phorphiex | file[.]exe

General

Target
file.exe
Size 22KB
Sample260402-wpbbsacy5t
SHA256 ee04c3c25cbee4fd131f65239b60c2c94db0428e86607c0685e7c610376b34c6
MD5 b0449f002413531fcec8ee70a83837f8
SHA1 6131ac02e5d8a14f22046e7743cbeebd3142f32f
SHA512 45e386a4ebceefb184587ebef4dd00d8a134406efd5feb3472fc475c25989025673211c2c17101f0bc6c6b07498e5f6599e80a54f1cc13889adf639238033568
SSDEEP 384:Hu1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:HNuPf4/IUrqY+xsN
TLSH
T108A20806AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

phorphiex

Malware Config

Extracted

Family

phorphiex

C2

178.16.54.109

Attributes

mutex
TWIZTPEINF

Signatures

Phorphiex family
phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 22KB

file.exe

IMPHASH d0f945da54f20d8bcaf079f2d6ea9f63
SHA256 ee04c3c25cbee4fd131f65239b60c2c94db0428e86607c0685e7c610376b34c6
MD5 b0449f002413531fcec8ee70a83837f8
SHA1 6131ac02e5d8a14f22046e7743cbeebd3142f32f
SHA512 45e386a4ebceefb184587ebef4dd00d8a134406efd5feb3472fc475c25989025673211c2c17101f0bc6c6b07498e5f6599e80a54f1cc13889adf639238033568
SSDEEP 384:Hu1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:HNuPf4/IUrqY+xsN
TLSH
T108A20806AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13541

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathCombineW PathMatchSpecW PathFileExistsW

msvcr90

_crt_debugger_hook _controlfp_s _invoke_watson _except_handler4_common _decode_pointer _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit wcscat_s _wcsicmp wcslen wcscpy_s _wcsnicmp wcsstr memset wcscpy wcsncmp memcpy

kernel32

IsDebuggerPresent UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoA InterlockedCompareExchange InterlockedExchange ExitThread FindFirstFileW lstrcmpW FindNextFileW GetLogicalDrives GetDriveTypeW QueryDosDeviceW lstrcpyW CreateFileW GetFileSize CreateFileMappingA CloseHandle MapViewOfFile FlushViewOfFile UnmapViewOfFile SetFilePointer SetEndOfFile Sleep SetErrorMode CreateMutexA ExitProcess GetLastError ExpandEnvironmentStringsW CreateThread

user32

CharLowerW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Sharing