fa5f795d71952bb9d880d24643f3a150_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa5f795d71952bb9d880d24643f3a150_JC.exe
Size

183KB
MD5

fa5f795d71952bb9d880d24643f3a150
SHA1

f50c8c2745d8ab61a6ffc577dd0c5822da7beca0
SHA256

da0326f5a50a7d4b3bd2bdf9a2c129e674432a595b9458fc7b088bb76e4d2d2d
SHA512

afce0748946a19112fce67c2af28202e6951ebdb8489e4a8edded91d6ec89c90652110c5409ecac3546f7eff982ff219f14f80cf5da8fc00ffcf1bc64513033f
SSDEEP

3072:t03Kvj7+d3VV/t5fT0UzA+YninOtowQgv4I/ZS5nthIQRzKnAiWs5u53V17Y:P77+dLl5fTxKninOtowQgs5VKn2hVhY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa5f795d71952bb9d880d24643f3a150_JC.exe

Files

fa5f795d71952bb9d880d24643f3a150_JC.exe
.exe windows:5 windows x86

887216cd14dc07ac5c7539304e24449b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageW

gdi32

DeleteObject

advapi32

AdjustTokenPrivileges

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 177KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE