zjlxnt[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

zjlxnt.exe
Size

93KB
MD5

a22e128e1c66e8e76f2f05ca2d81a8f1
SHA1

589a59b124facc5a045fa99b334e476415e57ca2
SHA256

ee05f69606802b01d1fa5bb8bc43885f7f5f66c53893de380f9026cd3afaa79d
SHA512

c646ed13aa87fc2345aae5ac640cd6e3a4b46b780045c86f4a384f4affd7e9fd510d7f50ecf2afbfb12f34734997077e4dc7dc46b1222a8ede0d0d793f77468b
SSDEEP

1536:+0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvwk:Ld4KALsGZDN+x/yuZocSTkyBw9y8eASd

Score

1^/10

Malware Config

Signatures

Files

zjlxnt.exe
.exe windows x86

a616ada7ab9834d0da305aefcacbe416

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHQueryValueExA
PathFindFileNameW
PathUnquoteSpacesW
SHRegWriteUSValueA
SHDeleteEmptyKeyW

kernel32

VirtualAlloc
GetLastError
CloseHandle
HeapAlloc
GetProcessHeap
GetConsoleWindow
GetConsoleOutputCP
FlushFileBuffers
CreateFileW
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetCurrentProcess
ReadConsoleW
GetConsoleMode
SetFilePointerEx
HeapFree
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
ReadFile
RaiseException
EncodePointer
HeapReAlloc
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableW
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW

wsnmp32

ord201
ord300
ord107
ord106
ord902
ord104
ord205

pdh

PdhSelectDataSourceW
PdhParseCounterPathA
PdhOpenLogA
PdhIsRealTimeQuery
PdhLookupPerfNameByIndexA
PdhParseInstanceNameA

msacm32

acmStreamSize
acmDriverID
acmDriverDetailsA
acmFilterTagDetailsW
acmStreamReset
acmStreamOpen
acmStreamMessage

rtutils

RouterLogEventStringA
RouterGetErrorStringA
TraceDumpExA
MprSetupProtocolFree

avicap32

videoThunk32

msvfw32

ICMThunk32
ICRemove
DrawDibClose
DrawDibStart

avifil32

EditStreamClone

rpcrt4

I_RpcBindingToStaticStringBindingW
RpcMgmtEpEltInqNextW
NdrServerContextNewUnmarshall
NdrSimpleStructBufferSize
RpcSmSetThreadHandle
NdrXmitOrRepAsUnmarshall

user32

ShowWindow

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a616ada7ab9834d0da305aefcacbe416

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

wsnmp32

pdh

msacm32

rtutils

avicap32

msvfw32

avifil32

rpcrt4

user32

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 4KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 4KB