phorphiex | 3bb1c1fd24a8e2cd98f7c20702c648e7

Sharing

Copy URL Twitter E-mail

General

Target
3bb1c1fd24a8e2cd98f7c20702c648e7
Size 104KB
Sample231222-a4vhbabcc2
SHA256 3bfc028ca2541bb8885beb3d8f9b285185ed54ed4724777fb729f8cefae8fee1
MD5 3bb1c1fd24a8e2cd98f7c20702c648e7
SHA1 316661d187a04d1b76980128ab0633390573c74d
SHA512 7e372ee7ddcd51348ae87aae4bc8181b9e30678d5ad2dc3ac104ce1f4c2352f1e4a09a9483873d8d99c70cddca7c09aadcc2cba1b5015f5314dba519987775f5
SSDEEP 3072:Xl58BV2ZjooGTb5PjMdhS3KV3/jjKwcNHjo86r8X7FS8EFcq:158BIFveZjMrS3q3/jjKwcNHjo86r8rC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bb1c1fd24a8e2cd98f7c20702c648e7

File Explorer

3bb1c1fd24a8e2cd98f7c20702c648e7

.exe 104KB

3bb1c1fd24a8e2cd98f7c20702c648e7

IMPHASH 572f29d114844c45cfd821916845866e
SHA256 3bfc028ca2541bb8885beb3d8f9b285185ed54ed4724777fb729f8cefae8fee1
MD5 3bb1c1fd24a8e2cd98f7c20702c648e7
SHA1 316661d187a04d1b76980128ab0633390573c74d
SHA512 7e372ee7ddcd51348ae87aae4bc8181b9e30678d5ad2dc3ac104ce1f4c2352f1e4a09a9483873d8d99c70cddca7c09aadcc2cba1b5015f5314dba519987775f5
SSDEEP 3072:Xl58BV2ZjooGTb5PjMdhS3KV3/jjKwcNHjo86r8X7FS8EFcq:158BIFveZjMrS3q3/jjKwcNHjo86r8rC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Phorphiex payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_controlfp memmove _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcscmp srand rand mbstowcs strchr strcmp _wfopen fseek ftell fclose memset _mbsstr strlen isalpha isdigit wcsstr wcslen iswalpha iswdigit memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z strtol memchr memcmp

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA HttpQueryInfoA InternetOpenUrlW InternetOpenW InternetReadFile

urlmon

URLDownloadToFileW

shlwapi

PathMatchSpecW StrCmpNW PathFileExistsW PathFindFileNameW PathFileExistsA

ws2_32

setsockopt send getaddrinfo recv socket connect closesocket listen bind htonl htons inet_pton ntohl shutdown WSACleanup WSAStartup getsockname ntohs WSAAccept WSARecv WSASend WSAGetLastError freeaddrinfo inet_ntop

kernel32

GlobalAlloc GlobalLock GlobalUnlock WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus LoadLibraryA GetProcAddress lstrlenW TerminateThread CloseHandle CreateIoCompletionPort SleepEx SetLastError GlobalFree GetSystemTimeAsFileTime GetTickCount lstrcpynA ExitThread SetEndOfFile SetFilePointer UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileW CreateProcessW GetLocaleInfoA DeleteFileW WriteFile ExpandEnvironmentStringsW lstrcpyW QueryDosDeviceW GetDriveTypeW GetLogicalDrives RemoveDirectoryW FindClose FindNextFileW MoveFileExW lstrcmpW WaitForSingleObject GetLastError GetStartupInfoA GetModuleHandleA MoveFileA MoveFileW DeleteFileA ExitProcess CreateMutexA CopyFileA CreateThread GetTempPathW GetModuleFileNameW GetVolumeInformationW SetFileAttributesW CopyFileW lstrcmpiW CreateDirectoryW lstrlenA Sleep HeapReAlloc HeapAlloc HeapFree GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindFirstFileW

user32

FindWindowA ShowWindow SetForegroundWindow CloseWindow SetFocus wsprintfA wsprintfW GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard

advapi32

CryptReleaseContext CryptGenRandom CryptEncrypt CryptDestroyKey CryptGetKeyParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDuplicateHash CryptExportKey CryptVerifySignatureA RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptAcquireContextW CryptAcquireContextA

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance