~�5��=�.���C�p�n���^wp��g�U�_��a��AI$#$�M��n��K�q�.G�bݤY(�|1��"K�۸�"� ��^���(rDu<k@�R���P��T;��8��9�} �d"�c����!�F'S2}y�WpOo��I~oN�ƗֈP��u���k����D�L ���c6�ȃ����(S�8��'R*��q<�I� ־��?^��I�0�����?��)6|(��3Rv������L�<��t�SaM����/a<Lf��s���/\-�d� 1}�B�o�=�kP���e��B��� ��?��\�;����m1�G��y��8F��ۨiF�����L)F����o��7C��G��n�&R���S�+���ͺ��C�C@(LfO�o��RՒ�� 2��T��Nl��P��i:Y]?:}Y�"����$���U"$�̷I��c��@�9O���xI��-�ى����9Q���K�&gv���[�8o���d~��KTv��[Yv��&�����L�7��fH���p�N�@�L�� eK7�k'��oN�� >������3���>��~�iq}j2U$xv�6�Rh��25��a��"d#�I-��z��w'��)�J�+1'ƁFن�]H;4�D?m�9{�t�=%F�qu���3@^ Xq�$�)��{�wu.f��$L�S�x%5� ��6϶c�퀼�I�GQ ������ ���B��[����$d���W��t|�h!�<��ܮ�cv�)4�C�qb:�~i�}����å�q�J���/���i >p�N¶x�l��a�wuL�٬v�e��t��NZ_��hB�B����({�8��0�GqDŽ�Z-��F(UwR-o�sՈ�jn�$Mc���e�P9�ط~x;�UӔW��&9�� ٚ�N��i╎$ߢmm�q�@hR���PkԎ��<�.�����Պ� ��P����Y��R�D��ʚ��\smYQ������QС4�$�>_$�p+�W�,�j���ë`Ya,l��Rv��r{�_�Ļ�-�Us�Yy��u�o�t��?�.JE��|o��G�lSڃA�(��91{��fM��K6uu���J~r�{<:Y�/h��׆����_t���3��^�zW⻈I�?�.�� ��CKP��S^��~�O �L�*���5{�Β���y�"{3B�Ѳ��$q� �bp�^'HU���"p��0G�r�Oy��ԷBf��ͳ�:ۣP]���1�s��V��'�k읯�`8A,�33�R|m"���oa�̣�l�����w���ս[�qlɹ(,r��"�D��Y��5m�g�������v���`����É9��'�x��HS�鷟k#T�1E�p=�"R�c�i�%�V��ȅ<��%���M�!$��z�%�t��o��N�)Dl��PA�z�{��p��N�d�ţ�I�E��IPs����(�;!�&9��2��<�����Ӿ�EA, ��[�*~m��������߃Te5 �ҮU�l�!g��n�I��K��"@���(��1- �|j��9e�1����4_/<V��p�;�'��Z%�Fpx���K��B��eFU���f�C�<A� � �v=�>F��b �GbJ\MG���/�������^{{,���Rq��*&���<"R��B��C��`���_�(sd$��R��-rz�|r�w��h|(��z�/C����Q�U�hDs�̙W���ǂ����S�H{��~h�<O#�H/;\���]��&t��� usY�X�� �����N���E�o�"�U5�E��4����Q�Ġ ��[ə�E�P��so��ҶC�کHgᤪ�p�ܖ�4�� �b��w����a��B?"�FK�� �l���3;S&8��O��&,R�u.������B��S�>-����j1Y�^(2VȨ���vk��>��P�,_�x����>T�����y��@���{�O����=S��ӗs�ߴ�����@�N`K���ąj���[���.r2i8�l"���������x�kr�ۛGx[#F��Qb�Y(��T���X�������>l o�x�\?�F���s�z=�o]� �az[���CA��yH�>8L�%�"rW�������ޗpUr~�����ގc���6$[V*by��ң��9����7�����l$������T��.�H�M�vn:�;�b�)I���X���$�2���Nzf������X�c(�c������0�u��a�T7���] ���Oխ]z(�@u���3�S�0�C��A���y�hT�� ��rF)<������pղ���b}���Ԋ��D�1v�֎)bܙS�|��I}g�a����JKuji]5 �~�Hi��q6c�j' 3!(���#�T�]�0�mF��/a�_D�@Y۞PK#u���o���Ӧ�㴴�c�n��v�-�T��&�K���@�i�Γt�}2jyi��y������M�e��7�<��;��[�9Q�X��X h!�Ծ�ti�^�����H����vC)����������-�R��d]���e9%����C嶓�(�ҳ��"E�ƭ �'�iR��p%�V�#�xw��oɦ�"��oY�<�J\�iw�?^�!�O ^i��==�;������D��s��o�:������h�B�ί��������?���~ӃB��x��Z@���~{�)%���O��u��-��7� ���I�(Ns�[�[�\j���<#UqLƞ��H�JQr\(�S���Q�S~WA`JWS��.����%�>�p����h��iz?�O��"F�0���y]���� �Vd��<����Y�S$Eu�U4�O�L=�����z��c�V-Ӽ 9��%�ˈ\���g�͚$�2��[���2R+İ�5pT�|��4�l0�GYRH�űxn_nN�x�fz������ �������>����It��Wã=�D./e �_6���h.8�ƨc��v��|���U���a����"�Vj��V%�&̹�V E�u�/�'��1w� �"�� B��[�� ��s�gB/�w٨���U�5"8'�9+�|�Rcy��ݳ�;���\�ƨ�
Static task
static1
Behavioral task
behavioral1
Sample
JTHXRT.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
JTHXRT.exe
Resource
win10v2004-20230703-en
General
-
Target
JTHXRT.exe
-
Size
1.9MB
-
MD5
50bc958e3e550d2fbd1192111e1cacb6
-
SHA1
f9f628b83aa5fe955a32bc761b5b437d6c6469ea
-
SHA256
4264abd798360bf2a4a339466f61a51e5fa94e91c8810de6286f779cf05b03e7
-
SHA512
d67f1c2854303097756e5b76d6ea0d45a6d03983fc8dbf5acf84440bde87eae9a252d8738332d929fe3c451f42277a44b1f43ca0025065dafd6a4f3c45cbe97e
-
SSDEEP
49152:rmO7L8W0ZHgH8X0nmaY78oQdBIpDKqZl1bA:rmM4IzzDnWj7b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JTHXRT.exe
Files
-
JTHXRT.exe.exe windows x64
5473795b9151fa3d92f1be3635f91414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryFullProcessImageNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MoveWindow
advapi32
RegDeleteTreeA
shell32
ShellExecuteA
ole32
CoUninitialize
d2d1
ord1
dwrite
DWriteCreateFactory
ws2_32
getaddrinfo
psapi
GetProcessImageFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 307KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.N4O0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.N4O1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ