jc100[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

jc100.exe
Size

6.0MB
MD5

b22934d6b2f6202b0f7a82408006efaa
SHA1

2dbf4915bbb4ffea7abe8f5e586ce0b7b2afc428
SHA256

cf2af491b20444f6f93318eefdcfc5cbc16f376d8b28b108d19fede8f6e8bd01
SHA512

6e7a91cd63b30821d4f767ee73e96eb0e0c4166757f1c16fe800c750901329a17cbe3d318057b4b01c09f92550d4692e80c9e05e207181de1f793ab88d5ab525
SSDEEP

196608:bnGXIbBOGUKBwTBRMkgLIs4mcyhNPeACGcSQxWM5A:bGXURqtuhL4bOPDGxX5A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jc100.exe

Files

jc100.exe
.exe windows:4 windows x86

d423b286272e9d2c90a9b98a8a8ef654

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
CreateFileW
InitializeCriticalSection
SetFilePointer
ReadFile
GetTempPathW
GetTempFileNameW
DeleteFileW
DeleteCriticalSection
lstrlenW
CreateDirectoryW
MultiByteToWideChar
EnterCriticalSection
lstrcatW
lstrcmpW
CreateProcessW
CloseHandle
WriteFile
SizeofResource
LeaveCriticalSection
FreeLibrary
LoadResource
lstrcmpiW
GetLastError
RaiseException
GetModuleHandleW
InterlockedIncrement
LoadLibraryExW
InterlockedDecrement
lstrcpyW
FindResourceW
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetOEMCP
IsValidCodePage
LoadLibraryA

user32

CharNextW
UnregisterClassA

advapi32

RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d423b286272e9d2c90a9b98a8a8ef654

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 51KB - Virtual size: 50KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 21KB - Virtual size: 20KB

.text
Size: 51KB - Virtual size: 50KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 21KB - Virtual size: 20KB