��E�H��l�"�y�FX���oo����<]kG�<��0�,�e�/~Bi��r�חr�{y拯Q-�A�0d����j`�$o��5��K�����% gM�>��2�Db������Z�y��u�O��<q�(kw9ڴ�,����}�6Ut�,�r\������π�lk^�!Ҿl�g�P ��T6F��6�3h{�7�d�H��v�c�hh �!�УfJ"Av����A� ��9���GLm���%%�M�Wf��v��g�������W�ׁJ��㏫�����f E�B!Y�sH��H� �_��ߌf�!_�'ct��O��wj����BřX$/�Q�� ���rB)�*wd�f����B�#G�.5V� �/���4�*���0������:��iLC~�W'�0�x�� srp)�m�t�u�/�4i*�P��W}�Q��"�$j� G:�;��c�~�8-?g|]JFkPw�ܣ�=�8�G�O$�h�VGrRI;O:r����;j����9��&L�/Wc�_�9� �谻���[������SC��S�v2P��r��߱F�����7�<F��)F�l�S��ʀT�-@����d�O��&|��~�r���(�^��'U8"h��m�)V=w��y����~ƕBh@�@��E_j)8.�.z{���p��f��X9P�0��|�y��<k�ʼ���S����7ɺ�Vx��q~9��j���(�݇.�_������ky��D�e5 �/�Tfv����V��/�Y'���2d���D�eC*=�b���gS�\o g�@�P���\S��-����ߣ�Ӟ���/��+̖�#�X�U`���xhw�h G�1L(ϥ�]?,~ .TI/qM� �l�ӗ�K;���ǜ6�T|&�O{]�mEļ�B�%��ұv���;A54ۦ�C�ѓ�C�e��|܈���"�*6�0F�M���<�ee���nOT�$�`1m�j��yuS��3�o"��?<���# ���"�]B�8�2�Q���} �bpbz���D�+�GXI�����cBA�:b(��5D4Z�F f����$z9 Po��9�),l��Gw�.���z���yV���_5�@,y��ȕ=�[f�a����B�������x9���U�V�6�����ջ�ҔY��p�O� z��� M�F������ �_.w��7s�T }��ӫ�Ȯ��U�G��BY�/�4��f.<�&�גv�C�\wI�+셯�3��:f=��eN4�4%�{�=@���CC�g!]�}�oX��ً�MHHv%⧋OG�+n����#�?��G�)��t���o�:#`���_mԮ�rW�(P>������b:����8�N5��p�u��m&#H��<33n�X�<��r�J�OM��&:<�uI�6!4��cу�2�l(@����ߊI�8dk�1?5�WD����s�V�rLi�(j,}��hc�{B��Rq�1�i�ِ�K��E�+�V&�q��������|u^��@��n�Y�!�v���팊������^g5:6�aAV�1N�c�@�������&6k*�[�J{L���a��t��Ȑ|*_�n���FP�i�2����\�����w}�l�!U��3�������Ë���-{�� k? UW�Z7�sE�Wj$�> hX˧+^�~C0�^��R^m�_e��w�NW�)fa1��0����r��U�A��Ke z�c�0�ۓ���ߞ���}��f��� c��&�vi�{W=(�h�I�)�"�㙏�/�����L��ØF��xW����'�לY���L�����BS��6�i /c�f�V� �g��Wñt�g���2��ݧ�k0�nF����Gխ�.���$�PJ��u��1��^a�z' ��[��P?�kCftA,2'���7�������T1�4ѵ1z����=�:�L7���l�G���[��k1;<������vL$�H��ƥ�0���g ���}|�J�t4�����?��v�guk .$/������=l��مǔ�ܭv��/9;Ce[ҶZ�f�.6 �zP3a�L��,��o�+P�V��% �D�������d�̯�����P`Box���MAQ���=6K�s��!aP��hع�-�G�kWx�h��SV�2%=o�<3�A��3�P��Z�{���`��+/���MV�x��>�>�5r=(�h��P0,.?����@@�K����3~���A�\D� ��Ya7��'ohN�=�[�Aҡ���09� �]��|�r� q0�¹?,w���c�3�m��3�6��w�Z�V���l*�r����QB�v��V�k�J��,d����Ĉ��v�MmML���n%ZI�L��������F�衳���c|�m9ܣ5����hߕ��c ��"��v�4�u #):���}��C���.g�Q�~ �ۃ#4]~�V��yG��H�f�����K��d�|7��~��@$})|W��=י'����f�%�>��@�����_��\�ƪ$Ȥ;�z;Ό5�3��XmkR��o���)�3��2q���,3�f����#B��X����y��Q�S�<.�Ct� v15��G���c0-��j�z�6��"XM��@"�"6�.�����,�s40-"����5ۢ����XurW<�8� �7\������s~��bd��T�����c�N��wP���|P�'��a��+�f�8|��W�q�R-��I�����M�@Z�y��nf�1w�'s���om;pAȥO�7��Oe���z�ח�tdv� sG,��t��?c�hpq;��9Z)�����t�q��D�G�O�I6��xL�x� ��ݨ[r5"/�]�~� ���:W�U9���^��� �� P]��<M�ب&���d����ͬ�\�td��7��,q#����>�D���Sb���,���Щt�c��͉l"�����F����+�Kόw�fd�������jAK��*[Þ�~���Y�������1<gF��8���N��wQP�i���~垛�-�'�Ie��������t�y��a4+�vj7����|on|��%?g�_�G���Y�G�T-�g�
Static task
static1
Behavioral task
behavioral1
Sample
68aa3e720e8acf3cbd64f4046d067c50e53426ad0a2e738d08618c7aff116073_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
68aa3e720e8acf3cbd64f4046d067c50e53426ad0a2e738d08618c7aff116073_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
68aa3e720e8acf3cbd64f4046d067c50e53426ad0a2e738d08618c7aff116073_JC.exe
-
Size
6.0MB
-
MD5
034dfb2a7a6be34ff4c197c3f5158c4e
-
SHA1
f7805977f7cef6bd9b6fccf0f0a144626a838fde
-
SHA256
68aa3e720e8acf3cbd64f4046d067c50e53426ad0a2e738d08618c7aff116073
-
SHA512
73d5b8f20f26573a19f7d202828a7401ab654c14361e05f2020d3ef3b0b09276546b9f3c72756ea6a4d81a08a7608d0c07b47f3ac767dafeeb133105d8488081
-
SSDEEP
98304:sB6Xdvo120oIeVsHteuyK8mCpq3wdqVAYUzujDG:pC8VFTd4AoVAYUzT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68aa3e720e8acf3cbd64f4046d067c50e53426ad0a2e738d08618c7aff116073_JC.exe
Files
-
68aa3e720e8acf3cbd64f4046d067c50e53426ad0a2e738d08618c7aff116073_JC.exe.exe windows:5 windows x64
0319e999ac49e0b5e3cd76fe794c25ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
wsprintfA
CharUpperBuffW
ws2_32
closesocket
advapi32
RegCloseKey
kernel32
VirtualFree
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
secur32
GetUserNameExA
ole32
CoCreateInstance
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 501B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ