Static task
static1
Behavioral task
behavioral1
Sample
85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe
-
Size
2.8MB
-
MD5
723a599e70812b9aa02beb8ba5ecd258
-
SHA1
25b72aa419fca1ecb094e65215fbc34bcf3566c8
-
SHA256
85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6
-
SHA512
d73768a8f43d4707fdf6e329d0a58bd15b144916db6509b48ccde0ac075bdccdade1cca369c0123a1e1edd9f7b71be5d893462875685ddf8347014ce48b59c10
-
SSDEEP
49152:jCfDVSuEDBxOGNDHw3eO/t578Or4loBkGIEQoPYk41Rwr/WRnqmU0wYF:eb0fZC3eO/t3r4loB2oPewzWqT0wYF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe
Files
-
85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe.exe windows:6 windows x64
c99072c6cc5976caba7b56af17171d6a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateMutexA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
oleaut32
SafeArrayUnaccessData
crypt32
CertAddCertificateContextToStore
advapi32
AllocateAndInitializeSid
user32
GetMonitorInfoW
bcrypt
BCryptCloseAlgorithmProvider
ws2_32
WSACleanup
ntdll
NtCreateFile
secur32
FreeCredentialsHandle
gdi32
CreateDCW
ole32
CoSetProxyBlanket
vcruntime140
strrchr
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 759KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dsdfsdfw Size: - Virtual size: 931KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dsdfsdfw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dsdfsdfw Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ