phorphiex | 2d5e7babf1b2d92b56fda0b9044f889a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
2d5e7babf1b2d92b56fda0b9044f889a.bin
Size 58KB
Sample240112-bq65macgh6
SHA256 701f8e268aa14d487e3fa1f92e41d89c38f3245c8246e66c2cdd5114367e295d
MD5 e270b8fff1d521742ba7b23add358e1f
SHA1 76521478ff57a2e8e5d9911f8efcb1560aba2ef8
SHA512 e7c7ac77474ed360a0d8fdc87e5906ef4d64eb3e6cdde2175f9207226f70c5e416f4765d3672296470090f3a36b1f1f291303df07efde328b60e2a7fe5c21073
SSDEEP 768:/rU9jWDlRszk3D/zv4CVhgjqThtpabxDtj60wayA9GhUDUpSpU3kqK3bFkIRBnbW:olmrsEzzv4OpThtpabxwCPQYJ/zbW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
static1/unpack001/8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c.exe	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c.exe

File Explorer

2d5e7babf1b2d92b56fda0b9044f889a.bin

.zip 58KB
8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c.exe

.exe 112KB

2d5e7babf1b2d92b56fda0b9044f889a.bin

SHA256 701f8e268aa14d487e3fa1f92e41d89c38f3245c8246e66c2cdd5114367e295d
MD5 e270b8fff1d521742ba7b23add358e1f
SHA1 76521478ff57a2e8e5d9911f8efcb1560aba2ef8
SHA512 e7c7ac77474ed360a0d8fdc87e5906ef4d64eb3e6cdde2175f9207226f70c5e416f4765d3672296470090f3a36b1f1f291303df07efde328b60e2a7fe5c21073
SSDEEP 768:/rU9jWDlRszk3D/zv4CVhgjqThtpabxDtj60wayA9GhUDUpSpU3kqK3bFkIRBnbW:olmrsEzzv4OpThtpabxwCPQYJ/zbW
MD5 SHA1 SHA512 SSDEEP

Password

infected

8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c.exe

IMPHASH 23ab644c44593e426ea915e5618d637d
SHA256 8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c
MD5 2d5e7babf1b2d92b56fda0b9044f889a
SHA1 d2f1f6a1e267172fc183a0d1a2affdd26145f59d
SHA512 68167664fc5e957b9aee18713ddf975823a73713d6c2fe31f532dcb53bee280a7fbfda68961a514d049558c602d74e91b24995fc1153e3f376cea5ebc7f93688
SSDEEP 3072:8q7DiX2FNAVWllSP8QLZwgtTIFFjB/0SA:N7DiQWTlZw3FjJA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Phorphiex payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

82554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_controlfp memmove _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcscmp srand rand mbstowcs strchr strcmp _wfopen fseek ftell fclose memset _mbsstr strlen isalpha isdigit wcsstr wcslen iswalpha iswdigit memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z strtol memchr memcmp

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA HttpQueryInfoA InternetOpenUrlW InternetOpenW InternetReadFile

urlmon

URLDownloadToFileW

shlwapi

PathMatchSpecW StrCmpNW PathFileExistsW PathFindFileNameW PathFileExistsA

ws2_32

setsockopt send getaddrinfo recv socket connect closesocket listen bind htonl htons inet_pton ntohl shutdown WSACleanup WSAStartup getsockname ntohs WSAAccept WSARecv WSASend WSAGetLastError freeaddrinfo inet_ntop

kernel32

GlobalAlloc GlobalLock GlobalUnlock WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus LoadLibraryA GetProcAddress lstrlenW TerminateThread CloseHandle CreateIoCompletionPort SleepEx SetLastError GlobalFree GetSystemTimeAsFileTime GetTickCount lstrcpynA ExitThread SetEndOfFile SetFilePointer UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileW CreateProcessW GetLocaleInfoA DeleteFileW WriteFile ExpandEnvironmentStringsW lstrcpyW QueryDosDeviceW GetDriveTypeW GetLogicalDrives RemoveDirectoryW FindClose FindNextFileW MoveFileExW lstrcmpW WaitForSingleObject GetLastError GetStartupInfoA GetModuleHandleA MoveFileW MoveFileA DeleteFileA ExitProcess CreateMutexA CopyFileA CreateThread GetTempPathW GetModuleFileNameW GetVolumeInformationW SetFileAttributesW CopyFileW lstrcmpiW CreateDirectoryW lstrlenA Sleep HeapReAlloc HeapAlloc HeapFree GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindFirstFileW

user32

FindWindowA ShowWindow SetForegroundWindow CloseWindow SetFocus wsprintfA wsprintfW GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard

advapi32

CryptReleaseContext CryptGenRandom CryptEncrypt CryptDestroyKey CryptGetKeyParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDuplicateHash CryptExportKey CryptVerifySignatureA RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptAcquireContextW CryptAcquireContextA

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance