Static task
static1
Behavioral task
behavioral1
Sample
c366c4e26ec3d2698a94dc04afb58dad429d6c28dff1820d53e277e108103f8f_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
c366c4e26ec3d2698a94dc04afb58dad429d6c28dff1820d53e277e108103f8f_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
c366c4e26ec3d2698a94dc04afb58dad429d6c28dff1820d53e277e108103f8f_JC.exe
-
Size
23KB
-
MD5
320dd151aed6a181d84e63f78cf801f0
-
SHA1
573e93bb5075ec74ec3c45eaf4190af8e315a429
-
SHA256
c366c4e26ec3d2698a94dc04afb58dad429d6c28dff1820d53e277e108103f8f
-
SHA512
f6c91820dd178456456e801114b9f03e082c6aa228b988d4d704451715c7e8d0b61f5bfb20747d1e5cf480a422a4ad16ed6e93b6ffb1a6b3d4bf9ce9b4e44e34
-
SSDEEP
384:0/UTIj4uy4m+JJK1Eh/l4WphFkBUgFOnNakRatr6OlEDpuUP:hh4mJeP+Uor6QE9B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c366c4e26ec3d2698a94dc04afb58dad429d6c28dff1820d53e277e108103f8f_JC.exe
Files
-
c366c4e26ec3d2698a94dc04afb58dad429d6c28dff1820d53e277e108103f8f_JC.exe.exe windows x86
448c7468121abeee4a827989f0f63dec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetComputerNameA
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
WaitForSingleObject
CreateProcessA
CloseHandle
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
ws2_32
WSAGetLastError
socket
__WSAFDIsSet
gethostbyname
ioctlsocket
connect
inet_addr
select
htons
recv
send
WSAStartup
closesocket
WSASocketA
msvcr90
__CxxFrameHandler3
memset
sprintf
feof
system
_beginthread
strncpy
fgets
fopen
rand
fwrite
fclose
exit
printf
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
memcpy
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ