Static task
static1
Behavioral task
behavioral1
Sample
b8359b0ad6d4b3_JC.exe
Resource
win7-20230712-en
General
-
Target
b8359b0ad6d4b3_JC.exe
-
Size
683KB
-
MD5
b8359b0ad6d4b351ef33b713d2a3a2e9
-
SHA1
d4d10fa8671b85343b42e322156c5aefec77d00a
-
SHA256
fc9ed88ce2b9a0b20f97938e709b178202f31f430a0eacacb936f0da6e10ebb7
-
SHA512
019719c1c938f5a300ebdaf8d954df1c8b22da1a4459ee3e7c695ed677859f24fca37d618afefb7d213401c8329b0863a2e1b86de49af13263380faaabc0a0e9
-
SSDEEP
12288:XAYz0vNGYFEQwnW9aT/jr/jjSvLXJ3H/7qovfOoOIcKnojG9nus44:XjMsWQTbmF3zqouoOIcXGZu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8359b0ad6d4b3_JC.exe
Files
-
b8359b0ad6d4b3_JC.exe.exe windows x86
2ac88b908fa571a3f1696742ae2085fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiW
LocalAlloc
LocalReAlloc
LocalSize
ReadFile
WriteFile
GetCurrentProcessId
WaitNamedPipeW
CreateFileW
GetSystemDirectoryW
DeviceIoControl
lstrlenW
CreateEventW
CreateThread
WaitForMultipleObjects
ExitThread
FindFirstFileW
FindClose
SetThreadPriority
GetExitCodeThread
SetEvent
GetModuleHandleW
GetCommandLineW
GlobalFree
OpenFileMappingW
GetShortPathNameW
GetCurrentProcess
WTSGetActiveConsoleSessionId
SetLastError
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
Sleep
GetLastError
OpenEventW
WaitForSingleObject
HeapSize
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
HeapAlloc
FlushFileBuffers
LCMapStringW
WriteConsoleW
SetStdHandle
RtlUnwind
GetLocaleInfoW
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
GetStringTypeW
MultiByteToWideChar
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
LocalFree
HeapFree
IsValidCodePage
GetCommandLineA
HeapSetInformation
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
advapi32
AllocateAndInitializeSid
SetNamedSecurityInfoW
SetEntriesInAclW
SetServiceStatus
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
StartServiceCtrlDispatcherW
RegQueryValueExW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
ControlService
CloseServiceHandle
RegisterServiceCtrlHandlerExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
SetTokenInformation
ImpersonateLoggedOnUser
CreateProcessAsUserW
RevertToSelf
RegCreateKeyExW
RegSetValueExW
FreeSid
wtsapi32
WTSQueryUserToken
WTSFreeMemory
WTSQuerySessionInformationW
shell32
CommandLineToArgvW
userenv
LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
DestroyEnvironmentBlock
setupapi
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
wintrust
WinVerifyTrust
crypt32
CertFindCertificateInStore
CryptQueryObject
CertFreeCertificateContext
CertCloseStore
shlwapi
StrRChrW
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE