Static task
static1
Behavioral task
behavioral1
Sample
ab6563964db8fe3966de4a215_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ab6563964db8fe3966de4a215_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
ab6563964db8fe3966de4a215_JC.exe
-
Size
2.3MB
-
MD5
69d19779b8da64ab2d877e9156ac1189
-
SHA1
e7ceb475978c9592dfe62737d56d0c8562744c6d
-
SHA256
ab6563964db8fe3966de4a215307a7aed3e5e242ba28d5f2f418f7723208f3a1
-
SHA512
b6031036c2b96eeb5fb719e4ecd26cde768385c2ed57579756db570ab42be62b05f620071e35ae0ae27d0a3295e1c553031055725e4a0b316ff0de925b8d75d3
-
SSDEEP
6144:hHlD0VNBrHdhsGE8C00iW5b2+DWW4eg3++OJPdums4:hHlD0VNBrHC1s+CnegN6Pdt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ab6563964db8fe3966de4a215_JC.exe
Files
-
ab6563964db8fe3966de4a215_JC.exe.exe windows x86
7171dd3cc2e067362ea92a90a83c63fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetWindowRgn
DdeReconnect
SetWindowDisplayAffinity
ole32
OleSave
ReleaseStgMedium
gdi32
RestoreDC
CreateBitmapIndirect
AngleArc
ws2_32
WSAStartup
kernel32
HeapSize
CreateFileW
WriteConsoleW
HeapReAlloc
SetEvent
GetConsoleMode
GetConsoleOutputCP
VirtualProtect
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CloseHandle
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
DecodePointer
ResetEvent
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
FlushFileBuffers
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.teext Size: 174KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.But... Size: 684KB - Virtual size: 683KB
IMAGE_SCN_MEM_READ
.But... Size: 684KB - Virtual size: 683KB
IMAGE_SCN_MEM_READ
.But... Size: 684KB - Virtual size: 683KB
IMAGE_SCN_MEM_READ