PhoenixBootstrapper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PhoenixBootstrapper.exe
Size 2.9MB
Sample261001-j2kd1aec36
SHA256 ef9fc4fa8a59d76591fcb4c7974bb144746d480b96b9e4de3ba4e2debfe42ae9
MD5 1041ddb9c84dd7db6e117f6b1e857bde
SHA1 586e3ff65ad15c2288bd76699b6881df00bc6b6f
SHA512 bf2613b629d6184955b54181623aba795965ba37fe78f0dac7d39218a4bc8be1f2a5fc9c5711a716d857af014e5ad42323bf785560866038a68f17525e8a8d34
SSDEEP 49152:QWQ72LcT/hoH7/IMTEBsQvv/lDQpj0wvPttJU51abMzf6kxoXDdYG8iRvrBGOOCT:QR7jab/qBtvv9cpj3vB2Pzf6kgDdYZif
TLSH
T1A5E533E06385F207F8674A750CB863BF4FEF93B924665DC2221C397E2199720E398356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
PhoenixBootstrapper.exe
unpack001/$PLUGINSDIR/NScurl.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsJSON.dll

File Explorer

PhoenixBootstrapper.exe

.exe 2.9MB
$PLUGINSDIR/NScurl.dll

.dll 7.6MB
$PLUGINSDIR/StdUtils.dll

.dll 100KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsJSON.dll

.dll 23KB

PhoenixBootstrapper.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 ef9fc4fa8a59d76591fcb4c7974bb144746d480b96b9e4de3ba4e2debfe42ae9
MD5 1041ddb9c84dd7db6e117f6b1e857bde
SHA1 586e3ff65ad15c2288bd76699b6881df00bc6b6f
SHA512 bf2613b629d6184955b54181623aba795965ba37fe78f0dac7d39218a4bc8be1f2a5fc9c5711a716d857af014e5ad42323bf785560866038a68f17525e8a8d34
SSDEEP 49152:QWQ72LcT/hoH7/IMTEBsQvv/lDQpj0wvPttJU51abMzf6kxoXDdYG8iRvrBGOOCT:QR7jab/qBtvv9cpj3vB2Pzf6kgDdYZif
TLSH
T1A5E533E06385F207F8674A750CB863BF4FEF93B924665DC2221C397E2199720E398356
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

test1234

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NScurl.dll

IMPHASH 79d2992377fd60cc62f58dd3b607b6fd
SHA256 6fd2b9a1f6b7446c4e2b0149586621e95e0bf3b12faac88a13da95562907fe7c
MD5 bd1654cb77662accd030558e2c031961
SHA1 1558517991d9756d1bc33e7fdd45ede2ce10fac7
SHA512 083084e1025bed706a4276e697b13931a2b201919c4f3c0763032305348c34c8428514e9091d232ff98b8f32c9961db85f525a37f1047db9a36a854e00be3f79
SSDEEP 196608:Z8GtjsDi1vOJ8sTu7tCL4u3OKBb7VYGh/hSUp/v3uTRC6dCfF0:SGDGRI/I
TLSH
T1A5863A95FFCB44F1E90788B088E7B37F8B34A7158025D6AAEE1C1D56F933701252A35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

test1234

Minor OS version

Major OS version

Entry point

5697216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext DeregisterEventSource RegisterEventSourceW ReportEventW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenSystemStoreW

kernel32

CloseHandle CompareFileTime CompareStringA CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateSemaphoreA CreateThread DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileA FindFirstFileW FindNextFileW FindResourceExW FormatMessageA FormatMessageW FreeLibrary GetACP GetCPInfo GetConsoleMode GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileSize GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTickCount GetVersion GetVersionExW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LockResource MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleA ReadConsoleW ReadFile ReleaseSemaphore ResetEvent SetConsoleMode SetEvent SetFilePointer SetLastError SizeofResource Sleep SleepEx SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiA lstrcmpiW lstrcpyW lstrcpynA lstrcpynW lstrlenA lstrlenW

msvcrt

__lc_codepage __p__iob __p___mb_cur_max _amsg_exit _assert _beginthreadex _close _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fstati64 _fullpath _get_osfhandle _initterm _lock _lseek _read _setmode _snprintf _snwprintf _stat _strdup _strdup _unlink _unlock _vsnprintf _vsnwprintf _wfopen _wfreopen _wfsopen _write _wsopen _wstati64 _wtoi64 abort atoi bsearch calloc fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos ftell fwrite getc getenv gmtime isdigit islower isspace isupper isxdigit localeconv malloc memchr memcmp memcpy memmove memset qsort raise realloc setvbuf signal sprintf strcat strchr strcmp strcpy strcspn strerror strftime strlen strncmp strncpy strpbrk time strrchr strspn strstr strtol strtoul tolower ungetc vfprintf wcscat wcscpy wcslen wcsncmp wcsstr wcstombs wprintf

user32

CallWindowProcW CopyRect CreateDialogParamW CreateWindowExW DestroyIcon DestroyWindow DispatchMessageW EnableMenuItem EnableWindow FindWindowExW GetDesktopWindow GetDlgItem GetProcessWindowStation GetPropW GetSystemMenu GetSystemMetrics GetUserObjectInformationW GetWindow GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDialogMessageW IsWindow IsWindowEnabled IsWindowVisible LoadImageW MessageBoxW MsgWaitForMultipleObjects OffsetRect PeekMessageW RemovePropW ScreenToClient SendDlgItemMessageW SendMessageW SetForegroundWindow SetPropW SetRectEmpty SetWindowLongW SetWindowPos SetWindowTextW TranslateMessage wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSASocketA WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect gethostbyaddr gethostbyname getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

713KB

Virtual Size

712KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

178KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/StdUtils.dll

IMPHASH 7b79709c0d5576549eb261e3410f95f8
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

test1234

Minor OS version

Major OS version

Entry point

60089

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

iswspace ??3@YAXPAX@Z _msize _wsetlocale _snprintf iswcntrl _beginthreadex time srand rand clock _getpid _wsplitpath iswgraph __wgetmainargs wcsncpy _wcsnicmp wcschr calloc free _wcsicmp _snwprintf swscanf abort ??2@YAPAXI@Z memset memcpy

shlwapi

ord176

crypt32

CryptProtectData CryptUnprotectData

kernel32

GlobalFree MultiByteToWideChar WideCharToMultiByte InterlockedExchange HeapValidate InterlockedDecrement InterlockedIncrement GetSystemTime OutputDebugStringA GetExitCodeProcess InitializeCriticalSection SystemTimeToFileTime TerminateThread WaitForSingleObject LocalFree GetFullPathNameW GetVersion GetFileAttributesW LoadLibraryW FreeLibrary CloseHandle lstrcpynW GlobalAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetTickCount Sleep VerSetConditionMask GetCurrentProcess GetModuleHandleW FatalAppExitW GetVersionExW TerminateProcess GetModuleFileNameW RaiseException VerifyVersionInfoW GetLastError GetProcAddress SetFilePointerEx WriteFile ReadFile CreateFileW GetFileSizeEx GetCommandLineW

user32

MsgWaitForMultipleObjects PeekMessageW DispatchMessageW wsprintfW DestroyWindow SetTimer UnregisterClassW KillTimer LoadStringW MessageBoxW GetWindowThreadProcessId AllowSetForegroundWindow CreateWindowExW RegisterClassW MessageBoxA

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

ShellExecuteExW SHFileOperationW ShellExecuteW

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

test1234

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

IMPHASH 674631b5b86309caa1d0df66c91a50f2
SHA256 8142b1bf6a3cd570c8c689ea749e71bd20fb07dfd0b8d0ed1c40eaade5882c0a
MD5 27b72e2b74534a1b8fd28d3e9326f30e
SHA1 32cb148f934362fc885f3ee85f9e3bc7ba1a61a6
SHA512 a73ac7e52b444b3948be5f0b6747dc35ac399acb1cc814e00b5e15dd37ffcc4ab1c715a410cc1166fea08902473afc66e0e304251757c52aa4257c34de228a23
SSDEEP 384:Q/rU5Ciwt1Q27yvn9TfldvuLik/BInwMiSFEOq6GUCTevvxOuofA6PlAUPUX2q2:LQt1Qnn9Tfldzk2bFE3ZeE1PUf2
TLSH
T127B23742A6B048F5F67755BA79722E231E7EBD18286195EBC73319186820913BF3D333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

test1234

Minor OS version

Major OS version

Entry point

11850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PhoenixBootstrapper.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NScurl.dll

advapi32

crypt32

kernel32

msvcrt

user32

version

ws2_32

generic

$PLUGINSDIR/StdUtils.dll

msvcrt

shlwapi

crypt32

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsJSON.dll

wininet

kernel32

user32

generic