Phoenix[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Phoenix.zip
Size

17.9MB
MD5

85a58cd9ca36da6a383fae5096c09149
SHA1

59efb41cb1cb24bda06d06f4a1290dc8aab11544
SHA256

24616e1397e331f99a08bf3c0ea49a5e1dfeb91ccae2614b7eb14dc808b29b1f
SHA512

7e44b726f75d1bcdbfd9f43935ad0a5a4e32b266331c84bab7bc8ac70037327edc025c798a10bff1b8aa7b36c9140dc5937acf685a15393f16b261981a49eba5
SSDEEP

393216:+kvcRiX9EvOL8WfoYaU0UYLeJkFBLUgNKRVmsW:+kv+vyLoyIa+FBtIRMv

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Phoenix/Phoenix.exe
unpack001/Phoenix/extatent.dll
unpack001/Phoenix/selenium-manager/windows/selenium-manager.exe

Files

Phoenix.zip
.zip
Phoenix/Phoenix.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\User\Desktop\My Projects\New\Phoenix\Phoenix\bin\Release\Secured\Phoenix.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 12.5MB - Virtual size: 12.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Phoenix/extatent.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\erand\Dropbox\Dev\ag.v66\Libraries\VMRuntime\obj\Trial\AgileDotNet.VMRuntime.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Phoenix/names.txt
Phoenix/selenium-manager/linux/selenium-manager
.elf linux x64
Phoenix/selenium-manager/macos/selenium-manager
.macho macos arch:x64
Phoenix/selenium-manager/windows/selenium-manager.exe
.exe windows:6 windows x86 arch:x86

d47805a84aebeff710339a49110d2096

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
ReleaseSRWLockExclusive
lstrlenW
TlsSetValue
TlsGetValue
AcquireSRWLockExclusive
SwitchToThread
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetBinaryTypeW
GetConsoleMode
GetStdHandle
GetFileType
GetFileInformationByHandleEx
CloseHandle
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
LCMapStringW
CompareStringW
CreateIoCompletionPort
SetFileCompletionNotificationModes
AcquireSRWLockShared
ReleaseSRWLockShared
GetStringTypeW
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
WaitForMultipleObjects
GetOverlappedResult
WaitForSingleObject
GetExitCodeProcess
WakeAllConditionVariable
SetHandleInformation
SetStdHandle
SetEnvironmentVariableW
GetModuleHandleA
GetProcAddress
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetLastError
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
CreateDirectoryW
FindFirstFileW
FindClose
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
SetThreadStackGuarantee
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
DeleteFileW
SetFileInformationByHandle
SleepConditionVariableSRW
CreateSymbolicLinkW
CreateHardLinkW
SetFileTime
SetFileAttributesW
SetConsoleMode
WakeConditionVariable
PostQueuedCompletionStatus
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetSystemInfo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
AddVectoredExceptionHandler
GetCommandLineA
GetModuleHandleExW
WriteFile
RaiseException
GetCurrentProcess
GetCommandLineW
LoadLibraryExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
DecodePointer

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ws2_32

freeaddrinfo
getaddrinfo
setsockopt
bind
send
WSAStartup
ioctlsocket
WSASocketW
WSASend
closesocket
WSAIoctl
WSACleanup
connect
recv
getsockname
WSAGetLastError
getpeername
shutdown
getsockopt

ntdll

NtCreateFile
NtCancelIoFileEx
NtDeviceIoControlFile
RtlNtStatusToDosError

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 12.5MB - Virtual size: 12.5MB

.rsrc Size: 125KB - Virtual size: 125KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 271KB - Virtual size: 271KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

d47805a84aebeff710339a49110d2096

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

ole32

ws2_32

ntdll

advapi32

bcrypt

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 6KB - Virtual size: 8KB

.reloc Size: 66KB - Virtual size: 65KB

.text
Size: 12.5MB - Virtual size: 12.5MB

.rsrc
Size: 125KB - Virtual size: 125KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 271KB - Virtual size: 271KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 6KB - Virtual size: 8KB

.reloc
Size: 66KB - Virtual size: 65KB