phorphiex | 8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe
Size 112KB
Sample240111-v9edhadacm
SHA256 8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c
MD5 2d5e7babf1b2d92b56fda0b9044f889a
SHA1 d2f1f6a1e267172fc183a0d1a2affdd26145f59d
SHA512 68167664fc5e957b9aee18713ddf975823a73713d6c2fe31f532dcb53bee280a7fbfda68961a514d049558c602d74e91b24995fc1153e3f376cea5ebc7f93688
SSDEEP 3072:8q7DiX2FNAVWllSP8QLZwgtTIFFjB/0SA:N7DiQWTlZw3FjJA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe

File Explorer

8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe

.exe 112KB

8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe

IMPHASH 23ab644c44593e426ea915e5618d637d
SHA256 8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c
MD5 2d5e7babf1b2d92b56fda0b9044f889a
SHA1 d2f1f6a1e267172fc183a0d1a2affdd26145f59d
SHA512 68167664fc5e957b9aee18713ddf975823a73713d6c2fe31f532dcb53bee280a7fbfda68961a514d049558c602d74e91b24995fc1153e3f376cea5ebc7f93688
SSDEEP 3072:8q7DiX2FNAVWllSP8QLZwgtTIFFjB/0SA:N7DiQWTlZw3FjJA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Phorphiex payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_controlfp memmove _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcscmp srand rand mbstowcs strchr strcmp _wfopen fseek ftell fclose memset _mbsstr strlen isalpha isdigit wcsstr wcslen iswalpha iswdigit memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z strtol memchr memcmp

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA HttpQueryInfoA InternetOpenUrlW InternetOpenW InternetReadFile

urlmon

URLDownloadToFileW

shlwapi

PathMatchSpecW StrCmpNW PathFileExistsW PathFindFileNameW PathFileExistsA

ws2_32

setsockopt send getaddrinfo recv socket connect closesocket listen bind htonl htons inet_pton ntohl shutdown WSACleanup WSAStartup getsockname ntohs WSAAccept WSARecv WSASend WSAGetLastError freeaddrinfo inet_ntop

kernel32

GlobalAlloc GlobalLock GlobalUnlock WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus LoadLibraryA GetProcAddress lstrlenW TerminateThread CloseHandle CreateIoCompletionPort SleepEx SetLastError GlobalFree GetSystemTimeAsFileTime GetTickCount lstrcpynA ExitThread SetEndOfFile SetFilePointer UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileW CreateProcessW GetLocaleInfoA DeleteFileW WriteFile ExpandEnvironmentStringsW lstrcpyW QueryDosDeviceW GetDriveTypeW GetLogicalDrives RemoveDirectoryW FindClose FindNextFileW MoveFileExW lstrcmpW WaitForSingleObject GetLastError GetStartupInfoA GetModuleHandleA MoveFileW MoveFileA DeleteFileA ExitProcess CreateMutexA CopyFileA CreateThread GetTempPathW GetModuleFileNameW GetVolumeInformationW SetFileAttributesW CopyFileW lstrcmpiW CreateDirectoryW lstrlenA Sleep HeapReAlloc HeapAlloc HeapFree GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindFirstFileW

user32

FindWindowA ShowWindow SetForegroundWindow CloseWindow SetFocus wsprintfA wsprintfW GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard

advapi32

CryptReleaseContext CryptGenRandom CryptEncrypt CryptDestroyKey CryptGetKeyParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDuplicateHash CryptExportKey CryptVerifySignatureA RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptAcquireContextW CryptAcquireContextA

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance