phorphiex | a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics
Size

58KB
MD5

a97dbab45fe24e468fd08afc9345a790
SHA1

a14ba70e58334c30fba2c42b7147c31ce2f098dc
SHA256

2aedf4746fa4cd41ddcdc200c74d5dabf58e358b8edb6b848da5cae0eaa08345
SHA512

34fb29e6a38cbe2871ffa4972c77ba3b8610869cdaedd8397fe864a5fdb9afdc995eb7ba1c367d8a2f3428d1442798ce00c843fea0b619937dc912e5060c0e32
SSDEEP

1536:mzQjJuw3c6hqh1kJaJrNKx5tzzevaCpzqFFzWcXdqu7mOYhngYFD:4QduF60Q0X036aCBqXcY6tgYFD

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex family
phorphiex
Phorphiex payload 1 IoCs

Processes:

resource yara_rule

sample family_phorphiex

resource	yara_rule
sample	family_phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics

Files

a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics
.exe windows:5 windows x86 arch:x86

d617e8618688e76a02c9e4d9a14e5afd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recvfrom
setsockopt
sendto
bind
ioctlsocket
WSAStartup
recv
send
WSACloseEvent
WSARecv
WSASend
gethostname
connect
inet_ntoa
inet_addr
htons
getsockname
shutdown
socket
closesocket
gethostbyname
WSAGetLastError
WSAEnumNetworkEvents
WSASocketA
listen
WSAWaitForMultipleEvents
getpeername
accept
WSAEventSelect
WSAGetOverlappedResult
WSACreateEvent

shlwapi

PathFileExistsW
StrCmpNW
PathMatchSpecW
StrCpyNW
PathFindFileNameW
StrStrIA
StrChrA
StrCmpNIA
StrStrW

wininet

InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA

ntdll

memset
memcpy
_chkstk
RtlUnwind
RtlTimeToSecondsSince1980
mbstowcs
NtQueryVirtualMemory
NtQuerySystemTime
memmove
strstr
isdigit
isalpha

msvcrt

rand
srand
_vscprintf

kernel32

ExitProcess
CreateProcessW
DeleteCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentThread
InterlockedExchangeAdd
InterlockedIncrement
InterlockedExchange
WaitForSingleObject
InterlockedDecrement
GetCurrentProcessId
HeapSetInformation
GetProcessHeaps
HeapValidate
HeapCreate
HeapFree
HeapAlloc
HeapReAlloc
ExpandEnvironmentStringsW
CreateThread
CreateMutexA
GetLastError
CreateEventA
GetVolumeInformationW
SetFileAttributesW
GetSystemInfo
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetEvent
lstrcpyW
DeleteFileW
GetDiskFreeSpaceExW
FindNextFileW
lstrcmpiW
QueryDosDeviceW
RemoveDirectoryW
FindClose
lstrlenA
GlobalLock
GetModuleHandleW
GetTickCount
GlobalAlloc
Sleep
lstrcpynW
ExitThread
MultiByteToWideChar
lstrlenW
GlobalUnlock
GetFileSize
MapViewOfFile
UnmapViewOfFile
WriteFile
InitializeCriticalSection
LeaveCriticalSection
CreateFileW
FlushFileBuffers
EnterCriticalSection
CreateFileMappingW
CloseHandle
FindFirstFileW
GetDriveTypeW
MoveFileExW
CreateDirectoryW
GetLogicalDrives
CopyFileW
GetModuleFileNameW
lstrcmpW

user32

RegisterClassExW
GetClipboardData
EmptyClipboard
ChangeClipboardChain
SetWindowLongW
TranslateMessage
wsprintfW
SendMessageA
IsClipboardFormatAvailable
CloseClipboard
GetMessageA
wvsprintfA
GetWindowLongW
DefWindowProcA
RegisterRawInputDevices
CreateWindowExW
DispatchMessageA
OpenClipboard
SetClipboardData
SetClipboardViewer

advapi32

RegSetValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExW
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitialize
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d617e8618688e76a02c9e4d9a14e5afd

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

shlwapi

wininet

ntdll

msvcrt

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 2KB - Virtual size: 6KB

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 2KB - Virtual size: 6KB