0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcfdll_JC[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcfdll_JC.dll
Size

339KB
MD5

ff02fe5d16d3abcbef7b17ee384e734f
SHA1

7796e4d639823bb80fe94af55abc037c8c06c35c
SHA256

0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcf
SHA512

1bfc68a18ba0fa1f4b94891fb280c36480471b43fb6e3d1e715e378a71b3d0482dba5530577ee87e35ef90ffec21935d22383acc010f439bcc0ff6d8bfd2d087
SSDEEP

6144:yFkcequUUnJqlXp8qm6SUbWNGhw2/K6786TEnCAIpi9MxipEl7BuHBTpOdNPIGA3:wkXG58L6foMbGB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcfdll_JC.dll

Files

0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcfdll_JC.dll
.dll regsvr32 windows x86

ad05ad9e56e1f7f5ae7c2986a290aa6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comdlg32

GetOpenFileNameA
GetSaveFileNameA

gdi32

GetStockObject

kernel32

AddAtomA
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetFileSize
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GlobalAlloc
GlobalFree
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
LeaveCriticalSection
QueryPerformanceCounter
ReadFile
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteFile

msvcrt

__dllonexit
_amsg_exit
_beginthreadex
_endthreadex
_ftime
_initterm
_iob
_lock
_onexit
_setjmp3
_unlock
_write
abort
calloc
exit
fprintf
fputc
fputs
free
fwrite
longjmp
malloc
memcmp
memcpy
memmove
printf
realloc
sprintf
strcmp
strlen
strncmp
vfprintf

ntdll

LdrAccessResource
LdrFindResource_U
NtAllocateVirtualMemory
NtQueueApcThread
NtTestAlert
ZwOpenSymbolicLinkObject
memset

user32

CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
GetDlgItem
GetMessageA
GetWindowTextA
GetWindowTextLengthA
LoadCursorA
LoadIconA
MessageBoxA
MoveWindow
PostMessageA
PostQuitMessage
RegisterClassExA
SendDlgItemMessageA
SendMessageA
SetFocus
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow

Exports

Exports

ABmFwMTwvVZtqyxRIoZJQ
AZdwRYDwfnoKlIzDJSLRuV
AfrfbEFJNrXF
AtHvCRpn
BLOoNUEZnZUBWclxQXGNwFK
BfmxAxHbniloNagAvgtz
BoScIBDoksZewImRTFQYRB
CQjqJZELmgRapadNajjR
CXbAfCrVwIKwf
CesYGjrGWCMVXqGZMxjympu
CtzxDvFWSIeVnmwPuEte
DIdEORjbNwkGWfuHP
DWEYlTQHmCMNxyXtu
DXlfkIIBAgfXwFIRvwMnFDpaU
DllRegisterServer
EInUBEdNxtzxal
EOJQguvjBcMKUrozbDXfJl
ETaUuZOMQwVNyWRunHtdVe
EgXRCkdqxZgugAVoeksrri
EkLeZsohhvmAxxfPIL
FAMviVXpACQhqVJWcinsDPYj
FAUSJthcMMQFWbUYafRjJkSpfv
FNEsWZrobQTv
FSeEVjTOofwAenFxhKOksvfoy
FcbLgNxrIuI
FqBiZNgueUuPWZSb
FubJXXL
FzdWNCrBobjNPsYJNbqEcAUMK
GHyYoUpPGFNDXtE
GZKQxnfRT
GnEXVZkGLuSjKGNxhqIll
HDsRDwAzhKZglUKzuJCThCzr
HKsheHnHwocZsyIBDiorp
HRgleWLYSbLQWbql
HSnRUKEQYu
HahnFjxmPXBfdqJUB
HajoeknSrIGDCFMG
HdJBhXTRy
IQpBEXMNNEnwYkJkUznbzly
JBjnPGgnIQLQZ
JTBPsXQ
JpMhtF
KUeAcmwGhiehYWykSut
KdFvaRXhrCEGWJVz
KeMIHOEAnpARvwvzbyXk
KtAetjZRKd
LNcDfe
LaXknCAERCRoUpnsOjXvnYhiD
LgdIdgIygzJdtIS
LgjUJAoUhnPLiXtKDtPiH
LsauanrKZODd
LtImdXABRjoLpZtst
LvnmazFOUrjXxYPKrb
MICnvFBBqWIPEmFlFg
MSutEJTTDOkySKhTvQMygXh
MfldyyShKbohpcnAEj
MhazCs
MooEzrEC
NCBDljNzdQVQwvYEVnGDaxx
NfpHaAHLVuMnIrS
NhmIwgregvjEbKmyrJUE
NkfyBCRZWq
NxazSJAHHelSPPbf
OIwYyjEVwphTLvVbHY
OgPfsxsd
OmjrNIGrrVhdIH
OynmseOMiFANnddFQaspfl
PCkzpNiQTEyJz
PIRXvqGUAapkUqYOrYiXQ
PIgLCgByIA
PdQXlMBovfssfITxGDbmvgC
PpKLwdflSOnxuHHMf
QEYhKBdLoCbaKvPcyswqhRnnYc
QYOTSmLbXgU
QdrRaFrytsljXNhoRQqO
QecPhyQuzU
QfKaXZIYfhbiFzKTTe
QlFjqqDQDDEDYbkodTzYw
RIIHcnmkufs
RTmKPDCDIdjOyMtxCsR
RbpUtPOtTIhFMuzqsb
RcmktICtGg
RdWDHjQypjrIhnWZiWZLbQR
RpDiXaGwYrXOSeJn
RraSBprfq
RtKNlBlpzkKfyAdEBlyQI
RwJnPHTTgabRTWFtzrcCejMNne
SHIOHdyq
SJflIqqBbBbiewIjLSOpQWIB
SMohhT
SbYATaQAoLr
ShFOHNLjTMzMOFTcdqsidRPd
TZUnfXpMOJqEHbUoWxJLLzKQiV
TfwvvU
ThTDOXfL
TkrJVryepLYfAFxpUmjbyvg
TndeoKWkOhqbVbDYqEnJYTNrn
ToCRCNqqyjzCNdMNChWtyZuZUi
TorpvFAjD
TwVnnGVjKELurLZ
VCaWYQhDtJlzupgreitxcMcC
VGKrFb
VHWnUrayHPhSc
VcMmrwTiJJZvS
VfLXUgCJvEEG
VhiTswksSwE
VmrKbtBJMUWWow
VsKjhViDnDRXkgfAhhSrsRD
VylxBGOSlWkEJbIFeeD
WwUAouiLjQQ
WzHnpWLUZxvuJgmfZzQ
XJBYXvIJqmkpUc
XJMVgEyatS
XNPeNXJb
XOoGgibKUun
XPCZzUPuGSwexfMpGJBKYim
XRlwLHXgMaiUXANPRLrnIKOhgN
XUPzlJNhffnKVzkCQF
XcBjZRyqmQprjPbpFWhsj
XqlOHwR
YFCHEeVjjkzWynTtvKMiSxYom
YGQbFIB
YSiMaRZcwAFhf
YbEBLoxzquqmfIiwZiaBFtb
ZEUDDYYtxqDJZNXnTuidSkq
ZGYagmU
ZJfBjCFnDZIJY
ZoroZmuogasmUlYvsu
ZttldSTDgNsmhZweXEFYVVjz
ZyZZoDoiIiexPdzuaMVrDjsE
aMRfKa
aMraqnucOyBCVBISHvwzhY
aRZNjtukxpYhiVdU
aZcebqxyLS
afRsqdfInzGz
akvtdejtVQgzn
avYSkSAzqhBWTwGUHN
bChCpkjqKyDDvqQswRU
bDbcrwyhqyzsCdGyQRqUUhAO
bGVxRBTQROAFUvgmPA
bNIRRqRiOoommm
bgiyMiIerAJXWHKC
bpqDmKDoAmyyZt
cGGYzLMyODZPQZVO
dINxIGOTEjquvRdRYvwVYdkF
dcAukEDumhx
ddbuRErGoshl
djhExCofCt
dnUwhFqlaWHbUulVMfYxC
dvRDfYjIwJl
eFnwuaNnhkBHifcfjTpRNCfp
eLzDkspMoNgzSBQfBIO
eUAFhqZnOB
eVVsbcpkprjqAsNwONdCMJa
eZJnPeSIwu
emnLCyJzXRh
eujSJNATnId
fLEsTBmomypRgw
fRsAvJlcYgtkenKMAVxuuA
fUMqPXqfYDAso
fbiVmRxkQajJ
fgZkImVMnzTsJaRf
ftRIBlwCh
gEpapqEgEXeSrJBBBQKolf
gwcNhoHlWPq
hBmHxPdnPaqmidiXIZkUQ
hCmJuJxyHAGwKiVA
hDJmfseUD
hHgelHCVq
hIwsOrWsFgNZeUhQoyhH
hMuxoxUYbwcolSiNHek
hNtXZPuwhuwoSaebMWPnkuLP
hSIeWkQf
hoQDDahj
hskGWSdRoPGUPKQZLHhBgx
iQIKdFQxrx
irDphktu
jIUmIauHCrh
jKYhlLsKbJxmStuChtBCkdmIB
jaBgCeCcj
jalGYZBMLViY
jgMRnPUpWlcwQDzdBTWwZqsQ
jpBNQhvYOXccSUA
kezyBgGiBJMFPWygWDdPuERUfR
kfnvpKnyY
krTapjZoOpwZgUe
kvDVmPG
kvzQoIFCpZZubbZDJn
lAaCDoLAW
lBbxkvUIBzGp
lFQkYqRdnvjbBgtmNFnDwUDWL
lHPcOoshpFuPCzAQN
lMkekbJyrEJI
lVwhwYUxxwyrtoOvoTD
lwFXdPmtxkHxSW
mcwVSYv
mkjdBaeiNEbKLwGsImFJ
nLuPCZkJIEZNvkvMQCG
nTneppkiTcAauJndJdpah
nUDvOTgklYOxkxZeCI
nVzUjhVitqvRv
nYDiNcvkSWFiaiESlMyjL
oVkIXoAFaq
oXnxolEqhrv
oaTfRcqCSIacHoYoWWwBDbRc
oaYzYasAmApQWuHUUG
ocMXkENXreFZJFnWKhhS
ogRefzBasOHb
otrChJscRyDtAG
pAvbquHuoycvmQCtPMFxMHO
pTUmomuoEGYta
pYMsNsSlwvGRfFbSvnddq
pYOUPEbBmpaCrR
pnpXgn
qwpYlw
rHEPKFFEbJekKKSjmYpLFCANeX
raniFUZxBNOXcFHyzavGc
rfmSbT
rkdfMIKbPPrhYacAFkE
szRWFCYGuDIDCbDVBpbI
tMLslaQtNsTPtxWUcHANLqG
tMPrgPO
tlcOmB
tujhTIsXxmj
uBQYrQpAoSBfIt
uJCAiJTZdGLUnVpo
uaAzFvkXlCXs
uflUgfFFwTyLTASXywo
utlUCkinuLnfK
vJbvjGfROVPSB
vTMKDSLqWmlZlBVb
vUZjvPlTYpoxSXGQdkBFiQUWL
wARSfxYOcEjujvqIhGU
wAXXvCJvJekKjK
wFyTPgX
wLggyDyeiQAnMrYtmUnSnuiYcy
wSAanCAcMqPB
whiRZoTnDoeNzXKSUAf
wiVZEPlbcZv
wskMUspfabEtAJTxqb
xAiNfWbEHUGQKPDalYoIpqjc
xwMYGXqkJwKITnDkH
yBepvqHWQRXgfa
yDLjKC
yDiVdqaEUW
yYBsxZvNRtCyodskWSoAJM
yeWfnkrwYhzz
zHsGIIXgFFjznWokeeYeK
zLmXuOOpSGRdoMJMtYEfmyk
zQIZgyLDCBIWo
zxKaeibzkoShLad

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 512B - Virtual size: 314B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad05ad9e56e1f7f5ae7c2986a290aa6c

Headers

File Characteristics

Imports

comdlg32

gdi32

kernel32

msvcrt

ntdll

user32

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

.data Size: 19KB - Virtual size: 18KB

.rdata Size: 10KB - Virtual size: 9KB

.bss Size: - Virtual size: 1KB

.edata Size: 7KB - Virtual size: 6KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 48B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 5KB - Virtual size: 5KB

/4 Size: 1024B - Virtual size: 568B

/19 Size: 42KB - Virtual size: 41KB

/31 Size: 6KB - Virtual size: 6KB

/45 Size: 6KB - Virtual size: 6KB

/57 Size: 3KB - Virtual size: 2KB

/70 Size: 512B - Virtual size: 314B

/81 Size: 6KB - Virtual size: 6KB

/92 Size: 1KB - Virtual size: 1KB

.text
Size: 88KB - Virtual size: 87KB

.data
Size: 19KB - Virtual size: 18KB

.rdata
Size: 10KB - Virtual size: 9KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 7KB - Virtual size: 6KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 5KB - Virtual size: 5KB

/4
Size: 1024B - Virtual size: 568B

/19
Size: 42KB - Virtual size: 41KB

/31
Size: 6KB - Virtual size: 6KB

/45
Size: 6KB - Virtual size: 6KB

/57
Size: 3KB - Virtual size: 2KB

/70
Size: 512B - Virtual size: 314B

/81
Size: 6KB - Virtual size: 6KB

/92
Size: 1KB - Virtual size: 1KB