phorphiex | e1af1ba1edb943b838456f57bd564d01

Sharing

Copy URL Twitter E-mail

General

Target
e1af1ba1edb943b838456f57bd564d01
Size 105KB
Sample240327-pt4essfd4s
SHA256 042fb580d253d7525231cbe7a2fb30f931c8a59bb51115e98fba3fe1d2f48a29
MD5 e1af1ba1edb943b838456f57bd564d01
SHA1 489760f1f57a35591020f1f82e54740d76fa97e7
SHA512 982417c1f742e2624c1da543058ccb2b3e9b5f46cedcbba242d13717a2f6c56cd186ba186767542bf68e0e38d0894b3ac027874f33f5bd5a94c3dac542916155
SSDEEP 3072:gEbJSw745FIlbt/d6WruEPJZDTS7MJCAc2BEUzWndAstTIgFpW:rbJSgkkcWruEhZDTS7MJCAc2BEUzWndw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1af1ba1edb943b838456f57bd564d01

File Explorer

e1af1ba1edb943b838456f57bd564d01

.exe 105KB

e1af1ba1edb943b838456f57bd564d01

IMPHASH 23ab644c44593e426ea915e5618d637d
SHA256 042fb580d253d7525231cbe7a2fb30f931c8a59bb51115e98fba3fe1d2f48a29
MD5 e1af1ba1edb943b838456f57bd564d01
SHA1 489760f1f57a35591020f1f82e54740d76fa97e7
SHA512 982417c1f742e2624c1da543058ccb2b3e9b5f46cedcbba242d13717a2f6c56cd186ba186767542bf68e0e38d0894b3ac027874f33f5bd5a94c3dac542916155
SSDEEP 3072:gEbJSw745FIlbt/d6WruEPJZDTS7MJCAc2BEUzWndAstTIgFpW:rbJSgkkcWruEhZDTS7MJCAc2BEUzWndw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Phorphiex payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_controlfp memmove _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcscmp srand rand mbstowcs strchr strcmp _wfopen fseek ftell fclose memset _mbsstr strlen isalpha isdigit wcsstr wcslen iswalpha iswdigit memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z strtol memchr memcmp

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA HttpQueryInfoA InternetOpenUrlW InternetOpenW InternetReadFile

urlmon

URLDownloadToFileW

shlwapi

PathMatchSpecW StrCmpNW PathFileExistsW PathFindFileNameW PathFileExistsA

ws2_32

setsockopt send getaddrinfo recv socket connect closesocket listen bind htonl htons inet_pton ntohl shutdown WSACleanup WSAStartup getsockname ntohs WSAAccept WSARecv WSASend WSAGetLastError freeaddrinfo inet_ntop

kernel32

GlobalAlloc GlobalLock GlobalUnlock WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus LoadLibraryA GetProcAddress lstrlenW TerminateThread CloseHandle CreateIoCompletionPort SleepEx SetLastError GlobalFree GetSystemTimeAsFileTime GetTickCount lstrcpynA ExitThread SetEndOfFile SetFilePointer UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileW CreateProcessW GetLocaleInfoA DeleteFileW WriteFile ExpandEnvironmentStringsW lstrcpyW QueryDosDeviceW GetDriveTypeW GetLogicalDrives RemoveDirectoryW FindClose FindNextFileW MoveFileExW lstrcmpW WaitForSingleObject GetLastError GetStartupInfoA GetModuleHandleA MoveFileW MoveFileA DeleteFileA ExitProcess CreateMutexA CopyFileA CreateThread GetTempPathW GetModuleFileNameW GetVolumeInformationW SetFileAttributesW CopyFileW lstrcmpiW CreateDirectoryW lstrlenA Sleep HeapReAlloc HeapAlloc HeapFree GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindFirstFileW

user32

FindWindowA ShowWindow SetForegroundWindow CloseWindow SetFocus wsprintfA wsprintfW GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard

advapi32

CryptReleaseContext CryptGenRandom CryptEncrypt CryptDestroyKey CryptGetKeyParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDuplicateHash CryptExportKey CryptVerifySignatureA RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptAcquireContextW CryptAcquireContextA

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance