Static task
static1
Behavioral task
behavioral1
Sample
jsl_debug.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
jsl_debug.exe
Resource
win10v2004-20231020-en
General
-
Target
jsl_debug.exe
-
Size
236KB
-
MD5
8977cac61332548d0799159c3836adde
-
SHA1
4152f20e3a9d7f6d7b3441be3c91cb7fac926249
-
SHA256
f68ff8d64adaae8273162662beed09ff442a29baf22d763aad127d54b80cf37b
-
SHA512
de83cf830659bdf9b62198865e25ac8a8fbed2a49358249571ddb170bf0ebfc7ce94f6f025c4378547e071008a42df6bdc9259a88127c704a9c67ca8d3908d8f
-
SSDEEP
3072:vdeVvnT1v99JKd51F8iv45rMyCdhr7VMwozpJpCxpga84wrfV26:VeVvnZv99JKdEpMyCdd7V+4E06
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource jsl_debug.exe
Files
-
jsl_debug.exe.exe windows:6 windows x86
1c530eeb769173ab7a12154fcfbe2428
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAGetLastError
socket
htons
connect
closesocket
kernel32
EnterCriticalSection
LeaveCriticalSection
Sleep
GetCurrentProcessId
LocalFree
FormatMessageA
lstrlenA
GetPrivateProfileIntA
GetPrivateProfileStringA
InitializeCriticalSection
CreateToolhelp32Snapshot
Process32First
Process32Next
WaitForSingleObject
SleepEx
CreateEventA
FindClose
FindFirstFileA
FindNextFileA
GetLastError
CloseHandle
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
QueryPerformanceFrequency
QueryPerformanceCounter
SetEnvironmentVariableA
GetEnvironmentVariableA
SetConsoleCtrlHandler
AllocConsole
SetEvent
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
SetEndOfFile
AttachConsole
ExitThread
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateThread
GetFullPathNameA
ResumeThread
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
DeleteCriticalSection
FatalAppExitA
RtlUnwind
GetStdHandle
GetFileType
GetStartupInfoW
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleCP
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
CreateSemaphoreW
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
GetCurrentThread
GetCurrentThreadId
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FlushFileBuffers
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
WriteConsoleW
OutputDebugStringW
HeapSize
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
ChangeServiceConfig2A
ChangeServiceConfigA
RegSetValueExA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
StartServiceCtrlDispatcherA
Sections
.text Size: 182KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ