JJSploit[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

JJSploit.exe
Size

9.9MB
MD5

325420af7bbb170cc7c94e3cab26c169
SHA1

dce685934565878c8fb925a45b1a8ac30dbd482c
SHA256

72be69123b64e13408d5c6ff629eea2bb3a8860e522380afa3ba079ff9d179c7
SHA512

0a53bf1cf7dd0ad2f95faf9f5ce3867e7a59de3ccdee6b5342d640911c29a918ca8f4e0231fc0e5fa346439b4231ec8973bc7c7d65dccef8b178d52f86296c1e
SSDEEP

196608:LY6WRa2wVkoL14oKr1Cd9dXyAaQVKGzzM2oyyM50g7a0eIKogbN7jyzUUmVQvN+c:LY6WRa2wVkoL14oKr1Cd9dXyAaQVKGzD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JJSploit.exe

Files

JJSploit.exe
.exe windows x86

161373b363dc78930c0b94de0a2f10a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

SetWindowSubclass
RemoveWindowSubclass
DefSubclassProc

user32

ShowWindow
PostQuitMessage
GetKeyboardState
GetKeyState
GetAsyncKeyState
VkKeyScanW
AdjustWindowRectEx
RedrawWindow
ValidateRect
PostThreadMessageW
PeekMessageW
GetUpdateRect
ShowCursor
GetClipCursor
SetWindowTextW
MonitorFromRect
PostMessageW
TrackMouseEvent
DestroyWindow
GetWindowLongW
GetClientRect
ClientToScreen
GetRawInputData
CreateMenu
MonitorFromPoint
EnumDisplayMonitors
IsProcessDPIAware
MessageBoxW
EnumChildWindows
SendInput
SetForegroundWindow
GetWindowRect
DispatchMessageA
GetMessageA
GetDC
GetTouchInputInfo
GetKeyboardLayout
SetWindowDisplayAffinity
ScreenToClient
ToUnicodeEx
AppendMenuW
GetMenu
GetSystemMenu
CreateAcceleratorTableW
SendMessageW
CloseTouchInputHandle
SetCapture
SetWindowLongW
CreateIcon
MsgWaitForMultipleObjectsEx
GetCursorPos
RegisterRawInputDevices
MonitorFromWindow
CheckMenuItem
SystemParametersInfoA
SetMenuItemInfoW
EnableMenuItem
DestroyAcceleratorTable
DestroyIcon
RegisterClassExW
SetCursorPos
GetActiveWindow
GetForegroundWindow
SetMenu
ReleaseCapture
RegisterWindowMessageA
MapVirtualKeyExW
RegisterTouchWindow
GetSystemMetrics
IsWindow
CreateWindowExW
SetWindowPos
InvalidateRgn
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
FlashWindowEx
DefWindowProcW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
IsWindowVisible
MapVirtualKeyW
LoadCursorW
ClipCursor
GetMonitorInfoW
SetCursor

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
GetCurrentThreadId
LoadLibraryA
GetModuleHandleW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
OpenProcess
TerminateProcess
TlsSetValue
EnterCriticalSection
TlsGetValue
ResetEvent
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
TryAcquireSRWLockExclusive
GetTempPathW
GetSystemTimeAsFileTime
GetFileAttributesW
GetModuleFileNameW
GetLastError
OutputDebugStringA
OutputDebugStringW
TlsFree
InitOnceComplete
TlsAlloc
InitOnceBeginInitialize
LoadLibraryExW
SetUnhandledExceptionFilter
FreeLibrary
GetEnvironmentVariableW
SetFileTime
CreateThread
WriteConsoleW
ReleaseSRWLockShared
CreateProcessW
GetWindowsDirectoryW
GetProcessHeap
HeapAlloc
GetSystemDirectoryW
HeapFree
WaitForMultipleObjects
FormatMessageW
SetEvent
WaitForSingleObject
GetCurrentProcess
CreateNamedPipeW
GetFullPathNameW
ExitProcess
GetConsoleMode
CancelIo
CreateEventW
GetFinalPathNameByHandleW
SetHandleInformation
CreateHardLinkW
GetCurrentProcessId
CreateSymbolicLinkW
DeleteFileW
FindFirstFileW
GetFileInformationByHandleEx
FindNextFileW
CreateMutexA
WaitForSingleObjectEx
HeapReAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
WakeConditionVariable
CreateIoCompletionPort
GetQueuedCompletionStatusEx
WakeAllConditionVariable
PostQueuedCompletionStatus
ReadFileEx
SetFileCompletionNotificationModes
ReadFile
GetOverlappedResult
SleepEx
IsProcessorFeaturePresent
Sleep
GetModuleHandleA
WriteFileEx
GetStdHandle
RtlUnwind
CreateDirectoryW
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
RaiseException
GetCurrentDirectoryW
SetLastError
RtlCaptureContext
GetCurrentThread
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
FindClose
ReleaseMutex
FreeEnvironmentStringsW
SleepConditionVariableSRW
DeviceIoControl
GetVolumeInformationW
GetDriveTypeW
GetSystemInfo
DuplicateHandle
GetProcAddress
LoadLibraryW
lstrlenW
GetFileInformationByHandle
SetFileAttributesW
MoveFileExW
CreateFileW
AcquireSRWLockShared
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
GetDiskFreeSpaceExW
EncodePointer
GetUserDefaultUILanguage
GetProcessTimes
GetExitCodeProcess
LCIDToLocaleName
GetSystemTimes
GetProcessIoCounters

ole32

CoTaskMemFree
RevokeDragDrop
OleInitialize
CoTaskMemAlloc
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance
RegisterDragDrop
CreateStreamOnHGlobal
CoUninitialize

ws2_32

getsockname
WSAStartup
getpeername
WSASocketW
bind
connect
ioctlsocket
select
getsockopt
shutdown
recv
send
WSASend
setsockopt
getaddrinfo
WSAIoctl
WSAGetLastError
freeaddrinfo
WSACleanup
closesocket

gdi32

GetDeviceCaps
DeleteObject
CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

secur32

FreeContextBuffer
InitializeSecurityContextW
DecryptMessage
ApplyControlToken
AcquireCredentialsHandleA
LsaFreeReturnBuffer
AcceptSecurityContext
LsaGetLogonSessionData
EncryptMessage
LsaEnumerateLogonSessions
FreeCredentialsHandle
QueryContextAttributesW
DeleteSecurityContext

crypt32

CertFreeCertificateChain
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertDuplicateStore
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain

advapi32

EventSetInformation
EventUnregister
EventWriteTransfer
OpenProcessToken
RegGetValueW
GetTokenInformation
IsValidSid
RegOpenKeyExW
GetLengthSid
CopySid
LookupAccountSidW
SystemFunction036
RegCloseKey
RegQueryValueExW
EventRegister

shell32

DragQueryFileW
DragFinish
SHGetKnownFolderPath
SHCreateItemFromParsingName

uxtheme

SetWindowTheme

oleaut32

SetErrorInfo
SysAllocString
SysFreeString
GetErrorInfo
SysStringLen
VariantClear

ntdll

NtDeviceIoControlFile
NtCancelIoFileEx
NtCreateFile
NtQuerySystemInformation
RtlNtStatusToDosError

bcrypt

BCryptGenRandom

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue
PdhCloseQuery
PdhOpenQueryA
PdhAddEnglishCounterW
PdhRemoveCounter

powrprof

CallNtPowerInformation

iphlpapi

GetAdaptersAddresses
GetIfEntry2
GetIfTable2
FreeMibTable

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserEnum
NetUserGetInfo

psapi

GetPerformanceInfo
GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

__setusermatherr
round
floor
trunc

api-ms-win-crt-string-l1-1-0

wcsncmp
wcslen
_wcsicmp
strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
calloc
_callnewh
free

api-ms-win-crt-runtime-l1-1-0

abort
_seh_filter_exe
_set_app_type
terminate
_controlfp_s
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___argv
_c_exit
_cexit
_register_thread_local_exe_atexit_callback
_crt_atexit
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

161373b363dc78930c0b94de0a2f10a4

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

user32

kernel32

ole32

ws2_32

gdi32

dwmapi

secur32

crypt32

advapi32

shell32

uxtheme

oleaut32

ntdll

bcrypt

pdh

powrprof

iphlpapi

netapi32

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.rdata Size: 4.1MB - Virtual size: 4.1MB

.data Size: 7KB - Virtual size: 9KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 198KB - Virtual size: 197KB

.text
Size: 5.5MB - Virtual size: 5.5MB

.rdata
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 7KB - Virtual size: 9KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 198KB - Virtual size: 197KB