General

Malware Config

Signatures

Files

• phobia.exe

  .exe windows:6 windows x64 arch:x64

  f6f62f495dfaa08ad50c4f89365c4b4a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  d3d11

  D3D11CreateDeviceAndSwapChain

  d3dx11_43

  D3DX11CreateShaderResourceViewFromMemory

  kernel32

  QueryFullProcessImageNameW

  GetSystemTimeAsFileTime

  LocalAlloc

  LocalFree

  GetModuleFileNameW

  GetProcessAffinityMask

  SetProcessAffinityMask

  SetThreadAffinityMask

  Sleep

  ExitProcess

  FreeLibrary

  LoadLibraryA

  GetModuleHandleA

  GetProcAddress

  user32

  ScreenToClient

  GetUserObjectInformationW

  GetProcessWindowStation

  GetUserObjectInformationW

  gdi32

  CreateSolidBrush

  advapi32

  CopySid

  shell32

  ShellExecuteA

  msvcp140

  ?_Xout_of_range@std@@YAXPEBD@Z

  ntdll

  RtlVirtualUnwind

  dbghelp

  ImageDirectoryEntryToData

  wininet

  InternetOpenA

  imm32

  ImmSetCompositionWindow

  d3dcompiler_43

  D3DCompile

  dwmapi

  DwmExtendFrameIntoClientArea

  rpcrt4

  UuidCreate

  psapi

  GetModuleInformation

  userenv

  UnloadUserProfile

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  __std_terminate

  api-ms-win-crt-stdio-l1-1-0

  _lseeki64

  api-ms-win-crt-heap-l1-1-0

  calloc

  api-ms-win-crt-runtime-l1-1-0

  system

  api-ms-win-crt-time-l1-1-0

  _difftime64

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-string-l1-1-0

  strpbrk

  api-ms-win-crt-locale-l1-1-0

  setlocale

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-convert-l1-1-0

  strtod

  api-ms-win-crt-filesystem-l1-1-0

  _unlink

  api-ms-win-crt-utility-l1-1-0

  rand

  ws2_32

  freeaddrinfo

  normaliz

  IdnToAscii

  crypt32

  CertFindCertificateInStore

  wldap32

  ord143

  wtsapi32

  WTSSendMessageW

  Sections

  .text

  Size: - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 261KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 404KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: - Virtual size: 50KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .phobia0

  Size: - Virtual size: 4.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .phobia1

  Size: 7.2MB - Virtual size: 7.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ