Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-29_3eebec90ce03fbe704b993f0e3020fea_phobos.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-01-29_3eebec90ce03fbe704b993f0e3020fea_phobos.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-29_3eebec90ce03fbe704b993f0e3020fea_phobos
-
Size
50KB
-
MD5
3eebec90ce03fbe704b993f0e3020fea
-
SHA1
63f1f3494def1198f87d853c86787172cb06d5ce
-
SHA256
10096d953eff7ab6ab41c43c3b87cbadcf86d83f70963208c621c9e71ed22f38
-
SHA512
769516d9e6b1956b9e7323b4bdc2a3fd542d897e3abbf341e611d37f002b7dbb1c274f5ad298decbfa4bab9362972501aa34c307e42ace8610f223d6c3641865
-
SSDEEP
768:bgZRUSqFU+qJck+fO+lJ8f9ICGjI4t1hg0v861NR/uWiuKBUnLR0cAApDcvDFg04:cRvoU+XfE9ICf4t1OwruWiyR0GAvbY5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-29_3eebec90ce03fbe704b993f0e3020fea_phobos
Files
-
2025-01-29_3eebec90ce03fbe704b993f0e3020fea_phobos.exe windows:5 windows x86 arch:x86
119a19c80714b41878d48310cf77def7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
connect
ntohl
select
getpeername
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
WSAStartup
htonl
WSAGetLastError
iphlpapi
GetIpAddrTable
kernel32
SetFilePointerEx
GetFileAttributesW
SetFileAttributesW
MoveFileW
ReadFile
GetProcAddress
SetEndOfFile
ExitProcess
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
CreateEventW
WaitForMultipleObjects
CloseHandle
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
WriteFile
OpenProcess
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
CreateFileW
FlushFileBuffers
OpenMutexW
GetLastError
GetCurrentThreadId
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
FindFirstFileW
FindClose
FindNextFileW
SystemTimeToFileTime
QueryPerformanceCounter
GetLocalTime
GetFileSizeEx
user32
GetShellWindow
GetWindowThreadProcessId
advapi32
DuplicateTokenEx
LookupAccountSidW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.cdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE