Behavioral task
behavioral1
Sample
2fbe2eaf3820a4a9cba713a1a03ea1159a085756417eb10901480059a74e1612.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2fbe2eaf3820a4a9cba713a1a03ea1159a085756417eb10901480059a74e1612.exe
Resource
win10v2004-20241007-en
General
-
Target
2fbe2eaf3820a4a9cba713a1a03ea1159a085756417eb10901480059a74e1612.exe
-
Size
12KB
-
MD5
f0bf16d5abd1af09a519783f408547ab
-
SHA1
932c99e771f358b5041780db8dea3bb5b0210d0f
-
SHA256
2fbe2eaf3820a4a9cba713a1a03ea1159a085756417eb10901480059a74e1612
-
SHA512
423ce09986cc24f9b6907c982f0f5c805a6d3c066ccd26b446be22f394d759cab60b2f5840933353b706b2ad63337ae8c369f94b3ea1641c3586728e1eff364e
-
SSDEEP
192:9BbUFJyyHpmUJ0FJx34ymFpQ9999999999999999999999999999999999999KIs:bUF0yHEUJ0FoyM
Malware Config
Extracted
phorphiex
http://91.202.233.141
Signatures
-
Phorphiex family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fbe2eaf3820a4a9cba713a1a03ea1159a085756417eb10901480059a74e1612.exe
Files
-
2fbe2eaf3820a4a9cba713a1a03ea1159a085756417eb10901480059a74e1612.exe.exe windows:5 windows x86 arch:x86
652bad30af4f722f78dcc1034111fbb2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr90
__dllonexit
_lock
_onexit
_decode_pointer
_unlock
_invoke_watson
_controlfp_s
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_except_handler4_common
_amsg_exit
wininet
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
shlwapi
PathFileExistsW
kernel32
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
ExpandEnvironmentStringsW
CreateFileW
CloseHandle
Sleep
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
user32
wsprintfW
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 450B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ