2cd427af733bbbexeexe_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2cd427af733bbbexeexe_JC.exe
Size

101KB
MD5

2cd427af733bbb872fc000094153e011
SHA1

171d20bc4fe3de2d9a031e4b7568223796a7c163
SHA256

afda12ba1de3a96884617e11eff700ff7f263eeffee1d58d26bb773e9381e617
SHA512

802bc81aa7d77bb79b5cf559919f99569e7db8642697ed22b1e740627fe1e98c50bd095b2cc8c7600e2e167adaa79265229b25e57e6bfe9ded1139b9c4b90961
SSDEEP

3072:AmD1tmtnnhf1j6VTAjIF66yRru77xHLDT3MqqD/txX6T:AyHWnn7WTWIF66yYwqqD/txqT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cd427af733bbbexeexe_JC.exe

Files

2cd427af733bbbexeexe_JC.exe
.exe windows x86

2430c4d884e6b7c075f835fdb6a6475c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetShareEnum
NetApiBufferFree

iphlpapi

GetAdaptersInfo

ws2_32

htons
ioctlsocket
WSAGetLastError
connect
inet_addr
__WSAFDIsSet
closesocket
select
WSACleanup
WSAStartup
socket

crypt32

CryptBinaryToStringA

gdiplus

GdipDrawString
GdipCreateStringFormat
GdipDeleteFontFamily
GdipGetImageEncoders
GdipCreateFontFamilyFromName
GdipDeleteBrush
GdipDisposeImage
GdipCreateFont
GdipCreateSolidFill
GdipFillRectangle
GdipGetGenericFontFamilySansSerif
GdiplusStartup
GdipGetImageGraphicsContext
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipSaveImageToFile

shlwapi

PathRemoveExtensionA
PathRemoveBackslashW
PathAddBackslashW
StrFormatByteSize64A
PathRemoveFileSpecW
PathFindExtensionW

mpr

WNetAddConnection2W
WNetOpenEnumW
WNetEnumResourceW
WNetGetConnectionW
WNetCloseEnum

ntdll

RtlAdjustPrivilege
RtlInitUnicodeString
NtAllocateVirtualMemory
LdrEnumerateLoadedModules
RtlAcquirePebLock
RtlReleasePebLock
memcpy
memset

msvcrt

malloc
calloc
free

kernel32

QueryDosDeviceW
FindFirstVolumeW
GetModuleFileNameW
lstrcpyW
GetWindowsDirectoryW
lstrcatW
InterlockedPopEntrySList
AllocConsole
GetCurrentProcessId
InitializeSListHead
InterlockedPushEntrySList
lstrcpyA
InterlockedFlushSList
MoveFileW
CreateIoCompletionPort
SystemTimeToFileTime
GetQueuedCompletionStatus
SetFileTime
WriteFile
GetFileSizeEx
ReadFile
SetThreadAffinityMask
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetVolumeMountPointW
GetLogicalDrives
FindFirstFileExW
EnterCriticalSection
GetCommandLineW
FindNextFileW
lstrlenW
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
FindClose
GetFileAttributesW
ExitThread
OpenProcess
SetFileAttributesW
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
GetDiskFreeSpaceExW
GlobalAlloc
Process32FirstW
GlobalFree
CloseHandle
CreateThread
DeleteCriticalSection
ExitProcess
GetConsoleWindow
lstrcmpiW
GetDriveTypeW
GetTempPathW
MultiByteToWideChar
GetTempFileNameW
CreateMutexA
OpenMutexA
LoadLibraryA
GetProcAddress
GetTickCount
GetSystemInfo
GetLocalTime
Process32First
TerminateProcess
GetUserDefaultLangID
GetConsoleMode
WaitForSingleObject
GetModuleHandleA
Process32Next
lstrcmpiA
CreateProcessA
lstrcmpW
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
WriteConsoleA
SetConsoleMode
SetProcessShutdownParameters
SetErrorMode
CreateFileW

user32

PeekMessageW
GetWindowLongA
wvsprintfA
SetWindowLongA
ShowWindow
GetMessageW
CharLowerBuffW
CharUpperA
DeleteMenu
wsprintfW
FlashWindow
wsprintfA
IsWindowVisible
SystemParametersInfoW
GetSystemMetrics
EnableMenuItem
SetLayeredWindowAttributes
RegisterHotKey
ShutdownBlockReasonCreate
GetSystemMenu

advapi32

RegCreateKeyExA
DuplicateToken
SetThreadToken
OpenProcessToken
RegSetValueExA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
GetAclInformation
GetAce
AllocateAndInitializeSid
AddAce
AddAccessDeniedAce
FreeSid
InitializeAcl
SetSecurityInfo
GetLengthSid
GetSecurityInfo
EnumDependentServicesA
CryptReleaseContext
InitializeSecurityDescriptor
CloseServiceHandle
OpenSCManagerA
GetTokenInformation
ControlService
RegSetValueExW
RegDeleteValueW
QueryServiceStatusEx
RegQueryValueExW
OpenServiceA
AdjustTokenPrivileges
SetFileSecurityW
CryptAcquireContextW
SetSecurityDescriptorOwner
CryptGenRandom
LookupPrivilegeValueA
CreateWellKnownSid
CheckTokenMembership

shell32

SHEmptyRecycleBinW
ShellExecuteExA
ShellExecuteExW
CommandLineToArgvW

ole32

CoGetObject
CoUninitialize
CoInitializeEx

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2430c4d884e6b7c075f835fdb6a6475c

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

iphlpapi

ws2_32

crypt32

gdiplus

shlwapi

mpr

ntdll

msvcrt

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 76KB - Virtual size: 76KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 8KB

.text
Size: 76KB - Virtual size: 76KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 8KB