c11806a41bfe4b263711365ff5dc2fc7b7fafaf40a5c79ad199306d3cd1b2950_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

c11806a41bfe4b263711365ff5dc2fc7b7fafaf40a5c79ad199306d3cd1b2950_JC.exe
Size

146KB
MD5

7c7e9782f0267895447571f773ca49b0
SHA1

214986d3da6e7cf63a0322d860affe1d1d1d5033
SHA256

c11806a41bfe4b263711365ff5dc2fc7b7fafaf40a5c79ad199306d3cd1b2950
SHA512

b421920960259a7a7ac3e88a8cbbf39aa833403df2e697902db2573be67664d3046a6a60aca24b64721169ea97e88c135d7063a04da774763a0956796fd743e7
SSDEEP

1536:vodreAQm5hPjPxeU9wf5isu0ryMcNpVKv6D/WaYnly4CZ0VLd+ccZws8jcdWfaYx:gdySrxkR1Iav+TYnoILd+hWfk0LamB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c11806a41bfe4b263711365ff5dc2fc7b7fafaf40a5c79ad199306d3cd1b2950_JC.exe

Files

c11806a41bfe4b263711365ff5dc2fc7b7fafaf40a5c79ad199306d3cd1b2950_JC.exe
.exe windows:6 windows x86

4ae5c0352a2707ad3f145fcc46657af5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetConsoleCP
GetFileType
GetStdHandle
GetCurrentThreadId
IsDebuggerPresent
GetProcessHeap
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
HeapSize
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CreateFileW
CloseHandle
EnumTimeFormatsW
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
RaiseException
RtlUnwind
GetCommandLineW
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW

setupapi

SetupQueueCopySectionA
SetupInstallServicesFromInfSectionW
SetupGetFileCompressionInfoA
SetupGetSourceFileSizeA
SetupCopyErrorA

rtm

MgmDeRegisterMProtocol
RtmBlockConvertRoutesToStatic
RtmCreateEnumerationHandle
RtmGetRouteAge
RtmGetFirstRoute

user32

CreateDesktopA
LoadImageW
LoadCursorW
MessageBoxW
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
DdeAddData
TrackMouseEvent

crypt32

CryptMsgVerifyCountersignatureEncoded
CryptSignAndEncryptMessage

comdlg32

ReplaceTextA
GetOpenFileNameW

mscms

CheckBitmapBits
IsColorProfileTagPresent
ord1
InstallColorProfileW
RegisterCMMW
SetStandardColorSpaceProfileA
DeleteColorTransform

gdi32

DeleteDC
DeleteObject
StretchBlt
SetStretchBltMode
CreateCompatibleDC
GetObjectW

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4ae5c0352a2707ad3f145fcc46657af5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

setupapi

rtm

user32

crypt32

comdlg32

mscms

gdi32

Sections

.text Size: 97KB - Virtual size: 97KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 12KB - Virtual size: 20KB

.text
Size: 97KB - Virtual size: 97KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 12KB - Virtual size: 20KB