Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-01_ac88dc513f3c40b24777d3b14355ca0e_phobos.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-03-01_ac88dc513f3c40b24777d3b14355ca0e_phobos.exe
Resource
win10v2004-20250217-en
General
-
Target
2025-03-01_ac88dc513f3c40b24777d3b14355ca0e_phobos
-
Size
51KB
-
MD5
ac88dc513f3c40b24777d3b14355ca0e
-
SHA1
2c443bfd6e5a0df8d2f06f75a83d86d8c044774b
-
SHA256
d3d3f6140e1ee794dd28013405265acdd7f5deb0afd6fc78ce63a32f91a29a13
-
SHA512
6ef375b8ba044fafd30723a582c54805434d8617d51e2c4f23bd050bc7dba264933746a87c98ca45b6ae904585963514be10e648b4795d7d6e9e924189e02157
-
SSDEEP
1536:GRvoU+XfE9ICf4t1OwruWiyB0VRm0el05:G6X89NfsjruWiyyMLl05
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-01_ac88dc513f3c40b24777d3b14355ca0e_phobos
Files
-
2025-03-01_ac88dc513f3c40b24777d3b14355ca0e_phobos.exe windows:5 windows x86 arch:x86
119a19c80714b41878d48310cf77def7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
connect
ntohl
select
getpeername
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
WSAStartup
htonl
WSAGetLastError
iphlpapi
GetIpAddrTable
kernel32
SetFilePointerEx
GetFileAttributesW
SetFileAttributesW
MoveFileW
ReadFile
GetProcAddress
SetEndOfFile
ExitProcess
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
CreateEventW
WaitForMultipleObjects
CloseHandle
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
WriteFile
OpenProcess
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
CreateFileW
FlushFileBuffers
OpenMutexW
GetLastError
GetCurrentThreadId
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
FindFirstFileW
FindClose
FindNextFileW
SystemTimeToFileTime
QueryPerformanceCounter
GetLocalTime
GetFileSizeEx
user32
GetShellWindow
GetWindowThreadProcessId
advapi32
DuplicateTokenEx
LookupAccountSidW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.cdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE