Overview

overview

10

Static

static

10

5820a8e57f...18.exe

windows7-x64

10

5820a8e57f...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118
  • Size 400KB
  • Sample240718-tpvdjswepj
  • SHA256 25b2db6412500a86c7a47ad4d88fe9d556cf677e50214355ddc0d34a620bbaf9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
phorphiex

Malware Config

Extracted

Family

  • phorphiex

C2

  • http://185.215.113.93/

  • http://gimmefile.top/

  • http://feedmefile.top/

  • http://gotsomefile.top/

Wallets

  • 15DBeUGFSQLbpYvWLJwzHUXSRrHNU9uQuS8c2wvFLZ7Nxz3N

  • 1E5ZxnNUbbGQarWjMA7tCwp3Btm38GvRkv

  • 3AcMV5pSUcxMmmcMbfSkJXRKbCrF3ysUDJ

  • bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr

  • XkcKjKZqNUkChwJXMj5uDjDns6etXvakir

  • D7MYki8urW3xq8sZJ8Q2v2ZrHxjzp7ACvb

  • 0x76e4CB2fcf7f931Fd750e93F443536Ee068d1cdE

  • LfYFvpk2hccXw12tN3BBMWh7EcUBMbKoTG

  • rUQFcff9R1eKAwTtR1wbuQxmcoB236mz44

  • TEUaG7jyXdyrDS3JeEg1w1hotmmEMjx4TB

  • t1gTRxsrEXwky32j22jgFRZAafBzmCV2M2V

  • AT5Vm3ZrUg98s9kBue2g9YjnwK4kFKhQw3

  • bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr

  • 44L2q3sPJ3DMJZiuSpHvehHMLbMXx3SAoVbLm5DWDw1A7PhUvcCPAGg5qAN98DWAUG7CuD4WmydP4JkewTz2aeVd4qhS822

  • GBLUYL3QTKP3NXVWCYNZ7ZH4CWFT6PVCXEYCNUNSHM34WKG2UL5EDQMV

  • bnb154sx9pdh8er33ujxlpfk3zwvlfp9rd5rskvvgc

  • bc1qn4r93am7rxxr4a5dwydhwx0p2kd4xfd7mz42f3

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36

Signatures

  • Phorphiex family
    phorphiex
  • Phorphiex payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118
    .exe 400KB

5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118

  • IMPHASH fbe38eac33127c8216f939b478d0cb1c
  • SHA256 25b2db6412500a86c7a47ad4d88fe9d556cf677e50214355ddc0d34a620bbaf9
  • MD5 SHA1 SHA512 SSDEEP
windows:5windowsx86arch:x86

  • Phorphiex payload

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
5
Entry point
21968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths