djoin[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

djoin.exe
Size

72KB
MD5

576896524dd1552f84afc9a2cdf57ea1
SHA1

20d8fb1fd3a09ad9ca810a0e37c5286dab83f49b
SHA256

a7b6ac2649e6398cec55a349929fe1de8da137b9f77ecd7d9036f4bacb29bb59
SHA512

a620669fb886fb2f5d4154f23e4a076ed70247b7da3f230b4e40707a227a4537d729a57e892d6155b642396b74f7e3aa42ef110c546c45cf492eb8093d6b6a5f
SSDEEP

768:wTEh5BWZ33NBsU9fFiLe/DmUJJMT9NUnPW1vLpppWIj8FT82zpp0vh9rrb0vQYaU:4kk3NR9xtoMW1vVpbGTpW7rXd3EQJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
djoin.exe

Files

djoin.exe
.exe windows x64

67ed2180b06686fecaa36dbfd2d9c7a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__iob_func
wcsrchr
memcpy
_onexit
wprintf
_unlock
_lock
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
malloc
free
printf
wcschr
wcscpy_s
_vsnprintf
_wtoi
_wcsicmp
_wcsnicmp
setlocale
?terminate@@YAXXZ
_vsnwprintf
fwprintf
swprintf_s
__CxxFrameHandler3
__dllonexit
memset

netprovfw

NetRequestProvisioningPackageInstall
NetCreateProvisioningPackage
NetpRequestProvisioningPackageInstallForIMC
NetpAnalyzeProvisioningPackage
NetpProvDomainJoinLicensingCheck

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages
FormatMessageW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetModuleFileNameW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetFileAttributesW
ReadFile
GetFullPathNameW
DeleteFileW
GetFileSize
WriteFile
CreateFileW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegUnLoadKeyW
RegSetValueExW
RegCreateKeyExW
RegLoadKeyW
RegSaveKeyExW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
StartServiceW
CloseServiceHandle

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

netutils

NetApiBufferFree
NetApiBufferAllocate

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

logoncli

DsGetDcNameW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetVersionExW
GetWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime

wkscli

NetUseDel
NetJoinDomain
NetUseAdd

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapSetInformation

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-eventing-legacy-l1-1-0

EnableTrace

ntdll

DbgPrint
RtlGetNtProductType
NtClose
RtlNtStatusToDosError
NtSetInformationThread
NtDuplicateToken
NtOpenProcessToken
RtlAllocateHeap
RtlFreeHeap
NtAdjustPrivilegesToken

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
SetEvent
EnterCriticalSection
OpenEventW
WaitForSingleObject
CreateEventW
DeleteCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags
TraceEvent
GetTraceLoggerHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67ed2180b06686fecaa36dbfd2d9c7a6

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

netprovfw

api-ms-win-core-localization-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-eventing-controller-l1-1-0

rpcrt4

netutils

api-ms-win-core-heap-l2-1-0

logoncli

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

wkscli

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-eventing-legacy-l1-1-0

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 1KB - Virtual size: 35KB

.pdata Size: 1024B - Virtual size: 1008B

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 512B - Virtual size: 188B

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 1KB - Virtual size: 35KB

.pdata
Size: 1024B - Virtual size: 1008B

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 512B - Virtual size: 188B