john-xop-non-omp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

john-xop-non-omp.exe
Size

6.7MB
MD5

79ac735229c3ec6ab69e25cfc1d3de0e
SHA1

9f49540d9847d0ca4d3aaaf3bcfb1154905d0c8f
SHA256

15baad37cd1dd8d802bcc1f83a1f1ff5855e9e9cb3839664a713fd41dc06b87b
SHA512

7e1678c7a560f832be4af97fdf20720b0476413a799ac983ebce5b6e31de392f17d7c27211adbbadc962d951d190e3b797e6590a75384eb931ef5f7b9623bb41
SSDEEP

49152:TgBlgov/2XcnLHH94G3Mjek5fUCNqnZPNWiiiifSoVWA/cK0setxZTzDHT8WJVtl:8BlJ+GSitoAs0se1TWAMl8Hb7C

Score

1^/10

Malware Config

Signatures

Files

john-xop-non-omp.exe
.exe windows x64

ee056cdad8c6508072708b3a9b08d25a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

cygbz2-1

BZ2_bzDecompress
BZ2_bzDecompressEnd
BZ2_bzDecompressInit

cygcrypt-2

crypt

cygcrypto-1.1

AES_cbc_encrypt
AES_cfb128_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_set_decrypt_key
AES_set_encrypt_key
BF_cbc_encrypt
BF_cfb64_encrypt
BF_ecb_encrypt
BF_set_key
BN_CTX_free
BN_CTX_new
BN_bin2bn
BN_bn2bin
BN_bn2hex
BN_cmp
BN_div
BN_free
BN_hex2bn
BN_mod_exp
BN_mul
BN_new
CAST_cfb64_encrypt
CAST_ecb_encrypt
CAST_set_key
CMAC_CTX_free
CMAC_CTX_new
CMAC_Final
CMAC_Init
CMAC_Update
CRYPTO_free
Camellia_cfb128_encrypt
Camellia_set_key
DES_cbc_cksum
DES_cbc_encrypt
DES_crypt
DES_ecb_encrypt
DES_ede3_cbc_encrypt
DES_ede3_cfb64_encrypt
DES_encrypt1
DES_key_sched
DES_ncbc_encrypt
DES_pcbc_encrypt
DES_set_key
DES_set_key_unchecked
DES_set_odd_parity
DES_string_to_key
DSA_free
DSA_get0_key
DSA_get0_pqg
DSA_new
DSA_set0_key
DSA_set0_pqg
EVP_aes_128_cbc
MD4_Final
MD4_Init
MD4_Update
MD5_Final
MD5_Init
MD5_Update
RC2_cbc_encrypt
RC2_set_key
RIPEMD160_Final
RIPEMD160_Init
RIPEMD160_Update
SHA1
SHA1_Final
SHA1_Init
SHA1_Update
SHA224_Final
SHA224_Init
SHA224_Update
SHA256_Final
SHA256_Init
SHA256_Update
SHA384_Final
SHA384_Init
SHA384_Update
SHA512_Final
SHA512_Init
SHA512_Update
WHIRLPOOL_Final
WHIRLPOOL_Init
WHIRLPOOL_Update

cygwin1

__assert_func
__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__main
_dll_crt0
_exit
_impure_ptr
abort
asctime
atoi
atol
atoll
calloc
chmod
clock
close
closedir
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
dlopen
dlsym
execv
exit
fclose
fcntl
fdopen
fflush
fgetc
fgets
fileno
fopen
fork
fprintf
fputc
fputs
fread
free
freopen
fscanf
fseek
fstat
fsync
ftell
ftruncate
fwrite
getc
getchar
getenv
getopt
getpid
getppid
gettimeofday
gmtime
isatty
kill
localtime
log
lseek
malloc
memchr
memcmp
memcpy
memmem
memmove
memset
mmap
munmap
nice
open
opendir
optarg
optind
perror
posix_memalign
pow
printf
putchar
puts
qsort
raise
rand
read
readdir
realloc
rewind
sched_yield
setenv
setlocale
setvbuf
sigaction
signal
sleep
snprintf
sprintf
srand
sscanf
stat
stpcpy
strcasecmp
strcasestr
strcat
strchr
strcmp
strcpy
strcspn
strdup
strerror
strftime
strlen
strlwr
strncasecmp
strncat
strncmp
strncpy
strnlen
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
strupr
sysconf
tcgetattr
tcgetpgrp
tcsetattr
time
times
tolower
toupper
umask
ungetc
unlink
vfprintf
vsnprintf
vsprintf
wait
write

cyggmp-10

__gmp_version
__gmpz_clear
__gmpz_get_str
__gmpz_init
__gmpz_init_set_str
__gmpz_mul_2exp
__gmpz_powm
__gmpz_set_str

cygopencl-1

clBuildProgram
clCreateBuffer
clCreateCommandQueue
clCreateContext
clCreateKernel
clCreateProgramWithBinary
clCreateProgramWithSource
clEnqueueMapBuffer
clEnqueueNDRangeKernel
clEnqueueReadBuffer
clEnqueueUnmapMemObject
clEnqueueWriteBuffer
clFinish
clFlush
clGetDeviceIDs
clGetDeviceInfo
clGetEventInfo
clGetEventProfilingInfo
clGetKernelInfo
clGetKernelWorkGroupInfo
clGetMemObjectInfo
clGetPlatformIDs
clGetPlatformInfo
clGetProgramBuildInfo
clGetProgramInfo
clReleaseCommandQueue
clReleaseContext
clReleaseEvent
clReleaseKernel
clReleaseMemObject
clReleaseProgram
clSetKernelArg
clWaitForEvents

cygz

inflate
inflateEnd
inflateInit2_
inflateInit_

cyggcc_s-seh-1

__floatuntidf
__udivmodti4
__udivti3
__umodti3

kernel32

CloseHandle
CreateMutexA
GetModuleHandleA
GetModuleHandleW
MapViewOfFile
OpenFileMappingA
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
SetConsoleCtrlHandler
Sleep
UnmapViewOfFile
WaitForSingleObject

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 645KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 19.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee056cdad8c6508072708b3a9b08d25a

Headers

DLL Characteristics

File Characteristics

Imports

cygbz2-1

cygcrypt-2

cygcrypto-1.1

cygwin1

cyggmp-10

cygopencl-1

cygz

cyggcc_s-seh-1

kernel32

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.data Size: 645KB - Virtual size: 644KB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.buildid Size: 512B - Virtual size: 53B

.pdata Size: 106KB - Virtual size: 106KB

.xdata Size: 126KB - Virtual size: 125KB

.bss Size: - Virtual size: 19.7MB

.idata Size: 10KB - Virtual size: 10KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 645KB - Virtual size: 644KB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.buildid
Size: 512B - Virtual size: 53B

.pdata
Size: 106KB - Virtual size: 106KB

.xdata
Size: 126KB - Virtual size: 125KB

.bss
Size: - Virtual size: 19.7MB

.idata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 1KB - Virtual size: 1KB