Static task
static1
Behavioral task
behavioral1
Sample
Ocean_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Ocean_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
Ocean_JC.exe
-
Size
1.9MB
-
MD5
93af695ced4b3fee3e8a1f54fcf86d0d
-
SHA1
dc9cd4dd64a9554866dc2f00c0d3005d48b7bc9b
-
SHA256
6b883e3f98c721155b6443aa2289defe78353328ceee17ea3bb3392ffe502d50
-
SHA512
b9fd398a9f26ebafee6b55bb8266f69fdb89e864ff297dd3fd259afda83e4cef1c7c982a3645f929be0a80749b006a370169daf3568fd33a3920fda06285afb4
-
SSDEEP
24576:B40K5TjY+BMIbiGAz5rANUiYnRlbpfqrnJHWJUbaglAwEVaAD9QE2G5ZEmY5MOU4:li1WGGae5QnJHypQE2Tnf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ocean_JC.exe
Files
-
Ocean_JC.exe.exe windows x64
9948308bf1689a50b51e9f21662d3779
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
Sleep
ReadFile
SetHandleInformation
CreatePipe
WaitForSingleObject
CloseHandle
CreateThread
CreateProcessA
CreateDirectoryA
GetExitCodeProcess
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GlobalUnlock
WideCharToMultiByte
GetStartupInfoW
GlobalLock
GlobalFree
MultiByteToWideChar
GlobalAlloc
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
user32
GetKeyState
LoadCursorA
PeekMessageA
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
SetCapture
ScreenToClient
TranslateMessage
keybd_event
DispatchMessageA
SetCursor
GetClientRect
ReleaseCapture
UpdateWindow
RegisterClassExA
PostQuitMessage
UnregisterClassA
CreateWindowExA
DefWindowProcA
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
ShowWindow
SetWindowPos
SetClipboardData
GetWindowRect
DestroyWindow
msvcp140
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon
URLDownloadToFileA
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-localization-l1-2-0
FormatMessageA
GetLocaleInfoEx
api-ms-win-core-file-l1-1-0
SetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_exception_destroy
__std_exception_copy
memchr
memcmp
memcpy
_CxxThrowException
memmove
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_set_app_type
_register_onexit_function
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
abort
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_errno
_invalid_parameter_noinfo_noreturn
terminate
_wassert
exit
_crt_atexit
api-ms-win-crt-heap-l1-1-0
free
_callnewh
_set_new_mode
malloc
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-string-l1-1-0
isspace
isblank
strncpy
strcmp
api-ms-win-crt-stdio-l1-1-0
_fseeki64
setvbuf
fgetpos
fgetc
fputc
_get_stream_buffer_pointers
_set_fmode
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
__p__commode
fseek
fclose
fflush
__acrt_iob_func
fsetpos
ftell
ungetc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cosf
sinf
ceilf
sqrt
sqrtf
pow
fmodf
__setusermatherr
acosf
Sections
.text Size: 280KB - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ