Static task
static1
Behavioral task
behavioral1
Sample
cd408dd464e385_JC.exe
Resource
win7-20230712-en
General
-
Target
cd408dd464e385_JC.exe
-
Size
2.0MB
-
MD5
cd408dd464e385703c6a11e7f89d5801
-
SHA1
9bbe2e646d979105b9a5358d96e2e72e2e1624c0
-
SHA256
b9e60d6e2d794cd4ebad8f1506ba25af2130e7470d2860eb73d7def435f7cafb
-
SHA512
4aa2e31a9d4a9231be106cfe73227977d965dd68335840f7dac1e00db1de8195ad5e3e936ba24a1c68de5c4c8eadc9dd2b1f5af3e3b5afe592fd123997f679a7
-
SSDEEP
49152:nSHEryCQk+36OFEVX3huo8CwoLs5swDKxrz3CgTS:nSHMIlFCr0as5sfz3w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd408dd464e385_JC.exe
Files
-
cd408dd464e385_JC.exe.exe windows x86
37cbad3d2ea6c619dd5723b0a0c0ca20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCPInfo
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
SetEvent
GetLocalTime
WritePrivateProfileStringW
GetPrivateProfileStringW
InitializeCriticalSectionAndSpinCount
SetLastError
GetCurrentThreadId
RaiseException
GetVersionExW
Module32NextW
Module32FirstW
lstrcmpiW
GetCurrentProcess
LocalFree
LocalAlloc
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
ReadFile
GetFileSize
UnlockFile
LockFile
CreateDirectoryW
SearchPathW
FindFirstChangeNotificationW
FindCloseChangeNotification
SetEndOfFile
WriteConsoleW
SetFilePointerEx
ReadConsoleW
SetStdHandle
CompareFileTime
GetFileInformationByHandle
FormatMessageW
SwitchToThread
CopyFileW
SetCurrentDirectoryW
GetTempPathW
LoadLibraryExW
Sleep
HeapDestroy
InterlockedDecrement
InterlockedIncrement
DecodePointer
GetShortPathNameW
GetModuleHandleW
SetFileTime
GetTempFileNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentProcessId
OpenProcess
GetLongPathNameW
GetLastError
GetFileAttributesExW
CreateFileW
CreateFileMappingW
UnmapViewOfFile
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
DeviceIoControl
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetCurrentThread
GetACP
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
InterlockedFlushSList
RtlUnwind
lstrcmpiA
MapViewOfFile
CloseHandle
SetFilePointer
lstrcmpA
GetSystemWindowsDirectoryW
FreeResource
QueryPerformanceCounter
WaitForSingleObjectEx
ResetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalFree
GlobalUnlock
CreateEventW
GetCurrentDirectoryW
GlobalLock
GlobalAlloc
FlushFileBuffers
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
WaitForSingleObject
TlsSetValue
TlsGetValue
WaitForMultipleObjects
TerminateProcess
GetExitCodeProcess
FindClose
GetTickCount
lstrlenW
RemoveDirectoryW
GetFullPathNameW
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
FindNextFileW
MoveFileExW
GetWindowsDirectoryW
MoveFileW
WriteFile
GetLogicalDriveStringsW
GetDriveTypeW
GetSystemDirectoryW
GetDiskFreeSpaceExW
GetFileSizeEx
OutputDebugStringA
OutputDebugStringW
CreateProcessW
GetStartupInfoW
GetTempPathA
GetTempFileNameA
CreateFileA
DeleteFileA
InterlockedExchange
InterlockedCompareExchange
TlsAlloc
user32
CreateWindowExW
CallWindowProcW
SendMessageW
GetWindowThreadProcessId
FindWindowExW
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
DestroyWindow
MessageBoxW
KillTimer
PeekMessageW
DispatchMessageW
GetShellWindow
RegisterWindowMessageW
SendMessageTimeoutW
SendNotifyMessageW
FindWindowW
CopyRect
UnionRect
EqualRect
PtInRect
DrawFocusRect
DestroyCursor
SetCursor
MoveWindow
UnregisterClassA
TranslateMessage
GetMessageW
DefWindowProcW
OffsetRect
GetActiveWindow
EndDialog
DialogBoxParamW
GetMonitorInfoW
MonitorFromWindow
GetWindow
MapWindowPoints
SetForegroundWindow
IsIconic
IsWindowVisible
PostQuitMessage
FillRect
GetWindowTextLengthW
GetWindowTextW
IsWindow
DrawTextW
GetFocus
SetFocus
LoadCursorW
SetWindowPos
ShowWindow
GetClassInfoExW
RegisterClassExW
UnregisterClassW
GetParent
SetWindowLongW
GetWindowLongW
ScreenToClient
GetWindowRect
GetClientRect
InvalidateRect
SetTimer
wsprintfW
IsDialogMessageW
PostMessageW
GetAsyncKeyState
CharNextW
SetWindowTextW
UpdateLayeredWindow
gdi32
SetBkMode
SetViewportOrgEx
SetTextColor
SelectObject
GetStockObject
GetObjectW
CreateDIBSection
SelectClipRgn
SaveDC
RestoreDC
DeleteObject
DeleteDC
CreateRectRgnIndirect
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
RectVisible
OffsetViewportOrgEx
CreateFontW
EnumFontFamiliesW
advapi32
OpenSCManagerW
RegOpenKeyExA
RegEnumKeyExA
GetTokenInformation
CryptContextAddRef
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
DuplicateTokenEx
LookupPrivilegeValueW
GetLengthSid
CreateWellKnownSid
AdjustTokenPrivileges
SetTokenInformation
OpenProcessToken
RegEnumValueW
RegQueryValueExW
CloseServiceHandle
ControlService
DeleteService
CryptDestroyKey
OpenServiceW
QueryServiceStatus
GetUserNameW
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
LockServiceDatabase
QueryServiceConfigW
QueryServiceConfig2W
QueryServiceLockStatusW
StartServiceW
UnlockServiceDatabase
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExA
shell32
SHFileOperationW
ShellExecuteW
CommandLineToArgvW
ord165
SHCreateDirectoryExW
SHGetFolderPathW
SHChangeNotify
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
OleRun
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid
CreateStreamOnHGlobal
CoInitializeEx
CoSetProxyBlanket
oleaut32
SysFreeString
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantClear
VarUI4FromStr
SysStringLen
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
VariantInit
VariantCopy
shlwapi
StrCmpNIW
StrCmpIW
StrTrimA
StrStrIW
StrToIntExW
SHGetValueA
PathIsPrefixW
PathRenameExtensionA
PathFindFileNameA
SHDeleteKeyW
wnsprintfW
AssocQueryStringW
SHSetValueA
PathIsRootW
PathIsRelativeW
PathFindExtensionW
SHDeleteValueW
PathCombineW
SHSetValueW
PathFileExistsW
SHGetValueW
PathRemoveFileSpecW
PathAppendW
PathFindFileNameW
StrStrIA
comctl32
InitCommonControlsEx
_TrackMouseEvent
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawImagePointRectI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
psapi
EnumProcesses
GetModuleFileNameExW
iphlpapi
GetAdaptersInfo
wininet
InternetGetConnectedState
urlmon
URLDownloadToCacheFileW
URLDownloadToFileW
secur32
GetUserNameExW
setupapi
SetupIterateCabinetW
crypt32
CertGetNameStringW
CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 23KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 677KB - Virtual size: 676KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 117KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE