7829b4c65c6ba48a41ec2a55de5214d4

Sharing

Copy URL Twitter E-mail

General

Target

7829b4c65c6ba48a41ec2a55de5214d4
Size

49KB
MD5

7829b4c65c6ba48a41ec2a55de5214d4
SHA1

8d5a19322a1a65897788dcb04265e162e17de130
SHA256

cae5147955ee008134450d67f5451f97f46d6a7698c0fcb01c2164b077648bfd
SHA512

5930aed28e1daa7fcf90396c11a959688295961fb42671384ef22e8391571739d6a2534a31f35e998e6776ee98eda9856f86fd1c6824a59bc8802946c95f237b
SSDEEP

768:tcn61wuh2yciu57TKd5L83BQ2It2mSfbCamBpOJC56nfZbzORK0jK2B+tDxBn:tcnryqi0Hz3BQ2IY4rLx56nfZPORVmdB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Phoenix.dll

Files

7829b4c65c6ba48a41ec2a55de5214d4
.zip
Phoenix.dll
.dll windows:4 windows x86 arch:x86

12715611513ce84bc9de072556cc3876

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2915
ord2818
ord939
ord537
ord858
ord823
ord825
ord540
ord860
ord800

msvcrt

wcscpy
_mbsnbicmp
strncpy
_access
fprintf
_mbslen
malloc
_mbsupr
realloc
calloc
rand
_mbscmp
strtoul
_strdup
free
fread
fseek
time
memmove
_mbsstr
_mbsrchr
atoi
_except_handler3
_vsnprintf
_mbsnbcpy
_purecall
srand
_mbsnbcmp
_splitpath
_mbstok
strchr
_mbsnbcat
fopen
fwrite
fclose
sprintf
_mbsicmp
__CxxFrameHandler
_itoa
_stricmp
exit
printf
__dllonexit
_onexit
_initterm
_adjust_fdiv
_mbschr

kernel32

LocalFree
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
HeapFree
HeapAlloc
GetProcessHeap
InitializeCriticalSection
SetEvent
CreateEventA
PostQueuedCompletionStatus
GetQueuedCompletionStatus
InterlockedExchangeAdd
TerminateThread
CreateIoCompletionPort
WriteFile
SetFileTime
CreateDirectoryA
LocalFileTimeToFileTime
ReadFile
SetFilePointer
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
GetCurrentDirectoryA
OutputDebugStringA
ExpandEnvironmentStringsA
GetTempPathA
ReleaseMutex
LeaveCriticalSection
WaitForSingleObject
EnterCriticalSection
DeleteCriticalSection
Sleep
GetModuleHandleA
GetTickCount
CreateThread
VirtualQuery
GetCurrentProcessId
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetFileAttributesA
CloseHandle
CreateFileA
SystemTimeToFileTime
GetLocalTime
GetLastError
GetSystemInfo
CreateMutexA

advapi32

FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
InitializeSecurityDescriptor

shell32

ord51
SHGetSpecialFolderPathA
ShellExecuteA

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

ws2_32

ioctlsocket
accept
send
recv
connect
gethostbyname
__WSAFDIsSet
sendto
select
socket
WSAEventSelect
WSAIoctl
htons
bind
listen
closesocket
WSASend
getpeername
ntohs
WSARecv
WSASocketA
setsockopt
gethostbyaddr
WSAGetLastError
ntohl
htonl
gethostname
WSACleanup
WSAStartup
inet_ntoa
inet_addr
recvfrom

wininet

InternetOpenUrlA
InternetConnectA
HttpOpenRequestA
InternetCanonicalizeUrlA
InternetSetOptionA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA
HttpSendRequestA
InternetReadFile

iphlpapi

GetBestInterface
GetIpAddrTable

shlwapi

PathIsDirectoryA
PathRemoveFileSpecA
PathAddBackslashA

Exports

Exports

start

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12715611513ce84bc9de072556cc3876

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

advapi32

shell32

msvcp60

ws2_32

wininet

iphlpapi

shlwapi

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 12KB - Virtual size: 13KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 12KB - Virtual size: 13KB

.reloc
Size: 8KB - Virtual size: 5KB