89c42828bb3c248a5a7c59aa57b85f0e[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

89c42828bb3c248a5a7c59aa57b85f0e.bin
Size

18.0MB
MD5

89c42828bb3c248a5a7c59aa57b85f0e
SHA1

d57facc3c7882ad9a126615e346d6d48db08768d
SHA256

1dde30cb2860794d8800b0dfa08710d6d097a2a84d8b16f79dcdd60fb390a905
SHA512

c8ee81d76fef163ddedbc3b6dfe9875aaedec6ba23c62d09f98a3334734a7132426719d79026785fc6382bad82b3d246d380d5373ff3fd0b3c3e6757381292d9
SSDEEP

393216:Hj8x+hlCz6jAeN+Q2FioUir21pxB7rP1tdx8qYEaFiYEMYHp:HbQzmp+4Gitvt4/9EMcp

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Phoenix/Phoenix/Phoenix.exe
unpack001/Phoenix/Phoenix/extatent.dll
unpack001/Phoenix/Phoenix/selenium-manager/windows/selenium-manager.exe

Files

89c42828bb3c248a5a7c59aa57b85f0e.bin
.zip

Password: infected
Phoenix/Phoenix/Phoenix.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\User\Desktop\My Projects\New\Phoenix\Phoenix\bin\Release\Secured\Phoenix.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 12.5MB - Virtual size: 12.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Phoenix/Phoenix/extatent.dll
.dll windows:4 windows x86 arch:x86

Password: infected

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\erand\Dropbox\Dev\ag.v66\Libraries\VMRuntime\obj\Trial\AgileDotNet.VMRuntime.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Phoenix/Phoenix/names.txt
Phoenix/Phoenix/selenium-manager/linux/selenium-manager
.elf linux x64
Phoenix/Phoenix/selenium-manager/macos/selenium-manager
.macho macos arch:x64
Phoenix/Phoenix/selenium-manager/windows/selenium-manager.exe
.exe windows:6 windows x86 arch:x86

Password: infected

d47805a84aebeff710339a49110d2096

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
ReleaseSRWLockExclusive
lstrlenW
TlsSetValue
TlsGetValue
AcquireSRWLockExclusive
SwitchToThread
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetBinaryTypeW
GetConsoleMode
GetStdHandle
GetFileType
GetFileInformationByHandleEx
CloseHandle
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
LCMapStringW
CompareStringW
CreateIoCompletionPort
SetFileCompletionNotificationModes
AcquireSRWLockShared
ReleaseSRWLockShared
GetStringTypeW
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
WaitForMultipleObjects
GetOverlappedResult
WaitForSingleObject
GetExitCodeProcess
WakeAllConditionVariable
SetHandleInformation
SetStdHandle
SetEnvironmentVariableW
GetModuleHandleA
GetProcAddress
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetLastError
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
CreateDirectoryW
FindFirstFileW
FindClose
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
SetThreadStackGuarantee
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
DeleteFileW
SetFileInformationByHandle
SleepConditionVariableSRW
CreateSymbolicLinkW
CreateHardLinkW
SetFileTime
SetFileAttributesW
SetConsoleMode
WakeConditionVariable
PostQueuedCompletionStatus
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetSystemInfo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
AddVectoredExceptionHandler
GetCommandLineA
GetModuleHandleExW
WriteFile
RaiseException
GetCurrentProcess
GetCommandLineW
LoadLibraryExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
DecodePointer

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ws2_32

freeaddrinfo
getaddrinfo
setsockopt
bind
send
WSAStartup
ioctlsocket
WSASocketW
WSASend
closesocket
WSAIoctl
WSACleanup
connect
recv
getsockname
WSAGetLastError
getpeername
shutdown
getsockopt

ntdll

NtCreateFile
NtCancelIoFileEx
NtDeviceIoControlFile
RtlNtStatusToDosError

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 12.5MB - Virtual size: 12.5MB

.rsrc Size: 125KB - Virtual size: 125KB

.reloc Size: 512B - Virtual size: 12B

Password: infected

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 271KB - Virtual size: 271KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Password: infected

d47805a84aebeff710339a49110d2096

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

ole32

ws2_32

ntdll

advapi32

bcrypt

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 6KB - Virtual size: 8KB

.reloc Size: 66KB - Virtual size: 65KB

.text
Size: 12.5MB - Virtual size: 12.5MB

.rsrc
Size: 125KB - Virtual size: 125KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 271KB - Virtual size: 271KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 6KB - Virtual size: 8KB

.reloc
Size: 66KB - Virtual size: 65KB