phorphiex | 96cc66c0821ac95f0a8b1d4e0f549109

Sharing

Copy URL Twitter E-mail

General

Target
96cc66c0821ac95f0a8b1d4e0f549109
Size 71KB
Sample231219-zdrfeahhf4
SHA256 304946a6982a482d29eb43968c79f8f24c513bba71cd886e6b186054b7632677
MD5 96cc66c0821ac95f0a8b1d4e0f549109
SHA1 31515284c6dcc9c7bd1ffced8bb7bd216a268413
SHA512 912c6c16fa99e13e833b0966b52172ceaa21a4eff5e3e99045727c49cd0fef1f77ac27f47851a32d365db25b920cddb2358775863c10729a166a7420b4c585c2
SSDEEP 1536:+3Mz8oy284usnjFzuNXoaSTM98qKH5FnA:FwofxFK5oagMNO5FA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96cc66c0821ac95f0a8b1d4e0f549109

File Explorer

96cc66c0821ac95f0a8b1d4e0f549109

.exe 71KB

96cc66c0821ac95f0a8b1d4e0f549109

IMPHASH f104e80119f78ba5be523e1d9fb681d0
SHA256 304946a6982a482d29eb43968c79f8f24c513bba71cd886e6b186054b7632677
MD5 96cc66c0821ac95f0a8b1d4e0f549109
SHA1 31515284c6dcc9c7bd1ffced8bb7bd216a268413
SHA512 912c6c16fa99e13e833b0966b52172ceaa21a4eff5e3e99045727c49cd0fef1f77ac27f47851a32d365db25b920cddb2358775863c10729a166a7420b4c585c2
SSDEEP 1536:+3Mz8oy284usnjFzuNXoaSTM98qKH5FnA:FwofxFK5oagMNO5FA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Phorphiex payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

recvfrom setsockopt sendto bind ioctlsocket WSAStartup send recv WSACloseEvent WSARecv WSASend WSAGetLastError gethostname connect inet_ntoa inet_addr htons getsockname shutdown socket closesocket gethostbyname WSAEnumNetworkEvents WSAEventSelect listen WSAWaitForMultipleEvents getpeername accept WSAGetOverlappedResult WSACreateEvent WSASocketA

shlwapi

PathFileExistsW StrCmpNW PathMatchSpecW PathFindFileNameW StrChrA StrStrIA StrCmpNIA StrStrW

urlmon

URLDownloadToFileW

wininet

InternetReadFile InternetOpenUrlW InternetOpenW InternetCloseHandle InternetOpenA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetConnectA InternetCrackUrlA

ntdll

memcpy _chkstk _aulldiv RtlUnwind mbstowcs RtlTimeToSecondsSince1980 NtQuerySystemTime NtQueryVirtualMemory memmove isdigit isalpha _allshl _aullshr memset

msvcrt

rand srand _vscprintf

kernel32

GetLastError CreateProcessW GetLocaleInfoA DuplicateHandle DeleteCriticalSection GetThreadPriority SetThreadPriority GetCurrentThread GetCurrentProcess InterlockedExchangeAdd InterlockedIncrement InterlockedExchange WaitForSingleObject InterlockedDecrement GetCurrentProcessId HeapSetInformation GetSystemInfo PostQueuedCompletionStatus GetProcessHeaps HeapValidate HeapCreate HeapFree HeapAlloc HeapReAlloc ExpandEnvironmentStringsW CreateThread CreateMutexA CreateEventA ExitProcess GetQueuedCompletionStatus CreateIoCompletionPort SetEvent GetVolumeInformationW SetFileAttributesW lstrcpyW DeleteFileW GetDiskFreeSpaceExW FindNextFileW lstrcmpiW QueryDosDeviceW RemoveDirectoryW lstrlenA GlobalLock GetModuleHandleW GetTickCount GlobalAlloc Sleep lstrcpynW ExitThread MultiByteToWideChar lstrlenW GlobalUnlock GetFileSize MapViewOfFile UnmapViewOfFile WriteFile InitializeCriticalSection LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection CreateFileMappingW CloseHandle FindFirstFileW GetDriveTypeW MoveFileExW CreateDirectoryW GetLogicalDrives CopyFileW GetModuleFileNameW lstrcmpW FindClose

user32

RegisterClassExW TranslateMessage GetClipboardData EmptyClipboard ChangeClipboardChain SetWindowLongW DefWindowProcA wsprintfW SendMessageA IsClipboardFormatAvailable CloseClipboard GetMessageA wvsprintfA GetWindowLongW RegisterRawInputDevices CreateWindowExW DispatchMessageA OpenClipboard SetClipboardData SetClipboardViewer

advapi32

RegSetValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExA RegSetValueExA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysAllocString SysFreeString