3be33385d62b7ee8c02fc33a0d438423b22b6239e125ba77558265c0fbb48b7a_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3be33385d62b7ee8c02fc33a0d438423b22b6239e125ba77558265c0fbb48b7a_JC.exe
Size 2.9MB
Sample230815-swclmsbd72
SHA256 3be33385d62b7ee8c02fc33a0d438423b22b6239e125ba77558265c0fbb48b7a
MD5 bb3c21d34a30f9e8c0995e552766cf9d
SHA1 7cf37c7049163739daefeacf9eaaeb6eb648448e
SHA512 e1eadb04b07a8428c490359203a72efc8e331c6f1a4de5917eb6b01c1fb02d61a6b303a33a5f30446d15d95c174d78e2cdb8e3ec0a370e0434cef970ee1cff3d
SSDEEP 49152:xNij54p8VHevy+nOjfDL0mdF/iVC/8UHFaWfFbStYCuA:C/z7D/HT5mH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3be33385d62b7ee8c02fc33a0d438423b22b6239e125ba77558265c0fbb48b7a_JC.exe

File Explorer

3be33385d62b7ee8c02fc33a0d438423b22b6239e125ba77558265c0fbb48b7a_JC.exe

.exe 2.9MB

3be33385d62b7ee8c02fc33a0d438423b22b6239e125ba77558265c0fbb48b7a_JC.exe

IMPHASH 9822cfebd7c974bd9454a866d6256f96
SHA256 3be33385d62b7ee8c02fc33a0d438423b22b6239e125ba77558265c0fbb48b7a
MD5 bb3c21d34a30f9e8c0995e552766cf9d
SHA1 7cf37c7049163739daefeacf9eaaeb6eb648448e
SHA512 e1eadb04b07a8428c490359203a72efc8e331c6f1a4de5917eb6b01c1fb02d61a6b303a33a5f30446d15d95c174d78e2cdb8e3ec0a370e0434cef970ee1cff3d
SSDEEP 49152:xNij54p8VHevy+nOjfDL0mdF/iVC/8UHFaWfFbStYCuA:C/z7D/HT5mH
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

431380

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges EnumerateTraceGuidsEx EventSetInformation EventUnregister EventActivityIdControl RegCloseKey EventRegister EventWriteTransfer RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW EventWrite EventEnabled

ncrypt

BCryptSetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptImportKey BCryptDecrypt BCryptEncrypt

kernel32

RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlPcToFileHeader SetLastError FormatMessageW GetLastError GetCPInfoExW GetConsoleMode GetFileType ReadFile ReadConsoleW WriteFile WriteConsoleW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WideCharToMultiByte CreateProcessW VirtualAllocEx CloseHandle GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses GetProcessId DuplicateHandle GetCurrentProcess GetCurrentProcessId TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcessorNumber GetCurrentThread Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetFullPathNameW GetLongPathNameW LocalAlloc GetProcAddress RaiseFailFastException LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetSystemDirectoryW LoadLibraryExW SetThreadErrorMode GetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation SetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead InitializeCriticalSectionAndSpinCount

ole32

CoUninitialize CoInitializeEx CoWaitForMultipleHandles CoGetApartmentType

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode calloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr cos modf tan sin pow floor ceil

api-ms-win-crt-string-l1-1-0

wcsncmp strncpy_s strcpy_s strcmp _stricmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc _initterm_e terminate _crt_atexit _register_onexit_function _initialize_onexit_table exit _initterm _get_initial_wide_environment abort __p___wargv _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe _set_app_type _initialize_wide_environment _configure_wide_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __p__commode __stdio_common_vfprintf __stdio_common_vsscanf _set_fmode __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

457KB

Virtual Size

456KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1014KB

Virtual Size

1013KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

126KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ