Phantom[.]exe | Triage

Sharing

General

Target

Phantom.exe
Size

5.5MB
MD5

8690a96cb3c847f8bb80b6751d16104c
SHA1

cbc8d267f47ba999fc65cc2dd548d7602acbe5b1
SHA256

b436fdffd0746b356fe159f9a8237951715553ac4787cbd77958122fdea2c296
SHA512

0c6549aa68bf59f47c8d475a6741f83da0df2ecaab9ec74a76c10f5551c54b083022cf1e9bd3eb538613d0c7dbd85d728fa24ea5ec101b23d03585678dc96655
SSDEEP

98304:V60oMgt5ToIT4bNJFY3OqtsrRPbk0abZsyGlus2xKgqSf6Dr:g0oPijBHY4dIfFsyG4Y3JH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Phantom.exe

Files

Phantom.exe
.exe .js windows:4 windows x86 arch:x86 polyglot

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ