42968b9effbb77exeexe_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

42968b9effbb77exeexe_JC.exe
Size

759KB
MD5

42968b9effbb7707fa2c08f753879f7e
SHA1

d1519bfffd4393f6f506e5c1e6f1bde5f5d2d101
SHA256

babb0edf2c041702ae832a78ed94d2074b11d1f042f5d4fee2b82807612d2c7f
SHA512

37851df4b6018e75ffe0871316b522d03fef16f103580d66d2a691563b7ccec1f69dd4c67fbd79c06c8c9f13b0ef18baa351dc9a02a9308f4fd7c23dc219b266
SSDEEP

12288:W1jvF0xhEHdvaKFyBjiiZsLoNn48aEK78dtTQkeXd:pKwBjfslEK78jTQkQ

Score

1^/10

Malware Config

Signatures

Files

42968b9effbb77exeexe_JC.exe
.exe windows x86

dad9a1a83133bc0471853473f13b58ee

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

02:6e:95:dd:b0:89:f2:fd:1b:15:4b:d7:b8:1b:71:57
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/08/2022, 00:00

Not After

22/08/2023, 23:59

Subject

CN=Tendyron Corporation,O=Tendyron Corporation,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:85:28:37:d1:57:38:6d:85:10:bc:ca:d6:36:90:39:22:86:80:21
Signer

Actual PE Digest

3a:85:28:37:d1:57:38:6d:85:10:bc:ca:d6:36:90:39:22:86:80:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTimeZoneInformation
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LCMapStringW
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
SetUnhandledExceptionFilter
VirtualQuery
VirtualAlloc
VirtualProtect
HeapSize
HeapReAlloc
HeapAlloc
HeapFree
ExitProcess
RaiseException
RtlUnwind
GetStartupInfoW
GetTickCount
GetFileTime
GetFileSizeEx
GetFileAttributesW
SetErrorMode
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
InterlockedDecrement
GetModuleHandleA
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
GetVersionExA
GetThreadLocale
FreeResource
FormatMessageW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
lstrlenA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
lstrcpyA
GetLastError
SetLastError
WriteFile
CreateEventW
OpenEventW
SetEvent
LocalFree
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
OpenMutexW
CreateProcessA
GetSystemInfo
lstrcatW
WaitForSingleObject
CreateMutexW
ProcessIdToSessionId
ReleaseMutex
CreateFileW
GetWindowsDirectoryW
lstrcmpW
GetLocalTime
GetCurrentThreadId
CreateThread
GetCurrentProcessId
lstrcatA
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
WideCharToMultiByte
GetVersionExW
GetSystemDefaultLangID
GetModuleHandleW
FreeLibrary
GetCurrentProcess
GetPrivateProfileStringW
lstrcpyW
lstrlenW
MultiByteToWideChar
CreateProcessW
CloseHandle
Sleep
LoadLibraryW
LoadLibraryA
GetProcAddress

user32

GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
GetScrollRange
SetScrollPos
GetScrollPos
IsWindowVisible
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowTextLengthW
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetMenuState
GetMenuItemID
GetMenuItemCount
IsChild
SetCapture
GetWindowRgn
SetWindowRgn
ReleaseCapture
RedrawWindow
MessageBoxW
ScreenToClient
IsZoomed
DrawFrameControl
EqualRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetWindowLongW
DrawTextExW
TabbedTextOutW
DrawEdge
SetRectEmpty
PtInRect
GetWindowTextW
GetWindowThreadProcessId
GetTopWindow
GetWindow
LoadCursorW
GetScrollInfo
SetRect
DrawTextW
DrawTextA
GetWindowLongW
WindowFromPoint
GetNextDlgTabItem
GetActiveWindow
ClientToScreen
DrawFocusRect
DrawStateW
FrameRect
OffsetRect
InflateRect
CopyRect
LoadMenuW
GetIconInfo
GetMessageW
SetDlgItemTextW
IsDialogMessageW
SetWindowTextW
MoveWindow
ShowWindow
CreateIconIndirect
GetDC
ReleaseDC
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
CheckMenuItem
EnableMenuItem
ModifyMenuW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetClassNameW
IsWindowEnabled
SendMessageW
WaitForInputIdle
wsprintfW
EnableWindow
GetSysColor
InvalidateRect
LoadImageW
GetSystemMetrics
wsprintfA
PostMessageW
EndDialog
GetParent
EnumWindows
KillTimer
FindWindowW
LoadBitmapW
DrawIcon
IsIconic
GetWindowRect
GetClientRect
SetTimer
LoadIconW
RegisterWindowMessageW
CreateWindowExW
UpdateWindow
SetForegroundWindow
RegisterClassExW
DefWindowProcW
DestroyMenu
DestroyCursor
DestroyIcon
SetCursor
TrackPopupMenuEx
GetSubMenu
FillRect
CharUpperW
GetWindowDC
BeginPaint
EndPaint
ValidateRect
GetCursorPos
TranslateMessage
PostThreadMessageW
RegisterClipboardFormatW
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
IsRectEmpty
CharNextW
UnregisterClassW
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GrayStringW

gdi32

GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetBkColor
MoveToEx
LineTo
SetMapMode
SetStretchBltMode
DPtoLP
CreateRectRgnIndirect
GetClipBox
GetRegionData
SelectClipRgn
SetBkMode
GetTextMetricsW
SetTextAlign
FillRgn
PtInRegion
CreateRectRgn
CombineRgn
GetRgnBox
OffsetRgn
CreateDCW
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetMapMode
CreatePen
GetTextColor
GetCurrentPositionEx
GetDeviceCaps
SaveDC
GetTextExtentPoint32W
RestoreDC
CreateDIBSection
GetPixel
SetPixel
CreateCompatibleBitmap
CreateBitmap
SelectObject
SetBkColor
BitBlt
SetTextColor
DeleteDC
DeleteObject
StretchBlt
CreateCompatibleDC
SetBrushOrgEx
GetStockObject
GetObjectW
CreateFontIndirectW
CreateSolidBrush

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegCloseKey
RegCreateKeyW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegQueryValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegEnumKeyW

shell32

SHGetSpecialFolderPathW
ord680
ShellExecuteExW

comctl32

_TrackMouseEvent
ord17

shlwapi

PathFindExtensionW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
wvnsprintfA
StrStrW
StrStrA
PathCompactPathW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

CLSIDFromProgID
OleRun
CoTaskMemAlloc
CLSIDFromString
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
CoInitializeEx
StgOpenStorageOnILockBytes
CoGetClassObject
OleInitialize
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CoInitialize
CoCreateInstance
CoUninitialize
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject

oleaut32

VariantInit
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysAllocString
VariantChangeType
SysStringLen
SysFreeString
VariantClear
OleCreateFontIndirect

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertCreateCertificateContext
CertGetNameStringW
CertOpenStore
CertFindCertificateInStore
CertCompareCertificateName
CertCloseStore
CryptVerifyMessageSignature
CertFreeCertificateContext
PFXVerifyPassword
CertGetNameStringA
CertNameToStrA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetGetConnectedState
InternetCheckConnectionW

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

winmm

PlaySoundW

dbtoken_2gbcm

OnKeyT_ContextFinal
OnKeyT_GetSlotList
OnKeyT_ContextInit
OnKeyT_ChangePin
OnKeyT_ManTokenParam
OnKeyT_GetDeviceInfo
OnKeyT_InitToken
OnKeyT_Login
OnKeyT_ReloadPin
OnKeyT_WaitForSlotEvent
Ossl_Base64_Decode
AddEnter
RemoveEnter
Ossl_Base64_Encode
Ossl_MakeP7Data
OnKeyT_CreateObject
Ossl_GetCertPublicKeyN
Ossl_GetCertFromP7
Ossl_PackageP10
OnKeyT_GeneratePairKeyEx

Sections

.text
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dad9a1a83133bc0471853473f13b58ee

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

02:6e:95:dd:b0:89:f2:fd:1b:15:4b:d7:b8:1b:71:57Certificate

Extended Key Usages

Key Usages

3a:85:28:37:d1:57:38:6d:85:10:bc:ca:d6:36:90:39:22:86:80:21Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wtsapi32

crypt32

version

wininet

imagehlp

winmm

dbtoken_2gbcm

Sections

.text Size: 421KB - Virtual size: 420KB

.rdata Size: 148KB - Virtual size: 148KB

.data Size: 13KB - Virtual size: 29KB

.rsrc Size: 166KB - Virtual size: 166KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

02:6e:95:dd:b0:89:f2:fd:1b:15:4b:d7:b8:1b:71:57
Certificate

3a:85:28:37:d1:57:38:6d:85:10:bc:ca:d6:36:90:39:22:86:80:21
Signer

.text
Size: 421KB - Virtual size: 420KB

.rdata
Size: 148KB - Virtual size: 148KB

.data
Size: 13KB - Virtual size: 29KB

.rsrc
Size: 166KB - Virtual size: 166KB