Static task
static1
Behavioral task
behavioral1
Sample
8a3e80e3f4376d_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8a3e80e3f4376d_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
8a3e80e3f4376d_JC.exe
-
Size
11.0MB
-
MD5
8a3e80e3f4376d567b8336164122ca0b
-
SHA1
004ab49d1402e991381fd3752183e9608c10b0d1
-
SHA256
c7b4bb0f440ff573e43cd355496157d61d64a3b2c098ac8b00d3671274dadda6
-
SHA512
4eb23e3aa131f055a671689d429c850cc6c3e93eee9ffba268e828fae529b665b30c4240147349e4b54a78818fe14e23b406c17e67179a68529bddfdc39c8e54
-
SSDEEP
196608:TTFX8SzJ32z6o1KS/AcNYY8uNAWj6kVNYj0QAwimrTFmMGu7Om:vp8CYjNAWjF2Hfr7b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a3e80e3f4376d_JC.exe
Files
-
8a3e80e3f4376d_JC.exe.exe windows x86
286e8da320a1b3484bddf25d9e0dc4c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringW
kernel32
WinExec
GetCommandLineW
OutputDebugStringW
Sleep
ReleaseMutex
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
FindFirstFileW
FindNextFileW
SetCurrentDirectoryW
RemoveDirectoryW
GetCurrentProcess
LocalAlloc
CopyFileW
MoveFileW
GetTempFileNameW
CreateFileW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
CreateMutexW
GetFileAttributesW
FindResourceA
CreateDirectoryW
GetTempPathW
CreateProcessW
GetSystemDefaultUILanguage
GetSystemInfo
GetVersionExW
FreeLibrary
WaitForSingleObject
DeleteFileW
GetModuleHandleW
CloseHandle
GetProcAddress
LoadLibraryW
SizeofResource
LockResource
LoadResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
LocalFree
SetEndOfFile
FindClose
GetProcessHeap
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
InterlockedExchange
LoadLibraryA
RaiseException
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetStringTypeW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCPInfo
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetFileAttributesW
RtlUnwind
CompareStringW
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
SetFilePointer
ReadFile
FlushFileBuffers
user32
wsprintfW
GetDesktopWindow
GetWindowRect
GetSystemMetrics
advapi32
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyW
RegCloseKey
RegEnumValueW
shell32
CommandLineToArgvW
ShellExecuteExW
ole32
CoCreateGuid
urlmon
URLDownloadToFileW
Sections
.text Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ