Phantom[.]win[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Phantom.win.exe
Size 471KB
Sample260820-s8s46atwe1
SHA256 fca065ee5d05364f607c00bb90cbbaa1c9274a6c8cb10451ca64f0c61df42dc8
MD5 951bb89a27b2ef658cd7173d162f64ce
SHA1 511afd96a8e518f4da3145cd09dfc070317e257d
SHA512 f8bfbfb7e44e1dbc974f1134809272511c822f745a9430a4e354994a89fede684cbc27b229eac9d890009ea5d6a12fca6ea9cdc3d06a6d5617bee7b271be3cfb
SSDEEP 6144:oaZk/eki0BPdaWh1eNmmuRzSD6766LgzBx97VyfN7Vv7WfIC9vFpAn7NIDgU:xZ+ESq67668B+1Vv78ICdFpAnBU
TLSH
T1FFA48D85F1F545E8E06AE038A567BB1FF635344807101ADB23D4D9682FF27E0AAB7352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Phantom.win.exe

File Explorer

Phantom.win.exe

.exe 471KB

Phantom.win.exe

IMPHASH b1076afb432fc82bdad5f75b2d357dfa
SHA256 fca065ee5d05364f607c00bb90cbbaa1c9274a6c8cb10451ca64f0c61df42dc8
MD5 951bb89a27b2ef658cd7173d162f64ce
SHA1 511afd96a8e518f4da3145cd09dfc070317e257d
SHA512 f8bfbfb7e44e1dbc974f1134809272511c822f745a9430a4e354994a89fede684cbc27b229eac9d890009ea5d6a12fca6ea9cdc3d06a6d5617bee7b271be3cfb
SSDEEP 6144:oaZk/eki0BPdaWh1eNmmuRzSD6766LgzBx97VyfN7Vv7WfIC9vFpAn7NIDgU:xZ+ESq67668B+1Vv78ICdFpAnBU
TLSH
T1FFA48D85F1F545E8E06AE038A567BB1FF635344807101ADB23D4D9682FF27E0AAB7352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

385968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Lakatos Nándor Noel\Desktop\celex\build\Phantom.win.pdb

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary VerifyVersionInfoW QueryPerformanceCounter GetModuleHandleA Sleep GetLocaleInfoEx FormatMessageA LocalFree GetModuleFileNameA AreFileApisANSI GetLastError GetModuleHandleW ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead CloseHandle Process32Next CreateToolhelp32Snapshot OpenProcess Module32First GetProcessId MultiByteToWideChar Module32Next Process32First

user32

SetWindowLongA FindWindowW GetAsyncKeyState SetClipboardData GetClipboardData GetDC EmptyClipboard LoadCursorA GetKeyState SendInput UpdateWindow ScreenToClient FindWindowA CloseClipboard PostQuitMessage PeekMessageA TranslateMessage SetLayeredWindowAttributes OpenClipboard GetCursorPos ReleaseDC SetCursorPos ReleaseCapture SetProcessDPIAware GetClientRect SetWindowDisplayAffinity GetWindowLongA GetWindowTextA ShowWindow DefWindowProcW SetCursor MonitorFromPoint DispatchMessageA DestroyWindow SetCapture CreateWindowExW GetSystemMetrics GetForegroundWindow IsChild ClientToScreen UnregisterClassW GetCapture RegisterClassExW

gdi32

GetDeviceCaps

msvcp140

?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memset _CxxThrowException __current_exception_context __C_specific_handler memcmp strstr __std_terminate __std_exception_copy __std_exception_destroy __current_exception memchr

api-ms-win-crt-string-l1-1-0

_stricmp strncpy strlen strcmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fseek fclose fflush __acrt_iob_func _set_fmode ftell

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

atan2f ceilf logf cosf pow powf acosf fmodf __setusermatherr log sqrtf sqrt sinf roundf floorf