phorphiex | b4a5ecd4285c5431b486740ce111211df90486d4ba1fe189e5cbbcd02ec72ed3[.]bin

Resubmissions

09/08/2023, 09:03

230809-kz8jgsaa7310

21/12/2021, 11:54

211221-n246maebcn10

Sharing

Copy URL Twitter E-mail

General

Target
b4a5ecd4285c5431b486740ce111211df90486d4ba1fe189e5cbbcd02ec72ed3.bin
Size 68KB
Sample230809-kz8jgsaa73
SHA256 b4a5ecd4285c5431b486740ce111211df90486d4ba1fe189e5cbbcd02ec72ed3
MD5 ae3acfb74780b06e60c44e545597d5d4
SHA1 42498d0ad9b494c2f79a5dbfa199d4c570bf223a
SHA512 a0b40bc9ec6653db668c183b355f4ebe9be84a008d901d9a6d24a7ed36a62388ab873f827c2f714640fc6ebf3560be40e75669c7eff13b6550a47ec42e088f05
SSDEEP 1536:g3Mz8uRmsoOhHywGaoFyBmGkONWhP05F3:Lw8G31QwG8hs5F3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4a5ecd4285c5431b486740ce111211df90486d4ba1fe189e5cbbcd02ec72ed3.bin

File Explorer

b4a5ecd4285c5431b486740ce111211df90486d4ba1fe189e5cbbcd02ec72ed3.bin

.exe 68KB

b4a5ecd4285c5431b486740ce111211df90486d4ba1fe189e5cbbcd02ec72ed3.bin

IMPHASH 8671c99be6e5b55d159f3475310c15fd
SHA256 b4a5ecd4285c5431b486740ce111211df90486d4ba1fe189e5cbbcd02ec72ed3
MD5 ae3acfb74780b06e60c44e545597d5d4
SHA1 42498d0ad9b494c2f79a5dbfa199d4c570bf223a
SHA512 a0b40bc9ec6653db668c183b355f4ebe9be84a008d901d9a6d24a7ed36a62388ab873f827c2f714640fc6ebf3560be40e75669c7eff13b6550a47ec42e088f05
SSDEEP 1536:g3Mz8uRmsoOhHywGaoFyBmGkONWhP05F3:Lw8G31QwG8hs5F3
MD5 SHA1 SHA512 SSDEEP

windows x86

Phorphiex payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22656

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

setsockopt sendto send WSASocketA WSAGetOverlappedResult WSAStartup bind recvfrom WSACloseEvent WSARecv WSASend WSAGetLastError WSAEnumNetworkEvents WSAEventSelect gethostname connect inet_ntoa inet_addr htons getsockname shutdown socket closesocket gethostbyname ioctlsocket WSACreateEvent getpeername accept listen recv WSAWaitForMultipleEvents

shlwapi

StrStrW StrCmpNW PathMatchSpecW StrCpyNW PathFindFileNameW StrStrIA StrChrA StrCmpNIA PathFileExistsW

urlmon

URLDownloadToFileW

wininet

InternetOpenA InternetOpenUrlW InternetOpenUrlA InternetOpenW InternetCloseHandle HttpSendRequestA HttpAddRequestHeadersA InternetConnectA InternetCrackUrlA InternetReadFile HttpOpenRequestA

ntdll

memcpy _chkstk _aulldiv RtlUnwind strchr mbstowcs RtlTimeToSecondsSince1980 NtQuerySystemTime NtQueryVirtualMemory memmove strstr isdigit isalpha _allshl _aullshr memset

msvcrt

rand srand _vscprintf

kernel32

ExitProcess CreateProcessW GetLocaleInfoA DuplicateHandle DeleteCriticalSection GetThreadPriority SetThreadPriority GetCurrentThread GetCurrentProcess InterlockedExchangeAdd InterlockedIncrement InterlockedExchange WaitForSingleObject InterlockedDecrement GetCurrentProcessId HeapSetInformation GetProcessHeaps GetSystemInfo PostQueuedCompletionStatus HeapValidate HeapCreate HeapFree HeapAlloc HeapReAlloc ExpandEnvironmentStringsW CreateThread CreateMutexA GetLastError CreateEventA GetVolumeInformationW SetFileAttributesW GetQueuedCompletionStatus CreateIoCompletionPort SetEvent lstrcpyW DeleteFileW GetDiskFreeSpaceExW FindNextFileW lstrcmpiW QueryDosDeviceW RemoveDirectoryW FindClose lstrcmpW GetModuleFileNameW CopyFileW lstrlenA GlobalLock GetModuleHandleW GetTickCount GlobalAlloc Sleep lstrcpynW ExitThread MultiByteToWideChar lstrlenW GlobalUnlock GetFileSize MapViewOfFile UnmapViewOfFile WriteFile InitializeCriticalSection LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection CreateFileMappingW CloseHandle FindFirstFileW GetDriveTypeW MoveFileExW CreateDirectoryW GetLogicalDrives

user32

GetClipboardData EmptyClipboard ChangeClipboardChain SetWindowLongW GetWindowLongW RegisterRawInputDevices CreateWindowExW DispatchMessageA OpenClipboard RegisterClassExW TranslateMessage wsprintfW SendMessageA IsClipboardFormatAvailable CloseClipboard GetMessageA wvsprintfA DefWindowProcA SetClipboardData SetClipboardViewer

advapi32

RegSetValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExA RegSetValueExA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysAllocString SysFreeString