Phantom_Loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Phantom_Loader.exe
Size

1.4MB
MD5

5fccfb4c2bf99c3e8d8095d1ba78a8f5
SHA1

cbf200b7a91817537e07838fdea55aa8da777c26
SHA256

dbc1df98c35000331faab238572dac22c96892c672874ef58ebf46ab028a0b9e
SHA512

89b2edbd3d120f0c87939c8bfd4aa689f539941aaeea6c3c0ec649f5367c19957155101d9c77ab44f090e263f1e119e0249f0f9c9b06e69d60600e43780718a6
SSDEEP

24576:Cq77upfh0lhSMXljCn2H1+7oFYZGIiAsEpiY+21J9zgNsL3irLPTBa0wdm:b7YeGnvjx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Phantom_Loader.exe

Files

Phantom_Loader.exe
.exe windows:6 windows x64

b80948e69017234ccb877a8348de4573

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OpenProcess
CreateToolhelp32Snapshot
GetLastError
GetFileAttributesA
LoadLibraryA
Process32Next
CloseHandle
VirtualAllocEx
CreateRemoteThread
FormatMessageA
VirtualFreeEx
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
VerifyVersionInfoW
QueryPerformanceCounter
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindFirstFileW
GetFileAttributesExW
FindClose
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Module32First
Module32Next
GetFullPathNameW
FindNextFileW
FindFirstFileExW
WriteProcessMemory
Process32First
LocalFree

user32

MessageBoxA
TranslateMessage
PeekMessageA
GetWindowRect
DispatchMessageA
GetDesktopWindow
PostQuitMessage
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
ReleaseDC
SetCursorPos
IsIconic
SetForegroundWindow
ReleaseCapture
RegisterClassExA
UnregisterClassA
GetClientRect
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
GetMonitorInfoA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW

gdi32

GetDeviceCaps

msvcp140

?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
_Query_perf_frequency

urlmon

URLDownloadToFileA

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

d3d9

Direct3DCreate9

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
memcmp
memcpy
memmove
memchr

api-ms-win-crt-runtime-l1-1-0

_set_errno
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
terminate
_wassert
_invalid_parameter_noinfo_noreturn
_set_app_type
_configure_narrow_argv
_seh_filter_exe
_cexit
_initialize_narrow_environment
_crt_atexit
_initialize_onexit_table
exit
_register_onexit_function

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free
_callnewh

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-stdio-l1-1-0

fwrite
_wfopen
__stdio_common_vsprintf
fread
fseek
fclose
fflush
__acrt_iob_func
ftell
_set_fmode
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vsscanf

api-ms-win-crt-convert-l1-1-0

wcstombs_s
mbstowcs_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strncpy
strncmp
strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

acosf
cosf
sinf
ceilf
sqrtf
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

Sections

.text
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 556KB - Virtual size: 557KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b80948e69017234ccb877a8348de4573

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msvcp140

urlmon

imm32

d3d9

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 318KB - Virtual size: 317KB

.rdata Size: 210KB - Virtual size: 209KB

.data Size: 556KB - Virtual size: 557KB

.pdata Size: 15KB - Virtual size: 15KB

.rsrc Size: 295KB - Virtual size: 294KB

.reloc Size: 512B - Virtual size: 280B

.text
Size: 318KB - Virtual size: 317KB

.rdata
Size: 210KB - Virtual size: 209KB

.data
Size: 556KB - Virtual size: 557KB

.pdata
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 295KB - Virtual size: 294KB

.reloc
Size: 512B - Virtual size: 280B