5aa9d61ea3a3e6364110a5d181dcdda270cfb4027fb6f95ed6d76cb0c94e0ff5_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5aa9d61ea3a3e6364110a5d181dcdda270cfb4027fb6f95ed6d76cb0c94e0ff5_JC.exe
Size

3.2MB
MD5

8b22ca7c6a7d2de712723ba0681d8595
SHA1

e39a26044180e438822933867e485f5f04370187
SHA256

5aa9d61ea3a3e6364110a5d181dcdda270cfb4027fb6f95ed6d76cb0c94e0ff5
SHA512

4534271345b81b045714e608e3026ca641b462fb39fa9ecdaf986825b4d4f8a425bfc5c875ae3a240e0edbfc780bbc1ddb7cc7becbd6ad52fe0acfd662fda83e
SSDEEP

49152:eMr69ypHXUN+JxApu67djgxpK1q9pRRrW6HzVjdjvPHm3CAqf5c2cJtX52a:VVU2jpPtC/Aa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5aa9d61ea3a3e6364110a5d181dcdda270cfb4027fb6f95ed6d76cb0c94e0ff5_JC.exe

Files

5aa9d61ea3a3e6364110a5d181dcdda270cfb4027fb6f95ed6d76cb0c94e0ff5_JC.exe
.exe windows:6 windows x64

674a07b697dd3ff7b890fb8f045a2f7c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtDeviceIoControlFile
NtCreateFile
NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
RtlLookupFunctionEntry
NtReadFile
RtlCaptureContext
RtlVirtualUnwind

kernel32

MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
HeapFree
CreateIoCompletionPort
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
GetLastError
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
QueryPerformanceCounter
GetStdHandle
GetSystemTimeAsFileTime
GetCurrentDirectoryW
AcquireSRWLockShared
ReleaseSRWLockShared
CopyFileExW
SleepConditionVariableSRW
WakeConditionVariable
GetFinalPathNameByHandleW
SetLastError
SwitchToThread
AcquireSRWLockExclusive
GetCurrentThread
GetProcAddress
GetModuleHandleA
SetFileCompletionNotificationModes
GetFileInformationByHandle
WakeAllConditionVariable
GetSystemInfo
SetThreadStackGuarantee
AddVectoredExceptionHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetExitCodeProcess
HeapReAlloc
GetProcessHeap
HeapAlloc
WaitForSingleObject
CloseHandle
SetHandleInformation
FindClose
GetConsoleMode
GetOverlappedResult
WaitForMultipleObjects
ReleaseSRWLockExclusive
QueryPerformanceFrequency
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
FindFirstFileW
PostQueuedCompletionStatus

oleaut32

SysFreeString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
SafeArrayDestroy

user32

EnumDisplaySettingsExW
GetMonitorInfoW
EnumDisplayMonitors

ws2_32

WSASocketW
closesocket
setsockopt
WSAIoctl
getsockopt
getsockname
ioctlsocket
getpeername
send
bind
connect
getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup
recv
WSAGetLastError
shutdown
WSASend

bcrypt

BCryptGenRandom

advapi32

SystemFunction036
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

crypt32

CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertOpenStore
CertDuplicateCertificateContext
CryptUnprotectData
CertAddCertificateContextToStore
CertGetCertificateChain
CertCloseStore
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertFreeCertificateContext

secur32

InitializeSecurityContextW
AcquireCredentialsHandleA
AcceptSecurityContext
EncryptMessage
FreeContextBuffer
QueryContextAttributesW
FreeCredentialsHandle
ApplyControlToken
DeleteSecurityContext
DecryptMessage

gdi32

GetObjectW
DeleteObject
SetStretchBltMode
GetDIBits
StretchBlt
SelectObject
CreateDCW
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
strrchr
memmove
__CxxFrameHandler3
memset
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

strcmp
strlen
strcspn
strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dclass
pow
log

api-ms-win-crt-heap-l1-1-0

_msize
_set_new_mode
realloc
malloc
free

api-ms-win-crt-utility-l1-1-0

qsort
_rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_set_app_type
_get_initial_narrow_environment
_initterm
terminate
exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_exit
_seh_filter_exe
_beginthreadex
_initterm_e
_endthreadex
__p___argc
__p___argv
_cexit
_register_thread_local_exe_atexit_callback
_c_exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 758KB - Virtual size: 758KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

674a07b697dd3ff7b890fb8f045a2f7c

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

oleaut32

user32

ws2_32

bcrypt

advapi32

crypt32

secur32

gdi32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 758KB - Virtual size: 758KB

.data Size: 24KB - Virtual size: 27KB

.pdata Size: 59KB - Virtual size: 59KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 758KB - Virtual size: 758KB

.data
Size: 24KB - Virtual size: 27KB

.pdata
Size: 59KB - Virtual size: 59KB

.reloc
Size: 13KB - Virtual size: 13KB