phorphiex | 7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752

Sharing

Copy URL Twitter E-mail

General

Target
7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752
Size 84KB
Sample220327-3dptcsadgr
SHA256 7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752
MD5 01fb5198d7ba9f2da21cbdc772aa0c5b
SHA1 f4fe3b6e65fcfad2c0d357d2858a027b53d57e82
SHA512 b264e0c37be3467e8b29c43bf0de1f43572b0ad61b6a83812b4d30c326ff25d1576a494b38db5a6f1883bcd9e211ffc2076a7fde23beabe2b20ce05402a08a11
MD5 SHA1 SHA512

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex Payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Phorphiex family
phorphiex

File Explorer

7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752

.exe 84KB

7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752

IMPHASH 83ed03288aab5785fc4b7fc141b87ad3
SHA256 7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752
MD5 01fb5198d7ba9f2da21cbdc772aa0c5b
SHA1 f4fe3b6e65fcfad2c0d357d2858a027b53d57e82
SHA512 b264e0c37be3467e8b29c43bf0de1f43572b0ad61b6a83812b4d30c326ff25d1576a494b38db5a6f1883bcd9e211ffc2076a7fde23beabe2b20ce05402a08a11
MD5 SHA1 SHA512

windows x86

Phorphiex Payload

Minor OS version

Major OS version

Entry point

98304

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memcpy _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcsstr srand wcslen wcscmp _wfopen fseek ftell fclose mbstowcs rand memset strlen isalpha isdigit

wininet

HttpQueryInfoA InternetOpenA InternetOpenUrlA InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle

urlmon

URLDownloadToFileW

shlwapi

StrCmpNW PathFileExistsW PathFindFileNameW PathFileExistsA PathMatchSpecW

kernel32

lstrcmpiW CreateDirectoryW FindFirstFileW lstrcmpW MoveFileExW FindNextFileW CopyFileW RemoveDirectoryW GetLogicalDrives GetDriveTypeW QueryDosDeviceW lstrcpyW ExpandEnvironmentStringsW DeleteFileW SetFileAttributesW GetVolumeInformationW GetModuleFileNameW CreateProcessW CreateThread GetTickCount ExitProcess GetLastError CreateMutexA CopyFileA MoveFileA DeleteFileA GetModuleHandleA GetStartupInfoA FindClose GlobalUnlock GlobalLock GlobalAlloc ExitThread Sleep SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile HeapFree HeapAlloc GetProcessHeap MapViewOfFile CreateFileMappingA GetFileSize CreateFileW WriteFile

user32

SetForegroundWindow ShowWindow SetFocus CloseClipboard CloseWindow wsprintfA wsprintfW GetClipboardData SetClipboardData OpenClipboard EmptyClipboard FindWindowA

advapi32

CryptAcquireContextW CryptEncrypt CryptImportKey CryptVerifySignatureA CryptHashData CryptCreateHash RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumValueW RegQueryInfoKeyW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptDestroyKey

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance