ORBIT + Phantom mw19[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ORBIT + Phantom mw19.exe
Size 17.0MB
Sample260823-3ztpfabe82
SHA256 742ac35201d479dd8cb1ba9b481bdd759b7711a36418e38b5b4841f33cb74f5c
MD5 fb13c5e237a0e7571dcdfb77338696b4
SHA1 5487962165557ba5b202bd53893e2da209c2a1f1
SHA512 b7c26ba9fc7b25a917ed25405e01e4f866a415080fd1b48fd3da20e2d853f7c05a388ce1c1804a2018036e70145b0573f7c6b9f96b649f99897259afea2387a5
SSDEEP 393216:0dOtKFTJ9SXINHz6wtJeedeSaPqQ7Wfl0O7G9e/jAXVd:0ogF19SXSWwtJeTbPHCfl00Gc0Xb
TLSH
T102073306B5C300FAC0DAC3B99232B03FB23D37A1952E7CA567E945111C53969DDFAE46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ORBIT + Phantom mw19.exe

File Explorer

ORBIT + Phantom mw19.exe

.exe 17.0MB

ORBIT + Phantom mw19.exe

IMPHASH 26b2599c98f7852123a9082c2ce5a3e5
SHA256 742ac35201d479dd8cb1ba9b481bdd759b7711a36418e38b5b4841f33cb74f5c
MD5 fb13c5e237a0e7571dcdfb77338696b4
SHA1 5487962165557ba5b202bd53893e2da209c2a1f1
SHA512 b7c26ba9fc7b25a917ed25405e01e4f866a415080fd1b48fd3da20e2d853f7c05a388ce1c1804a2018036e70145b0573f7c6b9f96b649f99897259afea2387a5
SSDEEP 393216:0dOtKFTJ9SXINHz6wtJeedeSaPqQ7Wfl0O7G9e/jAXVd:0ogF19SXSWwtJeTbPHCfl00Gc0Xb
TLSH
T102073306B5C300FAC0DAC3B99232B03FB23D37A1952E7CA567E945111C53969DDFAE46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5214974

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

kernel32

CreateToolhelp32Snapshot GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

MessageBoxA

gdi32

GetDeviceCaps

advapi32

CryptAcquireContextA

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmSetCompositionWindow

dwmapi

DwmEnableBlurBehindWindow

ntdll

RtlCaptureContext

normaliz

IdnToAscii

wldap32

ord60

crypt32

CertCreateCertificateChainEngine

ws2_32

bind

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

ftell

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

sinf

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

865KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

. @?

Size

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.it)

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.D-e

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ORBIT + Phantom mw19.exe

d3d9

kernel32

user32

gdi32

advapi32

shell32

msvcp140

imm32

dwmapi

ntdll

normaliz

wldap32

crypt32

ws2_32

psapi

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic