Behavioral task
behavioral1
Sample
3aa0a31f343b949a91bd1ee0c6546cb4d21994e019dcd3026c1e6187a2561f14.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
3aa0a31f343b949a91bd1ee0c6546cb4d21994e019dcd3026c1e6187a2561f14.exe
Resource
win10v2004-20250217-en
General
-
Target
3aa0a31f343b949a91bd1ee0c6546cb4d21994e019dcd3026c1e6187a2561f14
-
Size
860KB
-
MD5
70771cd18e2b4ba1d6418e1bcff40a77
-
SHA1
31209ff8d285ed77ab5083378246de371edbc83d
-
SHA256
3aa0a31f343b949a91bd1ee0c6546cb4d21994e019dcd3026c1e6187a2561f14
-
SHA512
f44512881710d76718da45fd43f1f2255d1a951ea13e724134795e06f60a6f12232ab9f550a75b951f22db8979d7558633def91776741930f7f9000ebfcdf135
-
SSDEEP
3072:fyBDE03tjf155Gb1QbhDBNYOd5AqVXtFk:vMtD155G2N5QQXtFk
Malware Config
Extracted
phorphiex
http://tldrbox.top/
http://92.63.197.225/
http://aeufoeahfouefhga.ru/
http://aefuaeufhueuufua.ru/
http://awduhawduhuhhaga.ru/
http://badaeduahedhhuaa.ru/
http://euuauudduufuugua.ru/
http://azezezbdndnnnsna.ru/
http://aegieuueueuuruia.ru/
http://awbnmnmammmamnra.ru/
http://ploaiedueaigzefa.ru/
http://eueuqundnndnsuda.ru/
http://eooeoeoririusfra.ru/
http://nbmbnmbembfaeura.ru/
http://euauueuueuruudga.ru/
http://afieifaieudhhuda.ru/
http://fauibdbebdbburua.ru/
http://aeufoeahfouefhgz.su/
http://aefuaeufhueuufuz.su/
http://awduhawduhuhhagz.su/
http://badaeduahedhhuaz.su/
http://euuauudduufuuguz.su/
http://azezezbdndnnnsnz.su/
http://aegieuueueuuruiz.su/
http://awbnmnmammmamnrz.su/
http://ploaiedueaigzefz.su/
http://eueuqundnndnsudz.su/
http://eooeoeoririusfrz.
-
user_agent
Mozilla/5.0 (Linux; Android 7.0; SM-T813) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.136 Safari/537.36
Signatures
-
Phorphiex family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3aa0a31f343b949a91bd1ee0c6546cb4d21994e019dcd3026c1e6187a2561f14
Files
-
3aa0a31f343b949a91bd1ee0c6546cb4d21994e019dcd3026c1e6187a2561f14.exe windows:5 windows x86 arch:x86
1fbb7681790cc4b6493a2f6ca741d65f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
wcsstr
wcslen
_wfopen
fseek
ftell
fclose
strlen
mbstowcs
srand
rand
memset
memcpy
wininet
InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileW
shlwapi
PathFindFileNameW
StrCmpNW
PathMatchSpecW
PathFileExistsW
kernel32
lstrcmpW
MoveFileExW
FindNextFileW
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
FindFirstFileW
lstrcpyW
ExpandEnvironmentStringsW
GetTickCount
WriteFile
Sleep
DeleteFileW
CreateFileW
CreateDirectoryW
lstrcmpiW
lstrlenA
CopyFileW
SetFileAttributesW
ExitThread
GetVolumeInformationW
GetModuleFileNameW
CreateProcessW
CreateThread
GetLastError
QueryDosDeviceW
GetProcessHeap
GetStartupInfoA
CheckRemoteDebuggerPresent
GetCurrentProcess
IsDebuggerPresent
ExitProcess
GetModuleHandleA
SetEndOfFile
SetFilePointer
CloseHandle
UnmapViewOfFile
HeapFree
HeapAlloc
GetFileSize
MapViewOfFile
CreateFileMappingA
CreateMutexA
user32
wsprintfW
wsprintfA
advapi32
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptVerifySignatureA
CryptHashData
CryptCreateHash
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExW
CryptDestroyKey
shell32
ShellExecuteW
ole32
CoInitializeEx
CoCreateInstance
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 596B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ