D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\phpdbg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
afed70d5dff76ef3226bd173bf6bf38138059deb5f570ae2f072a40bca1d6a3aN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
afed70d5dff76ef3226bd173bf6bf38138059deb5f570ae2f072a40bca1d6a3aN.exe
Resource
win10v2004-20240802-en
General
-
Target
afed70d5dff76ef3226bd173bf6bf38138059deb5f570ae2f072a40bca1d6a3aN
-
Size
1.4MB
-
MD5
6c60577ef8488134248864b7d2d93710
-
SHA1
4b73628baf917c756e82c65f350a7cdcb9c5cc20
-
SHA256
afed70d5dff76ef3226bd173bf6bf38138059deb5f570ae2f072a40bca1d6a3a
-
SHA512
1bfb940f8ac0169e32f22faee38c1ef4922fb1c51214f05752a0767c09ab2d8b5aeca2d83c9dcba73979be46e78cd7e970df116d3039d76a5c787fd4aaf4e15a
-
SSDEEP
24576:kga+NAxVm5sqjnhMgeiCl7G0nehbGZpbD:kl2Dmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afed70d5dff76ef3226bd173bf6bf38138059deb5f570ae2f072a40bca1d6a3aN
Files
-
afed70d5dff76ef3226bd173bf6bf38138059deb5f570ae2f072a40bca1d6a3aN.exe windows:6 windows x64 arch:x64
1df712d46d10693733c381630022cf8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
php8ts
zend_memory_usage
zend_memory_peak_usage
zend_mm_set_heap
zend_hash_update@@24
zend_hash_next_index_insert@@16
zend_hash_apply@@16
zend_print_zval
zend_is_auto_global
zend_rsrc_list_get_rsrc_type
zend_get_type_by_const
zend_stream_fixup
zend_message_dispatcher
zend_get_executed_scope
zend_is_executing
zend_compile_file
ap_php_vasprintf
gettimeofday
zend_str_tolower_copy@@24
zend_dump_op_array
zend_dump_op_line
zend_llist_apply
gc_possible_root@@8
zval_ptr_dtor
zend_stream_init_filename
zend_destroy_file_handle
php_win32_error_to_msg
php_win32_error_msg_free
zend_print_zval_r
zval_get_long_func@@16
zend_objects_store_del@@8
function_add_ref
zend_user_exception_handler
zend_exception_restore
zend_throw_exception_internal
zend_get_exception_base
zend_clear_exception
zend_exception_error
zend_is_unwind_exit
zend_vm_call_opcode_handler@@8
zend_generator_check_placeholder_frame
zend_generator_update_current
_php_stream_open_wrapper_ex
execute_ex
zend_eval_stringl
zend_timeout@@0
zend_next_free_module
zend_register_module_ex
zend_startup_module_ex
zend_update_property_string
zend_read_property
add_next_index_long
add_next_index_string
add_next_index_stringl
zend_fcall_info_args
zend_call_function
zend_call_known_function
pclose
zend_ini_string_ex
virtual_chdir
virtual_chdir_file
virtual_fopen
virtual_popen
php_build_argv
zend_append_version_info
zend_register_extension
is_zend_mm
zend_empty_string
module_registry
zend_ce_generator
zend_extensions
zend_mm_startup_ex
_zend_handle_numeric_str_ex@@24
instanceof_function_slow@@16
zend_is_auto_global_str
zend_lookup_class
zend_fetch_class_by_name
expand_filepath
php_addcslashes
_ecalloc@@16
zend_hash_index_add_empty_element@@16
zend_print_flat_zval_r
zend_long_to_str@@8
zend_write
zend_spprintf
_php_stream_fopen_from_fd
_php_stream_set_option
_php_stream_free
php_stream_context_get_option
php_output_write
php_output_deactivate
php_output_activate
zend_argument_value_error
zend_wrong_parameters_none_error@@0
zend_parse_parameters
zend_get_executed_lineno
zend_get_executed_filename
zend_function_dtor
destroy_op_array
zend_objects_store_mark_destructed@@8
zend_is_true@@8
zval_get_string_func@@8
convert_to_long@@8
get_zend_version
zend_strpprintf
_zend_bailout
_zend_new_array@@8
zend_hash_index_find@@16
zend_hash_str_find@@24
zend_hash_find@@16
zend_hash_del@@16
zend_hash_add_empty_element@@16
zend_hash_index_update@@24
zend_hash_index_add_new@@24
zend_hash_add_new@@24
zend_hash_clean@@8
zend_hash_destroy@@8
_zend_hash_init@@32
zend_mm_get_custom_handlers
zend_mm_set_custom_handlers
zend_mm_get_heap
_zend_mm_realloc@@24
_zend_mm_free@@16
_zend_mm_alloc@@16
__zend_malloc
_estrdup@@8
_efree@@8
output_globals_id
smart_str_realloc@@16
smart_str_erealloc@@16
zend_generator_freeze_call_stack
zend_generator_restore_call_stack
zend_fetch_debug_backtrace
php_printf
rc_dtor_func@@8
zend_hash_internal_pointer_reset_ex@@16
zend_hash_move_forward_ex@@16
ap_php_asprintf
_erealloc@@16
zend_compile_string
php_addcslashes_str
virtual_realpath
_php_stream_stat_path
zend_rebuild_symbol_table
zend_execute
zend_get_opcode_name@@8
zend_string_tolower_ex@@16
zend_str_tolower_dup@@16
zend_hash_internal_pointer_end_ex@@16
zend_hash_get_current_data_ex@@16
zend_hash_index_del@@16
zend_hash_str_del@@24
zend_hash_index_add@@24
zend_hash_str_add@@32
zend_hash_str_update@@32
zend_hash_add@@24
_emalloc@@8
zend_strndup@@16
zend_string_concat3
tsrm_get_ls_cache
zend_hash_func@@16
_estrndup@@16
php_import_environment_variables
sapi_globals_offset
sapi_module
core_globals_offset
zend_execute_ex
executor_globals_offset
compiler_globals_offset
php_free_shutdown_functions
php_ini_builder_define
php_ini_builder_unquoted
php_ini_builder_prepend
zend_vm_kind
php_tsrm_startup
php_module_shutdown
php_module_startup
php_request_shutdown
ts_free_id
ts_allocate_id
php_request_startup
php_getopt
php_register_variable
sapi_deactivate
sapi_shutdown
sapi_startup
zend_register_constant
zend_register_string_constant
zend_register_long_constant
virtual_stat
tsrm_shutdown
zend_alter_ini_entry
php_stream_open_for_zend_ex
_php_stream_get_url_stream_wrappers_hash
zend_error
zend_generator_update_root
php_module_shutdown_wrapper
kernel32
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetStdHandle
GetConsoleScreenBufferInfo
VirtualProtect
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
vcruntime140
memcpy
memcmp
memchr
memmove
strstr
strchr
longjmp
__intrinsic_setjmp
__current_exception
__current_exception_context
memset
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
calloc
malloc
_set_new_mode
free
realloc
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__p__fmode
__acrt_iob_func
_dup
clearerr
fclose
fputs
feof
_open
_write
_setmode
_read
_lseek
_close
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
ftell
fseek
fread
fopen
_fileno
fgets
fflush
ferror
api-ms-win-crt-string-l1-1-0
strncmp
_strdup
isspace
_strnicmp
isdigit
strtok
strcmp
api-ms-win-crt-runtime-l1-1-0
_errno
terminate
signal
_register_onexit_function
_initialize_onexit_table
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
OPENSSL_Applink
_phpdbg_asprintf
phpdbg_activate_err_buf
phpdbg_ask_user_permission
phpdbg_check_caught_ex
phpdbg_clear_breakpoints
phpdbg_clear_param
phpdbg_consume_stdin_line
phpdbg_copy_param
phpdbg_current_file
phpdbg_delete_breakpoint
phpdbg_destroy_input
phpdbg_disable_breakpoint
phpdbg_disable_breakpoints
phpdbg_enable_breakpoint
phpdbg_enable_breakpoints
phpdbg_export_breakpoints
phpdbg_export_breakpoints_to_string
phpdbg_find_breakbase
phpdbg_find_breakbase_ex
phpdbg_find_breakpoint
phpdbg_free_err_buf
phpdbg_get_color
phpdbg_get_colors
phpdbg_get_element
phpdbg_get_function
phpdbg_get_param_type
phpdbg_get_prompt
phpdbg_get_terminal_height
phpdbg_get_terminal_width
phpdbg_hash_param
phpdbg_hit_breakpoint
phpdbg_is_addr
phpdbg_is_class_method
phpdbg_is_empty
phpdbg_is_numeric
phpdbg_load_module_or_extension
phpdbg_log_internal
phpdbg_match_param
phpdbg_mixed_read
phpdbg_mixed_write
phpdbg_out_internal
phpdbg_output_err_buf
phpdbg_param_debug
phpdbg_param_tostring
phpdbg_parse_variable
phpdbg_parse_variable_with_arg
phpdbg_print
phpdbg_print_breakpoint
phpdbg_print_breakpoints
phpdbg_read_input
phpdbg_reset_breakpoints
phpdbg_resolve_op_array_break
phpdbg_resolve_op_array_breaks
phpdbg_resolve_opline_break
phpdbg_resolve_path
phpdbg_resolve_pending_file_break
phpdbg_resolve_pending_file_break_ex
phpdbg_set_async_io
phpdbg_set_breakpoint_at
phpdbg_set_breakpoint_expression
phpdbg_set_breakpoint_file
phpdbg_set_breakpoint_file_opline
phpdbg_set_breakpoint_function_opline
phpdbg_set_breakpoint_method
phpdbg_set_breakpoint_method_opline
phpdbg_set_breakpoint_opcode
phpdbg_set_breakpoint_opline
phpdbg_set_breakpoint_opline_ex
phpdbg_set_breakpoint_symbol
phpdbg_set_color
phpdbg_set_color_ex
phpdbg_set_prompt
phpdbg_stack_execute
phpdbg_stack_free
phpdbg_stack_push
phpdbg_stack_resolve
phpdbg_stack_separate
phpdbg_stack_verify
phpdbg_trim
phpdbg_vprint
phpdbg_watchpoint_parse_input
Sections
.text Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE