ba6692e24d1f10_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ba6692e24d1f10_JC.exe
Size

2.1MB
MD5

ba6692e24d1f1032fb56f328aff008bd
SHA1

672b9540e366afd8e772d33e67248442bc677684
SHA256

f3ae558a4ae6855f169c13eb2658cecf57ce25c444da779e1ea08f9282547d70
SHA512

456bd3f619a3b3eb37d4ab8ee8b96c638ca1b6c3064e361517fb40a081b3faee7feadb17e668535e06c80cce7578acf803739ca1b0f3ba03f3bf3fc9b411880d
SSDEEP

49152:nNLFvKPDFRY0fWVIUL0HkTDgkNemGTJt1XKcCCzZYY2:nZ0yIUL0HPPdKtCzY

Score

1^/10

Malware Config

Signatures

Files

ba6692e24d1f10_JC.exe
.exe windows x86

0e3a6fcd3bb9b26331412ccfb87deab5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:f5:74:30:25:e2:c2:20:2a:6b:bd:0a:f8:e5:70:fc
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/09/2011, 00:00

Not After

04/12/2013, 23:59

Subject

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b7:c2:f0:54:e4:42:dd:9d:29:75:11:be:d8:b3:3b:31:96:14:5d:a9
Signer

Actual PE Digest

b7:c2:f0:54:e4:42:dd:9d:29:75:11:be:d8:b3:3b:31:96:14:5d:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend

kernel32

LockResource
SizeofResource
Sleep
GetTickCount
GetModuleHandleW
OutputDebugStringW
LoadResource
FindResourceW
HeapFree
GetVersionExA
GetProcessHeap
SetEnvironmentVariableA
CompareStringW
GetTimeZoneInformation
WriteConsoleW
GetDriveTypeW
GetFullPathNameA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
UnhandledExceptionFilter
LCMapStringW
GetCPInfo
RaiseException
FindFirstFileExA
GetDriveTypeA
RtlUnwind
ExitThread
GetDiskFreeSpaceW
GetLastError
CreateFileW
GetCurrentProcessId
GetCurrentProcess
CloseHandle
InterlockedIncrement
LoadLibraryA
GetCurrentThreadId
CreateThread
WaitForSingleObject
FreeLibrary
InterlockedDecrement
OutputDebugStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
lstrcpynA
VirtualQuery
GetModuleFileNameA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
GetCurrentThread
SuspendThread
GetThreadContext
ResumeThread
IsBadWritePtr
GetLocalTime
WriteFile
GetVersion
GetExitCodeProcess
TerminateProcess
CreateDirectoryW
GetFileAttributesW
CreateProcessW
GetModuleFileNameW
FindFirstFileW
FindClose
GetComputerNameW
IsBadReadPtr
GetProcAddress
GetModuleHandleA
VirtualFree
VirtualAlloc
LoadLibraryW
Module32FirstW
Module32NextW
FormatMessageA
CreateFileA
ReadFile
GetFileSizeEx
GetFileSize
GetCompressedFileSizeW
GetFileAttributesExW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindNextFileW
FlushFileBuffers
GetShortPathNameW
GetDiskFreeSpaceExW
SetFilePointer
MoveFileW
RemoveDirectoryW
SetEndOfFile
GetVolumeInformationW
DeviceIoControl
GetFileInformationByHandle
SetFileTime
SetFileAttributesW
DeleteFileW
SetFilePointerEx
SetFileValidData
GetSystemInfo
HeapAlloc
GetProcessAffinityMask
SetThreadAffinityMask
WideCharToMultiByte
InterlockedCompareExchange
CreateEventW
SetEvent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GlobalMemoryStatus
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetVersionExW
OpenProcess
GetTempPathW
DisconnectNamedPipe
GetOverlappedResult
ReadFileEx
WriteFileEx
ConnectNamedPipe
MultiByteToWideChar
CreateNamedPipeW
WaitForSingleObjectEx
WaitNamedPipeW
SetNamedPipeHandleState
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
IsBadStringPtrA
Process32First
Process32Next
Module32First
Module32Next
GetUserDefaultLangID
LocalAlloc
LocalFree
SetLastError
lstrlenW
GlobalFree
FreeResource
FindResourceExW
LoadLibraryExW
GetComputerNameA
SleepEx
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
InterlockedExchange
EncodePointer
DecodePointer
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetFullPathNameW
HeapReAlloc

user32

GetSystemMetrics
MessageBoxW
AdjustWindowRectEx
CreateWindowExW
GetSysColorBrush
ShowWindow
GetSysColor
SetWindowLongW
SendMessageW
PeekMessageW
SystemParametersInfoW
GetWindowLongW
InvalidateRect
LoadIconW
RegisterClassExW
TranslateMessage
GetDC
BeginPaint
GetClientRect
GetShellWindow
GetWindowThreadProcessId
GetForegroundWindow
LoadCursorW
DrawTextW
PostMessageW
FillRect
PostQuitMessage
DestroyWindow
EndPaint
UpdateWindow
DefWindowProcW
DispatchMessageW
ReleaseDC
AllowSetForegroundWindow

gdi32

SelectObject
SetBkMode
SetBkColor
SetDCBrushColor
CreateFontIndirectW
DeleteDC
CreateCompatibleDC
CreateFontW
GetObjectW
SetTextAlign
GetStockObject
CreateSolidBrush
Rectangle
SetTextColor
CreateDIBSection
SetDCPenColor

shell32

SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW

comctl32

InitCommonControlsEx

winhttp

WinHttpGetProxyForUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser

ws2_32

select
__WSAFDIsSet
WSAGetLastError
WSASetLastError
recv
send
getsockname
ioctlsocket
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
closesocket
listen
bind
WSAStartup
WSACleanup
gethostname
connect
htons
setsockopt
getsockopt
getpeername
socket
ntohs

wininet

InternetSetCookieW
InternetCrackUrlA
InternetSetOptionA
InternetConnectA
HttpSendRequestA
InternetSetStatusCallbackA
InternetOpenA
InternetCloseHandle
InternetReadFileExA
HttpQueryInfoA
HttpOpenRequestA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

GetUserNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
DuplicateTokenEx
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
ConvertSecurityDescriptorToStringSecurityDescriptorW
SetEntriesInAclW
GetNamedSecurityInfoW
BuildTrusteeWithSidW
SetNamedSecurityInfoW
GetFileSecurityW
MapGenericMask
RegQueryValueExW
AllocateAndInitializeSid
RegOpenKeyExA
DuplicateToken
AccessCheck
RegQueryValueExA
RegCloseKey
RegDeleteValueA
OpenThreadToken
CloseServiceHandle

oleaut32

VariantClear

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 342KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e3a6fcd3bb9b26331412ccfb87deab5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

7d:f5:74:30:25:e2:c2:20:2a:6b:bd:0a:f8:e5:70:fcCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

b7:c2:f0:54:e4:42:dd:9d:29:75:11:be:d8:b3:3b:31:96:14:5d:a9Signer

Headers

DLL Characteristics

File Characteristics

Imports

msimg32

kernel32

user32

gdi32

shell32

comctl32

winhttp

ws2_32

wininet

version

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 287KB - Virtual size: 287KB

.data Size: 124KB - Virtual size: 184KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 342KB - Virtual size: 342KB

.reloc Size: 76KB - Virtual size: 75KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

7d:f5:74:30:25:e2:c2:20:2a:6b:bd:0a:f8:e5:70:fc
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

b7:c2:f0:54:e4:42:dd:9d:29:75:11:be:d8:b3:3b:31:96:14:5d:a9
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 287KB - Virtual size: 287KB

.data
Size: 124KB - Virtual size: 184KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 342KB - Virtual size: 342KB

.reloc
Size: 76KB - Virtual size: 75KB