��|@�a=B��^���b���|�:�òg��L|v0��%e�,�m��M��ި/�W�d����rQ�������FR����n�š�P��S]ߔ��6�ןϫz%�DA��ΆۉJ�������k ��̚V_�}K:�܉���UĈ���_�*����Vgoi�݅(pz�و�o��M�-�0��q�0�����4 O`��u���CQ�wַ_e����N0tc�x����e{�D8��������"1���L�RQ�ۼ�����6~�`I �cК^iU�T.���]����ٯ ��V�B!%?+� ]G�WiԵE�?�4�Q '~���&�F�P��V5ߐ��Rm"Ʀ5"h!��Rk���V��O��V"s��赸�7��\;�DvH���ܫi�}<�uM��с�礃�� id��m'����Ukwz�42 Rq@��_c������>���gJ�]����50?�d.a���u�V($�6�@�~���o�mX�dhJ�X�7o6A�Q�_1(�ذI�珧��)�$/��/4���WłbB<~��'����ΐm�[c=��P���L�$2��Im,1Vt�$�p*�!��/���=�Ժp��=[`�?����օ��!�}<�c����cVg7LI�Z�r.J���(N+�!Y��sRI�����V�h��ZZ���;?6��b7��1�4�اR2!� �e.7����tTW�3��?^�|�67�h�l��K���q� v���v��]u���5�.�rҋSޭ�c�r <@��Ҥ���a�����9{�t�d���Đ�c)H��x@O���A���3���Iz/.B�⅛[ �=S&�V����5�F��^V�(���ҀG&�Z�� �,�rs��Dt{<��L/��1GU�o�XJ��in��KV�w��OYN`��,�uLM�[v�J��kM��iD���PAN�_@C���J����K��3�-�u�3ɬue�h��)�h`��v �'���.���w�~-����d�~�D0M�}JAp�oᲸ��.�3��f���ʢ *��L�x�b*������gYj�s>�.�-h��E!pIa�78u-�~�h��~���$�m^����.K��n���5��E��4h�'Vï�q~�3�D8�i>U�DJ�Z�x�� c�U�C��hdU��v� .ڎ�����g6.&I�o=�41�|���d�i���Ѽ�c�������`#�M�� aT� �=! y�"�� ����s_O��qL�/�N>�"W�hx��R�В�B��M9����}i��v������SB�|= ���܆aӤ��,}����ͮ�G��& �`AȠX�K`�$��{���c�����b��۴������c~!��e��A����,�w&M3Q���4f����0m�<3z+� W��_M��������f��J ��_|��I�gp4�B���x!�4�u0���VG�T�v����r ��S[�y���~�4�0��kRw�V�d�s!6y��Uל�?-�@٭[���_$S������C^�߬�z{z�JK��]�p��� �IB��hh���=I�g�5����w�ߟ7����a&aREZ��3��i/L� ����.� "Lс�<~�����Q����5�����7e�VQDa��}P�Ǿ�9�}90T��Zy>��Z>N��z����k�o5�A���y�O�3��B`����^����!�=l��El<Z���B�ɮ��6%=D�wزM\]+cF���ធй}B�o�R���4���!�lS`���/�`�Ў=��m��q���5�#H�>�)��{(~��G�2���D�3�H��m;�G�'�Naɘ�! N��� ����#���Y�e����UU�ץIqߵ�2Ɋu������7���-�V�ޝ��E��P���:v�h��|�l�!��Ƣ��E�z-����Ƥ�̀@��!�K]z��w���|ʗ/.e��Pe�#������s&�f����:��(r�ku"ߺ>�+B�1�q�����uXt@��6��&�;�3!e<̺�ea�ˑ����ք���@p�������L�����*bc(�AƷt� s����O�)���ed��|M��W�7�l� k;�jΛ�d��o�2�D1�����3>�bCR����k�(���f�Y�X z���K�(��0Vr�j�ͪ.4!��p�B�.[%tmSΡ�h突1���q5��3���I��0�ꄣq�=�i'L'̕9%6�2�)��(���Q;1*�������#�����(�,�"������5��.Ьl�DI������ �a#�6���S�蔼��5�~x��N��u��u^��m�2z�/�T�P���Wo@��AbT�/.�1vk7��{(SZծ�z�U�M;fki)>N��S��QY�>GA�z��e���]�S�ƥ;DbO�X�W���l��PjqЯ�7����#nwp�x������u�?]JJ��Dž��h�]=�z���в����^�?��dȐgo�����JwC��ǘY@�u&������8'"��k�~�ЛM���R fN��}1諾��S��l�&�M{�L.���{G��*z�c��Ͼ��̝�/Z�T��p+���RrO����>�%�Q�g}��@D&>���̶�t��r���?nT'і�{�3�U3��y9"x0�[N�*Uǀ�Ku�*��� Y�iNP��bXVI0k�ÓG�I�8 ��>��E�����f�v�g�f&�*���4��xI�)G[��p>X��\�J*��b/-3p^*6rZWӒN���a��^��_��i�FW?�l~݆Ӏ�M՛C ��,�B���|�t�=As�fl] 8��c��m�+��)s����A�����[Bv�j�+L�^�#�Jo�����2�s�{�T�� �plj�У�Z���y�;��� �����pS�J���#)�r ��Vr��[�N5�^����]��z����v�C�PaHp�'�c�b_^�8�.������ �&�n~�w+Qva�����m�7H�kǚ+�����&]�菽 �u���7vd���RF�!Pʚ�k�
Static task
static1
Behavioral task
behavioral1
Sample
JhonNet v6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
JhonNet v6.exe
Resource
win10v2004-20230915-en
General
-
Target
JhonNet v6.exe
-
Size
7.0MB
-
MD5
3adfa02366559391193babd23572fdd0
-
SHA1
4345dc7502252a54a91d55670639bcfea8218f76
-
SHA256
0e20aa3d4a4774f420239427a2cb325255192a0740d554ad34fd78b8b4044299
-
SHA512
06c980c3bab2b8e1ba3ecc97ab5ab547f97c4bfd474bae3334081cfab80daed71bf21753ba4cd1f715dc03c4ef6a43c1d45ab4a249fb5e15a58880da7677ef01
-
SSDEEP
196608:kw6rQZwpk1/OpukB6J+IalYVGf4pa1JNEjlcXdW:1wi6GRqJf4pa1JNBN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JhonNet v6.exe
Files
-
JhonNet v6.exe.exe windows:6 windows x64
b46fa148bc0521bbd9d488dd8cb79e56
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
IsDebuggerPresent
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
CharUpperBuffW
advapi32
ConvertSidToStringSidA
ole32
CoInitialize
msvcp140
??1_Lockit@std@@QEAA@XZ
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
userenv
UnloadUserProfile
ntdll
NtResumeProcess
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord45
crypt32
CertFreeCertificateChain
ws2_32
ntohl
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
Sections
STREETdH Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET#k Size: - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREETFd Size: - Virtual size: 523KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
STREEThA Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREETfq Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREETlC Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
STREETJv Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET)6 Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ