618804306fe03b_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

618804306fe03b_JC.exe
Size

3.9MB
MD5

618804306fe03b3cdc5a46549269a621
SHA1

6e4ff85f477f8a10a5561c5b354b65ad69b61bb3
SHA256

dafcb3831dad1a6df35c933266719e9b07cbb2d3321b7163fcd8137381bcf623
SHA512

052ed60d6cd52fbb33edddaf8883a251f60fa2fbc4b47d5fd86c4421fa894ee9453d41a5e0aa71447ff6657d569ae847213579d29bf975dff0a5669991351d90
SSDEEP

98304:lTrn46UqYXVrcot6bGZH1zQRhZpRh2ApVTL:pQtiP/n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
618804306fe03b_JC.exe

Files

618804306fe03b_JC.exe
.exe windows x86

489cc4b87cc4427c3c376a154ba3271c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
RemoveDirectoryW
GetModuleHandleA
GetSystemDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTempPathW
CreateEventW
ResetEvent
SetEvent
TerminateThread
GetExitCodeThread
SuspendThread
ResumeThread
CreateFileW
VirtualAlloc
lstrcmpA
lstrcpynW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
OpenEventW
WaitForMultipleObjects
UnmapViewOfFile
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
GetCurrentThreadId
GetCommandLineW
AttachConsole
GetConsoleDisplayMode
FreeConsole
WaitNamedPipeW
CreateThread
GetTickCount
VirtualFree
InterlockedIncrement
InterlockedDecrement
RaiseException
DecodePointer
ReadFile
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
Sleep
GetTempFileNameW
MoveFileExW
GetSystemTime
GetLongPathNameW
GetPrivateProfileStringW
OutputDebugStringW
GetWindowsDirectoryW
GetVersionExW
FreeLibrary
LoadLibraryW
GetExitCodeProcess
GetCurrentProcessId
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
FindFirstFileW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleMode
HeapDestroy
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetCurrentThread
GetACP
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetFullPathNameA
GetFullPathNameW
FormatMessageA
WriteFile
OutputDebugStringA
GetFileSize
DeleteFileA
GetModuleFileNameA
SetFileAttributesW
GetFileAttributesW
GetUserDefaultLangID
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateProcessW
WaitForSingleObject
WTSGetActiveConsoleSessionId
Process32NextW
ProcessIdToSessionId
CloseHandle
GetLastError
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetLocalTime
LocalFree
CreateDirectoryW
CreateDirectoryA
LocalAlloc
GetModuleFileNameW
lstrlenW
PeekNamedPipe
GetFileType
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetFileAttributesExW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
SetProcessWorkingSetSize
GetComputerNameW
CreateMutexW
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
InterlockedExchangeAdd
SetEnvironmentVariableW
GetEnvironmentVariableW
SetFileTime
MulDiv
GlobalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
VerSetConditionMask
VerifyVersionInfoW
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFileTimeToFileTime
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
InterlockedExchange
TryEnterCriticalSection
SetThreadPriority
InterlockedCompareExchange
GetCPInfo
GetLocaleInfoW
SetFilePointer
CreateFileA
TerminateProcess
GetCurrentProcess
GetModuleHandleW
GetProcAddress
SystemTimeToFileTime
GetDiskFreeSpaceExW
FindFirstFileExW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
EncodePointer
GetStringTypeW
FormatMessageW
IsDebuggerPresent
FileTimeToSystemTime
FileTimeToLocalFileTime
CopyFileW
FindNextFileW
SetStdHandle
FindClose
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW

user32

UnionRect
UpdateLayeredWindow
IsRectEmpty
GetUpdateRect
MoveWindow
EndPaint
BeginPaint
ReleaseCapture
SetCapture
GetFocus
InvalidateRect
GetPropW
SetPropW
CallWindowProcW
MonitorFromWindow
GetMessageW
SetFocus
EnableWindow
GetWindow
IsWindow
GetClassInfoExW
RegisterClassW
LoadCursorW
OffsetRect
DefWindowProcW
DestroyWindow
GetKeyState
CreateWindowExW
WaitMessage
RegisterClassExW
DispatchMessageW
MsgWaitForMultipleObjectsEx
CallMsgFilterW
GetQueueStatus
TranslateMessage
IsIconic
GetDesktopWindow
GetShellWindow
GetClassNameW
GetWindowRect
MonitorFromRect
GetMonitorInfoW
OpenClipboard
EqualRect
GetWindowLongW
EnumWindows
SetCursor
GetForegroundWindow
GetLastInputInfo
UnregisterClassW
FindWindowA
FindWindowExA
IsClipboardFormatAvailable
CharNextW
PeekMessageW
PostThreadMessageW
wsprintfW
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
FindWindowW
WindowFromPoint
SetParent
GetAncestor
PostMessageW
GetCursorPos
LoadImageW
SendMessageW
SetWindowPos
SetWindowTextW
SetTimer
KillTimer
FlashWindowEx
GetDC
ReleaseDC
GetClientRect
IsWindowVisible
PtInRect
GetSystemMetrics
SendMessageTimeoutW
PostQuitMessage
FindWindowExW
SetWindowLongW
ClientToScreen
AttachThreadInput
ShowWindow
SetForegroundWindow
GetActiveWindow
FlashWindow
SystemParametersInfoW
ScreenToClient
GetParent
MonitorFromPoint
IsZoomed
SetWindowRgn
SetClassLongW
MessageBoxW
MapWindowPoints
GetSysColor
GetWindowThreadProcessId
GetAsyncKeyState
IntersectRect

gdi32

SetStretchBltMode
GetObjectA
CreateRectRgnIndirect
CreateCompatibleDC
SetWindowOrgEx
DeleteObject
DeleteDC
SelectObject
ExtSelectClipRgn
CreateDIBSection
GetWindowOrgEx
GetObjectW
GetStockObject
CreateFontIndirectW
GetTextMetricsW
BitBlt
GetDeviceCaps
CreateRoundRectRgn
StretchBlt
SaveDC
RestoreDC

advapi32

RegCloseKey
AllocateAndInitializeSid
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptDestroyHash
CryptReleaseContext
GetUserNameA
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
RegQueryValueExW
InitializeSecurityDescriptor
RegSetValueExW
RegOpenKeyExW
CreateProcessAsUserW
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
SetEntriesInAclW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHChangeNotify
SHAppBarMessage
Shell_NotifyIconA
Shell_NotifyIconW
ord165
SHGetFolderPathW
CommandLineToArgvW
SHGetMalloc
ShellExecuteW
SHFileOperationW

ole32

CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
OleUninitialize
OleInitialize
StringFromGUID2
CLSIDFromString
CoTaskMemFree

oleaut32

VariantChangeType
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString
SetErrorInfo
CreateErrorInfo
GetErrorInfo

shlwapi

PathFileExistsW
PathFileExistsA
PathCombineW
PathRemoveFileSpecA
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
PathIsRelativeW
PathAppendA

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CertCloseStore
CertGetNameStringW
CertFreeCertificateContext
CryptDecodeObject
CryptQueryObject
CryptMsgClose
CertFindCertificateInStore
CryptMsgGetParam

wintrust

CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext

gdiplus

GdipAlloc
GdipFree
GdipCreateBitmapFromFileICM
GdipCloneImage
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipMeasureString
GdipFillPath
GdipDrawPath
GdipFillEllipseI
GdipDrawEllipseI
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawRectangleI
GdipDrawBezierI
GdipSetSmoothingMode
GdipDrawLineI
GdipFillRectangle
GdipDeletePath
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathBezierI
GdipCreateBitmapFromFile
GdipAddPathLineI
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathFillMode
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDeletePen
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipCreatePen1
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipDeleteMatrix
GdipCreateMatrix
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipAddPathLine2I

winmm

timeSetEvent
timeGetTime
timeKillEvent

comctl32

ord17
_TrackMouseEvent

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmSetOpenStatus
ImmGetContext
ImmGetOpenStatus

msimg32

AlphaBlend

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

setupapi

SetupFindFirstLineW
SetupGetLineCountW
SetupGetFieldCount
SetupGetStringFieldW
SetupFindNextLine
SetupCloseInfFile
SetupOpenInfFileW

winhttp

WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpQueryHeaders

dbghelp

MiniDumpWriteDump

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 832KB - Virtual size: 831KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 46KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 279KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

489cc4b87cc4427c3c376a154ba3271c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

userenv

crypt32

wintrust

gdiplus

winmm

comctl32

imm32

msimg32

version

setupapi

winhttp

dbghelp

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 832KB - Virtual size: 831KB

.data Size: 46KB - Virtual size: 77KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 163KB - Virtual size: 163KB

.reloc Size: 279KB - Virtual size: 280KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 832KB - Virtual size: 831KB

.data
Size: 46KB - Virtual size: 77KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 163KB - Virtual size: 163KB

.reloc
Size: 279KB - Virtual size: 280KB