phorphiex | c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc

Sharing

Copy URL Twitter E-mail

General

Target
c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc
Size 85KB
Sample220503-sawsdscbdm
SHA256 c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc
MD5 5a5ea34b7265aec2fbcc1183376a9f47
SHA1 6008107f7e197b564ec186caa8e04995cba50ede
SHA512 7f65306676f81a5456f24cb1f0ac4cbcb227a523af5e087ba4725bf1207dc8248085e59458de07b4ae32c8ff3f008235c16c5f627ab78c435dbca0334c8f1dc7
SSDEEP 768:FllNU0vCiBb8nzDLu3rv0Ud/iCeFD9aki8fbo+bvzO9YtvCUbba74rY28FQhlXev:DzU4CW2zDy3rZeFDTi8Tr7KAHOM7IiC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex Payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Phorphiex family
phorphiex

File Explorer

c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc

.exe 85KB

c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc

IMPHASH 97442f2d9dd92a8751b2934ce6a28570
SHA256 c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc
MD5 5a5ea34b7265aec2fbcc1183376a9f47
SHA1 6008107f7e197b564ec186caa8e04995cba50ede
SHA512 7f65306676f81a5456f24cb1f0ac4cbcb227a523af5e087ba4725bf1207dc8248085e59458de07b4ae32c8ff3f008235c16c5f627ab78c435dbca0334c8f1dc7
SSDEEP 768:FllNU0vCiBb8nzDLu3rv0Ud/iCeFD9aki8fbo+bvzO9YtvCUbba74rY28FQhlXev:DzU4CW2zDy3rZeFDTi8Tr7KAHOM7IiC
MD5 SHA1 SHA512 SSDEEP

windows x86

Phorphiex Payload

Minor OS version

Major OS version

Entry point

18634

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memcpy _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcsstr srand wcslen _wfopen fseek ftell fclose mbstowcs rand memset strlen isalpha isdigit

wininet

InternetOpenA InternetOpenUrlA HttpQueryInfoA InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle

urlmon

URLDownloadToFileW

shlwapi

StrCmpNW PathMatchSpecW PathFileExistsW PathFindFileNameW PathFileExistsA

kernel32

CopyFileW lstrcmpiW CreateDirectoryW FindFirstFileW lstrcmpW MoveFileExW FindNextFileW SetFileAttributesW RemoveDirectoryW GetLogicalDrives GetDriveTypeW QueryDosDeviceW lstrcpyW ExpandEnvironmentStringsW DeleteFileW GetVolumeInformationW GetModuleFileNameW CreateProcessW CreateThread GetTickCount ExitProcess GetLastError CreateMutexA CopyFileA MoveFileA DeleteFileA MoveFileW GetModuleHandleA FindClose WriteFile GlobalUnlock GlobalLock GlobalAlloc ExitThread Sleep SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile HeapFree HeapAlloc GetProcessHeap MapViewOfFile CreateFileMappingA GetFileSize CreateFileW GetStartupInfoA

user32

CloseWindow SetFocus SetForegroundWindow ShowWindow FindWindowA wsprintfA wsprintfW GetClipboardData OpenClipboard EmptyClipboard CloseClipboard SetClipboardData

advapi32

CryptAcquireContextW CryptEncrypt CryptImportKey CryptVerifySignatureA CryptHashData CryptCreateHash RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptDestroyKey

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance