinH_Aero
SkinH_Aero_Adjust
SkinH_Alpha
SkinH_Alpha_Menu
SkinH_Attach
SkinH_Attach_Ex
SkinH_Attach_Ext
SkinH_Attach_Res
SkinH_Attach_ResEx
SkinH_Detach
SkinH_Detach_Ex
SkinH_DisMove
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_TitleMenuBar

Sections

UPX0
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
phpddoszysmq/skin/shell.she
phpddoszysmq/扫phpddos.exe
.exe windows:4 windows x86 arch:x86

00f93d40dc7b07b75973efa4823ad5a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamOut
midiOutPrepareHeader
waveOutOpen
midiOutUnprepareHeader
midiStreamOpen
midiStreamProperty
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
midiStreamStop
midiOutReset
midiStreamClose
midiStreamRestart
waveOutGetNumDevs
waveOutClose

ws2_32

WSAAsyncSelect
closesocket
WSACleanup
recvfrom
ioctlsocket
inet_ntoa
recv
accept
getpeername

kernel32

GetTimeZoneInformation
GetVersion
HeapSize
RaiseException
GetLocalTime
GetSystemTime
RtlUnwind
GetStartupInfoA
GetOEMCP
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
SetLastError
MultiByteToWideChar
OpenProcess
TerminateProcess
GetCurrentProcess
GetFileSize
SetFilePointer
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
ReadFile
GetLastError
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
WinExec
lstrcpyA
InterlockedExchange
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
lstrlenA
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
SetFileAttributesA
GetFileAttributesA
DeleteFileA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
CreateProcessA
WaitForSingleObject
CloseHandle
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetCPInfo

user32

PeekMessageA
SetMenu
GetMenu
DefWindowProcA
GetClassInfoA
DeleteMenu
GetSystemMenu
IsZoomed
PostQuitMessage
CopyAcceleratorTableA
GetKeyState
TranslateAcceleratorA
IsWindowEnabled
ShowWindow
LoadImageA
EnumDisplaySettingsA
ClientToScreen
EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
ModifyMenuA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
InflateRect
SetRect
IntersectRect
GetSysColorBrush
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
TrackPopupMenu
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
WaitForInputIdle
AppendMenuA
CreatePopupMenu
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
RegisterClipboardFormatA
SetRectEmpty
DispatchMessageA
GetMessageA
DrawFocusRect
DrawEdge
DrawFrameControl
LoadIconA
TranslateMessage
SystemParametersInfoA
GetDesktopWindow
GetClassNameA
GetWindowThreadProcessId
FindWindowA
GetDlgItem
FindWindowExA
GetWindowTextA
WinHelpA
UnregisterClassA
WindowFromPoint
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
LoadStringA

gdi32

ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
CreatePen
PatBlt
FillRgn
CreateRectRgn
CombineRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Escape
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
GetTextMetricsA
GetObjectA
SelectObject
CreateBitmap
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateRectRgnIndirect
SetBkColor
Ellipse
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
RegCloseKey

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

CLSIDFromString
OleUninitialize
OleInitialize

oleaut32

LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

comctl32

ImageList_GetIcon
ImageList_GetImageCount
ImageList_SetBkColor
ord17
ImageList_Destroy
ImageList_Read
ImageList_Duplicate

comdlg32

ChooseColorA
GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA

Sections

.text
Size: 452KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
phpddoszysmq/河源下载站-cngr.cn.url
.url
phpddoszysmq/淘宝热卖.url
.url

Sharing

General

Malware Config

Signatures

Files

13c2eeb9e271560a71898c4998eb0d9f

Headers

File Characteristics

Imports

php5ts

msvcrt

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 220B

.rsrc Size: 4KB - Virtual size: 2KB

df5520e35226d651d139f376913b9dfd

Headers

File Characteristics

Imports

oleaut32

odbc32

kernel32

ole32

user32

advapi32

ws2_32

msvcrt

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 280KB - Virtual size: 571KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 148KB - Virtual size: 145KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 148KB

UPX1 Size: 82KB - Virtual size: 84KB

.rsrc Size: 2KB - Virtual size: 4KB

00f93d40dc7b07b75973efa4823ad5a8

Headers

File Characteristics

Imports

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

Sections

.text Size: 452KB - Virtual size: 448KB

.rdata Size: 84KB - Virtual size: 81KB

.data Size: 60KB - Virtual size: 219KB

.rsrc Size: 40KB - Virtual size: 36KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 220B

.rsrc
Size: 4KB - Virtual size: 2KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 280KB - Virtual size: 571KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 148KB - Virtual size: 145KB

UPX0
Size: - Virtual size: 148KB

UPX1
Size: 82KB - Virtual size: 84KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 452KB - Virtual size: 448KB

.rdata
Size: 84KB - Virtual size: 81KB

.data
Size: 60KB - Virtual size: 219KB

.rsrc
Size: 40KB - Virtual size: 36KB