phorphiex | t[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
t.exe
Size 100KB
Sample240409-p5cq8aag3v
SHA256 abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922
MD5 ee0a1ec859b753abc30847157d81f37c
SHA1 2fd868d94c6dc063ca49c767c873505fbc87dcd9
SHA512 6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc
SSDEEP 3072:UlmICQuNwVOv/8I6WruEPJZDUXA2M1CUci6sUJW51TrFS83Fo:WmICRmgMtWruEhZDCA2M1CUci6sUJW5D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
t.exe

File Explorer

t.exe

.exe 100KB

t.exe

IMPHASH 23ab644c44593e426ea915e5618d637d
SHA256 abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922
MD5 ee0a1ec859b753abc30847157d81f37c
SHA1 2fd868d94c6dc063ca49c767c873505fbc87dcd9
SHA512 6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc
SSDEEP 3072:UlmICQuNwVOv/8I6WruEPJZDUXA2M1CUci6sUJW51TrFS83Fo:WmICRmgMtWruEhZDCA2M1CUci6sUJW5D
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Phorphiex payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_controlfp memmove _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcscmp srand rand mbstowcs strchr strcmp _wfopen fseek ftell fclose memset _mbsstr strlen isalpha isdigit wcsstr wcslen iswalpha iswdigit memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z strtol memchr memcmp

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA HttpQueryInfoA InternetOpenUrlW InternetOpenW InternetReadFile

urlmon

URLDownloadToFileW

shlwapi

PathMatchSpecW StrCmpNW PathFileExistsW PathFindFileNameW PathFileExistsA

ws2_32

setsockopt send getaddrinfo recv socket connect closesocket listen bind htonl htons inet_pton ntohl shutdown WSACleanup WSAStartup getsockname ntohs WSAAccept WSARecv WSASend WSAGetLastError freeaddrinfo inet_ntop

kernel32

GlobalAlloc GlobalLock GlobalUnlock WaitForMultipleObjects GetQueuedCompletionStatus PostQueuedCompletionStatus LoadLibraryA GetProcAddress lstrlenW TerminateThread CloseHandle CreateIoCompletionPort SleepEx SetLastError GlobalFree GetSystemTimeAsFileTime GetTickCount lstrcpynA ExitThread SetEndOfFile SetFilePointer UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileW CreateProcessW GetLocaleInfoA DeleteFileW WriteFile ExpandEnvironmentStringsW lstrcpyW QueryDosDeviceW GetDriveTypeW GetLogicalDrives RemoveDirectoryW FindClose FindNextFileW MoveFileExW lstrcmpW WaitForSingleObject GetLastError GetStartupInfoA GetModuleHandleA MoveFileW MoveFileA DeleteFileA ExitProcess CreateMutexA CopyFileA CreateThread GetTempPathW GetModuleFileNameW GetVolumeInformationW SetFileAttributesW CopyFileW lstrcmpiW CreateDirectoryW lstrlenA Sleep HeapReAlloc HeapAlloc HeapFree GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindFirstFileW

user32

FindWindowA ShowWindow SetForegroundWindow CloseWindow SetFocus wsprintfA wsprintfW GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard

advapi32

CryptReleaseContext CryptGenRandom CryptEncrypt CryptDestroyKey CryptGetKeyParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDuplicateHash CryptExportKey CryptVerifySignatureA RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptAcquireContextW CryptAcquireContextA

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance