joker | 13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8

Sharing

Copy URL Twitter E-mail

General

Target
13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8
Size 3.5MB
Sample221107-1433kaebgr
SHA256 13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8
MD5 c738f0f966954593989c0d99494bb87b
SHA1 a8197de5ce6c3d3a49b3beaf8d3538ff43ee9c4f
SHA512 2508145638308658d8d61468fa895d95aea20e2450f3f812720968a86f7fd33cabbf571daf53a571821beab557ed277c239a9ff51ba7fe5b070442b46bcb6895
SSDEEP 49152:/ufHLkgsOS6lSWTKVUMghsLgkXvJVn0oG5tCZktDqpdmhMPJ9xpfqT:grkgsx6lSWTI1LgAvJZr4tCmtCFp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

joker

Malware Config

Extracted

Family

joker

https://cq2c.oss-cn-hangzhou.aliyuncs.com

Signatures

Joker family
joker

File Explorer

13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8

.exe 3.5MB

13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8

IMPHASH 2080ac84ded2cd923d0da58a5839faa7
SHA256 13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8
MD5 c738f0f966954593989c0d99494bb87b
SHA1 a8197de5ce6c3d3a49b3beaf8d3538ff43ee9c4f
SHA512 2508145638308658d8d61468fa895d95aea20e2450f3f812720968a86f7fd33cabbf571daf53a571821beab557ed277c239a9ff51ba7fe5b070442b46bcb6895
SSDEEP 49152:/ufHLkgsOS6lSWTKVUMghsLgkXvJVn0oG5tCZktDqpdmhMPJ9xpfqT:grkgsx6lSWTI1LgAvJZr4tCmtCFp
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

592488

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvfw32

DrawDibDraw

avifil32

AVIStreamGetFrame AVIStreamInfoA

iphlpapi

GetAdaptersInfo

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop PlaySoundA waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen

ws2_32

inet_addr inet_ntoa gethostbyname WSAStartup WSACleanup select send closesocket WSAAsyncSelect htons socket setsockopt recvfrom ioctlsocket connect recv accept WSAGetLastError ntohs getservbyname shutdown getpeername

rasapi32

RasGetConnectStatusA RasHangUpA

kernel32

GetWindowsDirectoryA GetSystemDirectoryA SetLastError GetTimeZoneInformation GetLocaleInfoA GetVersion FileTimeToSystemTime InterlockedIncrement InterlockedDecrement LocalFree FileTimeToLocalFileTime lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile lstrcmpiA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrcmpA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind GetSystemTime GetLocalTime RaiseException HeapSize GetACP SetStdHandle GetFileType UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableW SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage EnumSystemLocalesA GetLocaleInfoW SetNamedPipeHandleState WaitNamedPipeA UnmapViewOfFile MapViewOfFile OpenFileMappingA OpenEventA TerminateProcess GetCurrentProcess GetFileSize SetFilePointer CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID MultiByteToWideChar WideCharToMultiByte GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose GetFileAttributesA DeleteFileA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle InterlockedExchange

user32

LoadStringA GetSysColorBrush GetDesktopWindow GetNextDlgTabItem LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement EndDialog CreateDialogIndirectParamA DestroyWindow GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC CharUpperA GetWindowTextLengthA SetWindowTextA GetForegroundWindow GetWindowTextA GetDlgItem DestroyAcceleratorTable GetClassNameA RedrawWindow UnregisterClassA

gdi32

RoundRect GetCurrentObject DPtoLP LPtoDP Rectangle CreateCompatibleDC BitBlt GetTextExtentPoint32A StartPage StartDocA Ellipse GetTextMetricsA Escape ExtTextOutA RectVisible PtVisible GetViewportExtEx DeleteDC EndDoc EndPage GetObjectA GetStockObject CreateFontIndirectA CreateSolidBrush FillRgn CreateRectRgn CombineRgn PatBlt CreatePen SelectObject CreatePatternBrush CreateBitmap CreateHatchBrush CreateBrushIndirect CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode CreateDIBSection CreateRectRgnIndirect SetBkColor TextOutA SetBkMode SetTextColor SetDIBitsToDevice SaveDC RestoreDC SetPolyFillMode SetROP2 SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetDeviceCaps

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

comdlg32

ChooseColorA GetOpenFileNameA GetSaveFileNameA GetFileTitleA

advapi32

RegEnumValueA RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleInitialize CLSIDFromString CoCreateInstance OleRun OleUninitialize

oleaut32

VariantClear VariantChangeType SafeArrayGetUBound UnRegisterTypeLi LoadTypeLi LHashValOfNameSys RegisterTypeLi SafeArrayGetLBound SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString

comctl32

_TrackMouseEvent ImageList_SetBkColor ord17 ImageList_Destroy ImageList_Read ImageList_Duplicate ImageList_GetImageCount

wininet

InternetConnectA InternetSetOptionA InternetOpenA InternetCloseHandle InternetCanonicalizeUrlA InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile