589ed58a5ef0f4_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

589ed58a5ef0f4_JC.exe
Size

1.2MB
MD5

589ed58a5ef0f44521510ac25429997e
SHA1

d37ce1c697ec1d4649938d8eb4dbf5abc409cc77
SHA256

b83228dd56dd4b10c81666932381bb7c65be3faca4e8678079fd336cadbd22f5
SHA512

8d8084ac3f7e1e993e1e0066d964c150d9e72d6343b926896ab3413ade72c69256f3d9be2bc6adb5aff6a59eb1bdff89f79c2e7a46387c97947e7e8a34e248cd
SSDEEP

12288:sMjerFu6ZAxHwiXB99bTjBNs8c9TQg/Y7WNbvdkNVK807/sB7qBJmGxClteX+haT:PiU6ktsl9TrDLiJ07gqB4Gctei1Gd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
589ed58a5ef0f4_JC.exe

Files

589ed58a5ef0f4_JC.exe
.exe windows x86

34646f7db0fbfc8d8374d08965cd096f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

psapi

GetModuleFileNameExA
EnumProcesses
EnumProcessModules

kernel32

FindNextFileA
FileTimeToSystemTime
FindFirstFileA
VirtualProtect
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
FindResourceExA
SetErrorMode
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RemoveDirectoryA
FindClose
GetStartupInfoA
ExitProcess
SetStdHandle
GetFileType
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsValidCodePage
LCMapStringA
GetStringTypeA
GetStringTypeW
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeZoneInformation
GetDriveTypeA
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcmpA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
RaiseException
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
MulDiv
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateProcessW
GetModuleFileNameW
SetFileTime
SetFileAttributesW
GetTempFileNameW
GetTempPathW
GetFileSize
SetFilePointer
WriteFile
ReadFile
SetEndOfFile
CreateFileW
LocalFileTimeToFileTime
DosDateTimeToFileTime
FileTimeToLocalFileTime
MoveFileExW
InterlockedDecrement
InterlockedIncrement
LCMapStringW
CreateThread
GetFileTime
CompareFileTime
GetCurrentDirectoryA
GetDefaultCommConfigA
GetACP
DeviceIoControl
LocalAlloc
CreateDirectoryA
SetLastError
FormatMessageA
LocalFree
OpenProcess
GetProfileStringA
WriteProfileStringA
WaitForSingleObject
CopyFileA
GetTempFileNameA
GetTickCount
Sleep
SetFileAttributesA
GetWindowsDirectoryA
GetSystemDirectoryA
GetFileAttributesA
GetModuleHandleA
GetProcAddress
lstrlenA
CompareStringW
CompareStringA
GetVersion
MultiByteToWideChar
InterlockedExchange
GetLocaleInfoA
LoadLibraryA
GetCommandLineA
FreeLibrary
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateFileA
CloseHandle
DeleteFileA
GetModuleFileNameA
GetTempPathA
MoveFileExA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetCurrentProcess
GetLastError
GetProcessHeap

user32

DestroyMenu
UnregisterClassA
LoadCursorA
GetSysColorBrush
InvalidateRect
DrawFocusRect
EndPaint
BeginPaint
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
ReleaseDC
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
MapDialogRect
ShowWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
CheckRadioButton
CheckDlgButton
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextLengthA
GetForegroundWindow
SetActiveWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
GetSysColor
AdjustWindowRectEx
ScreenToClient
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
wvsprintfA
GetAsyncKeyState
GetWindowRect
GetClientRect
GetDC
LoadBitmapA
PostMessageA
GetParent
SendNotifyMessageA
CharUpperA
EnableWindow
GetWindow
SendMessageA
MessageBoxA
GetDesktopWindow
ExitWindowsEx
GetMenu
RegisterClassA
GetWindowTextA

gdi32

CreateSolidBrush
CreateFontIndirectA
DPtoLP
GetTextMetricsA
EnumFontFamiliesExA
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetStockObject
CreateCompatibleDC
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
BitBlt
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
GetObjectA

comdlg32

GetFileTitleA

winspool.drv

EnumPrinterDriversA
ClosePrinter
OpenPrinterA
EnumMonitorsA
AddPortA
GetPrinterA
EnumPrintersA
ord201
SetJobA
EnumJobsA
DeletePrinter
DeletePrinterConnectionA
DeletePrinterDriverA
SetPrinterA
DocumentPropertiesA
DocumentPropertiesW
ord202
ConfigurePortA
AddPrinterA
GetPrintProcessorDirectoryA
EnumPortsA
GetPrinterDriverDirectoryA

advapi32

OpenServiceA
RegQueryValueA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyA
RegEnumKeyA
AdjustTokenPrivileges
OpenSCManagerA
QueryServiceStatus
ControlService
StartServiceA
CloseServiceHandle
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegEnumValueA
RegEnumKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHChangeNotify
ShellExecuteExA
ShellExecuteA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oleaut32

VariantClear
SysAllocStringLen
VariantChangeType
VariantInit

Sections

.text
Size: 460KB - Virtual size: 458KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 684KB - Virtual size: 688KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34646f7db0fbfc8d8374d08965cd096f

Headers

File Characteristics

Imports

version

psapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oleaut32

Sections

.text Size: 460KB - Virtual size: 458KB

.rdata Size: 108KB - Virtual size: 106KB

.data Size: 16KB - Virtual size: 26KB

.rsrc Size: 684KB - Virtual size: 688KB

.text
Size: 460KB - Virtual size: 458KB

.rdata
Size: 108KB - Virtual size: 106KB

.data
Size: 16KB - Virtual size: 26KB

.rsrc
Size: 684KB - Virtual size: 688KB