Phosphorus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Phosphorus.exe
Size 264KB
Sample260704-mprt4aet61
SHA256 52c18a16c42a35bed77cff77d5e255de8426ab3d7652a274b2b673b2e13ad883
MD5 7c31f95ebdaee2b0176960566f65070c
SHA1 968201af887d3ad0fba2b412485a810c6b4c6b84
SHA512 1236e07805abf247d00345b51368725253e5c797d8d51928fa23a5439373b7dce1d07cab5c8b0e2dc12d34c440474d0c8678347198e53ba1f27f6cfdfe2322c2
SSDEEP 6144:EvQVbGMUAXJP5L5noKaeAhxWQxBHUWq+9yN86IpKIGl9AvXZq2qOqB9S9K99NpNG:EO9oKaeAhLwJv+sZFov
TLSH
T1CD442AA777E51CEAD616627C45D7D3223339B9A05322AF170124EA321F03ED0BED662D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Phosphorus.exe

File Explorer

Phosphorus.exe

.exe 264KB

Phosphorus.exe

IMPHASH c68546e4f1717d514937e0bd56f2311b
SHA256 52c18a16c42a35bed77cff77d5e255de8426ab3d7652a274b2b673b2e13ad883
MD5 7c31f95ebdaee2b0176960566f65070c
SHA1 968201af887d3ad0fba2b412485a810c6b4c6b84
SHA512 1236e07805abf247d00345b51368725253e5c797d8d51928fa23a5439373b7dce1d07cab5c8b0e2dc12d34c440474d0c8678347198e53ba1f27f6cfdfe2322c2
SSDEEP 6144:EvQVbGMUAXJP5L5noKaeAhxWQxBHUWq+9yN86IpKIGl9AvXZq2qOqB9S9K99NpNG:EO9oKaeAhLwJv+sZFov
TLSH
T1CD442AA777E51CEAD616627C45D7D3223339B9A05322AF170124EA321F03ED0BED662D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4389

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreatePen CreateSolidBrush DeleteObject Ellipse LineTo PatBlt SelectObject

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetProcessAffinityMask GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount64 InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection MultiByteToWideChar OpenProcess OutputDebugStringA RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _errno _endthreadex _fmode _initterm free memcmp memcpy memmove memset printf srand _onexit _time64 _ultoa _setjmp abort calloc exit fprintf fputc fputs fwrite getenv localeconv longjmp malloc rand realloc signal strchr strcmp strerror strlen strncmp strtoul vfprintf wcslen _strdup

user32

GetDC GetSystemMetrics InvalidateRect MessageBoxA ReleaseDC ShowWindow

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

772B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1024B

Virtual Size

681B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

170B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

1024B

Virtual Size

974B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Phosphorus.exe

gdi32

kernel32

msvcrt

user32

winmm

generic