phantom_Cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
phantom_Cracked.exe
Size 2.9MB
Sample260807-ntlpbafe82
SHA256 5fcf2aa491ead9e65826860d03f893b7b60770931107e54a9d14b31414a26f46
MD5 7e1e16d86f932cb26dd872d3b42069a0
SHA1 9b8f43583cb8a30362109f180e335d555c9284e5
SHA512 9a63a6b153b735fe1cb992e6324c32af60d3457b85b528d8353b396824d5868e6bb68c18818e30755c45aec7fe14db4aa8a78fd2513ad62fe8096fc683e1541f
SSDEEP 49152:5FN9ShyvI8u+4RN5F5VR2GtXwphU4G/7lTSX70tdhzSwQsA4r2gwFyNyoEwgM9Em:h9VgJtdaKyoEwgM9EicQ15f6iMf4
TLSH
T188E5AF46B3A540E8C0BBD178D657921BE772744803309BEB13E0CE696F63BE15B7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
phantom_Cracked.exe

File Explorer

phantom_Cracked.exe

.exe 2.9MB

phantom_Cracked.exe

IMPHASH 55cf3e772c50f013b18cf2c8ad45d7a1
SHA256 5fcf2aa491ead9e65826860d03f893b7b60770931107e54a9d14b31414a26f46
MD5 7e1e16d86f932cb26dd872d3b42069a0
SHA1 9b8f43583cb8a30362109f180e335d555c9284e5
SHA512 9a63a6b153b735fe1cb992e6324c32af60d3457b85b528d8353b396824d5868e6bb68c18818e30755c45aec7fe14db4aa8a78fd2513ad62fe8096fc683e1541f
SSDEEP 49152:5FN9ShyvI8u+4RN5F5VR2GtXwphU4G/7lTSX70tdhzSwQsA4r2gwFyNyoEwgM9Em:h9VgJtdaKyoEwgM9EicQ15f6iMf4
TLSH
T188E5AF46B3A540E8C0BBD178D657921BE772744803309BEB13E0CE696F63BE15B7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2159540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpSendRequest WinHttpConnect WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle

vmprotectsdk64

VMProtectBegin VMProtectEnd

kernel32

ExitProcess CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetSystemInfo MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW GetModuleFileNameA GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetCurrentThreadId InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetLastError DuplicateHandle Module32First GetProcessId Module32Next GetCurrentProcess Process32FirstW Process32NextW K32GetModuleFileNameExA OpenProcess VirtualQueryEx VirtualProtectEx WriteProcessMemory ReadProcessMemory GetCurrentThread SetThreadPriority GetConsoleWindow GetCurrentProcessId GetConsoleMode SetCurrentConsoleFontEx SetConsoleMode GetStdHandle SetConsoleTextAttribute GetTickCount CloseHandle Process32Next GetTickCount64 Sleep CreateToolhelp32Snapshot Process32First GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError CreateFileW HeapDestroy HeapSize InitializeCriticalSectionEx lstrcpynW DeleteCriticalSection GetModuleFileNameW FindNextFileW GetModuleHandleW

user32

GetClipboardData GetMonitorInfoA SetWindowDisplayAffinity SetWindowLongA SetClipboardData GetAsyncKeyState ShowWindow GetKeyState RegisterClassExW MoveWindow GetSystemMetrics CreateWindowExW GetMessageExtraInfo DestroyWindow LoadCursorA GetWindowRect DispatchMessageA DefWindowProcW SendMessageA UnregisterClassW SetLayeredWindowAttributes TranslateMessage EnumWindows MonitorFromWindow ScreenToClient GetCapture ClientToScreen SetWindowTextA PeekMessageA EmptyClipboard AppendMenuW DestroyMenu GetKeyboardLayout GetWindowTextA LoadImageW SetCapture DefWindowProcA TrackPopupMenu MessageBoxA CreatePopupMenu SendMessageW PostMessageA SetForegroundWindow GetMessageA LoadIconA GetDC CloseClipboard SetCursor GetClientRect SetProcessDPIAware PostQuitMessage IsWindowUnicode FindWindowA UpdateWindow ReleaseCapture GetClassNameA GetWindowThreadProcessId SendInput MapVirtualKeyA keybd_event IsWindow ShowCursor SetCursorPos ReleaseDC TrackMouseEvent GetForegroundWindow GetDesktopWindow GetCursorPos OpenClipboard

gdi32

GetDeviceCaps CreateSolidBrush

advapi32

SystemFunction036 GetLengthSid GetTokenInformation IsValidSid RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegDeleteKeyA CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteA Shell_NotifyIconW

d3dcompiler_43

D3DCompile

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Xbad_function_call@std@@YAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ _Mtx_lock _Thrd_id _Thrd_join _Mtx_unlock _Cnd_broadcast ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait ??7ios_base@std@@QEBA_NXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?uncaught_exceptions@std@@YAHXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Xtime_get_ticks ?id@?$ctype@D@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

winmm

timeBeginPeriod

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFindExtension CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertOpenStore CertGetNameStringW CertCreateCertificateChainEngine CryptQueryObject

ws2_32

getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent freeaddrinfo gethostname ioctlsocket sendto recvfrom getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler wcschr _CxxThrowException memcmp memchr memmove memset memcpy longjmp strrchr _purecall strchr strstr __std_terminate

api-ms-win-crt-heap-l1-1-0

realloc calloc _callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

abort _errno _invoke_watson _configure_narrow_argv terminate __sys_errlist __sys_nerr _beginthreadex _invalid_parameter_noinfo _resetstkoflw exit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment system

api-ms-win-crt-math-l1-1-0

log _fdopen fmodf _fdclass acosf sinf sin _dsign __setusermatherr pow logf atan2f roundf ceilf _dclass cosf floorf sqrtf ldexp sqrt powf

api-ms-win-crt-string-l1-1-0

strcpy_s _stricmp _strdup wcscpy_s strcmp wcsncpy wcslen tolower strncpy _wcsdup strpbrk strcspn strncmp wcspbrk strspn wcsncmp strlen

api-ms-win-crt-convert-l1-1-0

strtoll atof atoi strtoul strtod wcstombs strtoull strtol

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _lseeki64 fwrite _wfopen __stdio_common_vsprintf _wopen fread __stdio_common_vsscanf fputs __p__commode __stdio_common_vfprintf _read _write _fileno _close __stdio_common_vsprintf_s fflush _set_fmode _popen _pclose fgets fputc fseek fgetc fclose feof fgetpos setvbuf ftell _get_stream_buffer_pointers _fseeki64 fsetpos ungetc

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _localtime64_s _time64 _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wstat64 _fstat64 _unlock_file _unlink

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale