Behavioral task
behavioral1
Sample
0x0009000000016d0c-11.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0x0009000000016d0c-11.exe
Resource
win10v2004-20250314-en
General
-
Target
0x0009000000016d0c-11.dat
-
Size
19KB
-
MD5
9adb4c4939743d5f3e670b4d783d38e5
-
SHA1
7c989249b99b82def352f66bc97d9403fd6e653b
-
SHA256
be502d8d90235a3c317e97cacb55b0eb5ec2aa8c50a582ec6f0527d08e99a759
-
SHA512
7573981af4fc4845e4af61067e4620b92aace90b4ac218a14920dc6f93bddafac92a8f7b02c61f3d41b42ba9f1aabbea3c215dc439da3e9c9dc68060c9a53ac1
-
SSDEEP
384:NmVdEjIxR0FTeMdMdMdMdMdMdMdMdMwMdMdMdMdMdMdMdMdMnMdMdMdMdMdMdMdV:N0Ecm
Malware Config
Extracted
phorphiex
http://45.93.20.18
Signatures
-
Phorphiex family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0009000000016d0c-11.dat
Files
-
0x0009000000016d0c-11.dat.exe windows:5 windows x86 arch:x86
7d043fa7bcef8cef39f98c88b1875ef7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr90
__dllonexit
_lock
_onexit
_decode_pointer
_unlock
_invoke_watson
_controlfp_s
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_except_handler4_common
_amsg_exit
wininet
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
shlwapi
PathFileExistsW
kernel32
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
Sleep
ExpandEnvironmentStringsW
CreateFileW
CloseHandle
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
user32
wsprintfW
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 466B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ