Static task
static1
Behavioral task
behavioral1
Sample
Phantom.exe
Resource
win10v2004-20240508-en
General
-
Target
Phantom.exe
-
Size
762KB
-
MD5
c7b7f5054e8e6c83884c7dad28172803
-
SHA1
a0687c720df35d0735b86ca2e1ce38b0e80b4491
-
SHA256
29cb5e7f08b41751bb06c42b57067a2b07e3cc2bfa044cd694d922529a619238
-
SHA512
fc13b789fc28476247f4724a8cb8896223af77f37aa09164dc40e562368cbbe62cafe2dc448a54bb0abdbdd348e900edb4a586cdc318f9bbe4a01f052e444efe
-
SSDEEP
12288:lIdSxkJb4ZQivRFZKP0m4FdWaGNGGLUWl6JB+A6+rN6FAZXhqDnxlrug6JnGs:lL2Jb4/U8mGWArwCZ6FPxk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Phantom.exe
Files
-
Phantom.exe.exe .js windows:4 windows x64 arch:x64 polyglot
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 730KB - Virtual size: 730KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ