djoin[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

djoin.exe
Size

63KB
MD5

c51676b83e61e46ab7bdd3d93023511c
SHA1

6931c2e0ea431b5f5cbc35ad56606d00209b1de5
SHA256

5c7ef0e0f9f35c90d304c56bfc04c85ab4476d83fbb91f38fc207809fbc38210
SHA512

634743b903bfe47252a01b25f05ada3881dc19e95be66a9cbe16fa6f02363d941e1ebdf312f92b5f73a7bbe2d9664b278bf1a9106f457f3f9a1dee4257aa79a1
SSDEEP

768:bIjgYZsiC38MVRyaSrLVZI7zVDI27ZmJCfe8QcD6wCtBnfU/Pwg1QieQk/8O:4XWoMVCVZIP3pfexrtRU/Pw8eQk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
djoin.exe

Files

djoin.exe
.exe windows:6 windows x64

ca8ce38a9dacb403b481cc7c04c44d42

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

ControlTraceW
EnableTrace
RegCreateKeyExW
RegQueryValueExW
StartTraceW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
TraceEvent

kernel32

ReadFile
OpenEventW
SetEvent
WaitForSingleObject
SetLastError
CreateDirectoryW
GetFullPathNameW
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleFileNameW
LeaveCriticalSection
LoadLibraryW
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileSize
GetVersionExW
CreateEventW
GetFileAttributesW
WriteFile
Sleep
FormatMessageW
CreateFileW
GetModuleHandleW
GetTickCount64
ExpandEnvironmentStringsW
LocalFree
GetWindowsDirectoryW
CloseHandle
HeapSetInformation
LocalAlloc
GetLastError
SetThreadPreferredUILanguages
GetStdHandle
GetConsoleOutputCP

msvcrt

_wcsnicmp
free
_wtoi
_wcsicmp
memcpy
malloc
wcsrchr
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wprintf
fwprintf
swprintf_s
wcscpy_s
setlocale
_iob
_vsnprintf
_vsnwprintf
printf
wcschr
memset

user32

LoadStringW

ntdll

RtlAllocateHeap
RtlGetNtProductType
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DbgPrint
RtlNtStatusToDosError
RtlFreeHeap

logoncli

DsGetDcNameW

wkscli

NetJoinDomain
NetUseAdd
NetUseDel

netutils

NetApiBufferAllocate
NetApiBufferFree

netjoin

NetCreateProvisioningPackage
NetRequestOfflineDomainJoin
NetpDomainJoinLicensingCheck
NetProvisionComputerAccount
NetpAnalyzeProvisioningPackage

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca8ce38a9dacb403b481cc7c04c44d42

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ntdll

logoncli

wkscli

netutils

netjoin

Sections

.text Size: 37KB - Virtual size: 36KB

.data Size: 1KB - Virtual size: 35KB

.pdata Size: 1024B - Virtual size: 852B

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 512B - Virtual size: 188B

.text
Size: 37KB - Virtual size: 36KB

.data
Size: 1KB - Virtual size: 35KB

.pdata
Size: 1024B - Virtual size: 852B

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 512B - Virtual size: 188B