Static task
static1
Behavioral task
behavioral1
Sample
8299006011a94a_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8299006011a94a_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
8299006011a94a_JC.exe
-
Size
386KB
-
MD5
8299006011a94a5d6c6317a3c907a500
-
SHA1
42c2eb181437a88cdbb796b2557c4cf161850536
-
SHA256
cbb224ed8f3e7d7271b2bfdaccb7343758aa93c1c60f82f2693922a57fbf8a3f
-
SHA512
6e69233355f6040c7da35e00cf09f07356f68e3fad91605699364e27e02d7a9c801d91f68ed38653442ca06b5ca7a96218e5d463da058a7ee173317ba6bda7df
-
SSDEEP
6144:gUslxYcRFxKjixt+rS5Tg4enPkKLstexGNxVy:tslxYcRP64t+rocnPkKQti0x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8299006011a94a_JC.exe
Files
-
8299006011a94a_JC.exe.exe windows x86
3e1e79e7678e07c22f9def81ef2d3f6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
lstrcpyA
lstrcatA
OpenProcess
GetModuleFileNameA
LoadLibraryA
OutputDebugStringA
GetProcAddress
FreeLibrary
GetModuleHandleA
CreateToolhelp32Snapshot
Process32First
Process32Next
QueryDosDeviceA
Sleep
CreateProcessA
GetCurrentProcess
GetLastError
CreateThread
TerminateProcess
CreateFileA
DeleteFileA
GetPrivateProfileIntA
CreateMutexA
GetProcessHeap
SetEndOfFile
lstrcmpiA
GetLogicalDriveStringsA
CloseHandle
GetCurrentThreadId
GetCurrentProcessId
GetLocalTime
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
GetPrivateProfileStringA
EnterCriticalSection
CreateFileW
WriteConsoleW
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
ReadFile
SetFilePointer
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
SetHandleCount
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
EncodePointer
DecodePointer
InterlockedCompareExchange
MultiByteToWideChar
GetLocaleInfoW
GetStringTypeW
HeapFree
HeapAlloc
GetFullPathNameA
GetModuleHandleW
ExitProcess
GetFileAttributesA
GetCommandLineA
HeapSetInformation
RtlUnwind
RaiseException
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapSize
IsProcessorFeaturePresent
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
LoadLibraryW
SetEnvironmentVariableA
user32
MessageBoxA
advapi32
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CreateProcessAsUserA
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueA
OpenProcessToken
QueryServiceStatusEx
userenv
CreateEnvironmentBlock
wtsapi32
WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsA
psapi
GetProcessImageFileNameA
ws2_32
connect
inet_addr
htons
send
closesocket
WSAGetLastError
recv
WSACleanup
WSAStartup
ntohs
socket
Sections
.text Size: 304KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ