phoenix-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
phoenix-launcher.exe
Size 9.7MB
Sample260814-jsglragb78
SHA256 37e4b353e0b1ea2ef552af2825a3610a8b051464a96795c596045dd1cc49cd21
MD5 a399582dbe0974eb5a00fbca5dbc1453
SHA1 664569ecc825ccfc88ae50390ceb055a53417dd6
SHA512 dc36806c43be425318afba1fb002dc75fd958831116f257644fdb0ae20d8f8e6a356976cd30755999509c03c807d698131544b0678748736cf321ece172cdf84
SSDEEP 98304:ZeHnK8uESRIWTBCVoewBcn4mawildBmjb+YTpAKioCt5q32szPnn:0nK8uJRIPwBcn4mQubMo
TLSH
T1D7A62902BE8B9968D08EC8B0C3878AA68D2130DB1D35B5BF14D6563D2E7E7F45F19319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
phoenix-launcher.exe

File Explorer

phoenix-launcher.exe

.exe 9.7MB

phoenix-launcher.exe

IMPHASH 06aa5a803f440d0fbd192d8844ed336f
SHA256 37e4b353e0b1ea2ef552af2825a3610a8b051464a96795c596045dd1cc49cd21
MD5 a399582dbe0974eb5a00fbca5dbc1453
SHA1 664569ecc825ccfc88ae50390ceb055a53417dd6
SHA512 dc36806c43be425318afba1fb002dc75fd958831116f257644fdb0ae20d8f8e6a356976cd30755999509c03c807d698131544b0678748736cf321ece172cdf84
SSDEEP 98304:ZeHnK8uESRIWTBCVoewBcn4mawildBmjb+YTpAKioCt5q32szPnn:0nK8uJRIPwBcn4mQubMo
TLSH
T1D7A62902BE8B9968D08EC8B0C3878AA68D2130DB1D35B5BF14D6563D2E7E7F45F19319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6282672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

phoenix_launcher.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateFileW CreateMutexA CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetUserDefaultUILanguage GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionEx InitializeSListHead LCIDToLocaleName LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

user32

AdjustWindowRect AdjustWindowRectEx AppendMenuW ChangeDisplaySettingsExW CheckMenuItem ClientToScreen ClipCursor CloseTouchInputHandle CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawIconEx DrawMenuBar DrawTextW EnableMenuItem EnableWindow EnumChildWindows EnumDisplayMonitors FillRect FindWindowExW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClientRect GetClipCursor GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMenuBarInfo GetMenuItemInfoW GetMessageA GetMessageW GetMonitorInfoW GetParent GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindow GetWindowDC GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InsertMenuW InvalidateRect InvalidateRgn IsIconic IsProcessDPIAware IsWindow IsWindowEnabled IsWindowVisible LoadCursorW MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageW SetCapture SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow ValidateRect VkKeyScanW

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject SetBkMode SetTextColor

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

shell32

DragFinish DragQueryFileW SHAppBarMessage SHCreateItemFromParsingName SHGetKnownFolderPath ShellExecuteW

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

advapi32

EventRegister EventSetInformation EventUnregister EventWriteTransfer RegCloseKey RegGetValueW RegOpenKeyExW RegQueryValueExW SystemFunction036

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv select send setsockopt

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s strlen wcscmp wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow round roundf trunc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

387KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

429B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

phoenix-launcher.exe

bcryptprimitives

ntdll

kernel32

user32

gdi32

ole32

comctl32

shell32

dwmapi

oleaut32

advapi32

shlwapi

api-ms-win-core-synch-l1-2-0

bcrypt

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic