_ReflectiveLoader@4
Static task
static1
Behavioral task
behavioral1
Sample
JuicyPotato.x86.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
JuicyPotato.x86.dll
Resource
win10v2004-20231130-en
General
-
Target
JuicyPotato.x86.dll.1
-
Size
254KB
-
MD5
28e874a7107b7e08e79e6efc63602609
-
SHA1
ffb3b9ea5dac1741448800464ee1284f13a45b73
-
SHA256
07381878641e99bfa6ff286ba7010c04e9055e1dd7c27c079063617a18e1da03
-
SHA512
927b707d1c9a104870036b52efc02d8c148645cd1fee62ae3756ec9c7678a6c6be10e763609b0d91fc936a8db55cbfc125e0cc362463e96d3a4f8b796f097ce5
-
SSDEEP
6144:GTy93RNkysEsXACLxqJa/vueSzJTtwSpHJbkv0GQspid6/o:p9YlFq+tCTtwSZJXGQe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JuicyPotato.x86.dll.1
Files
-
JuicyPotato.x86.dll.1.dll windows:6 windows x86 arch:x86
6009cc5a11ba91fc5873c5be5067d787
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
secur32
AcceptSecurityContext
AcquireCredentialsHandleW
QuerySecurityContextToken
kernel32
CreateRemoteThread
HeapReAlloc
WTSGetActiveConsoleSessionId
VirtualAllocEx
GetLastError
Sleep
GetCurrentProcess
WriteProcessMemory
DecodePointer
CreateFileW
WriteConsoleW
CreateThread
SignalObjectAndWait
HeapSize
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
WriteFile
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
CloseHandle
SetEvent
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
FlushFileBuffers
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountSidW
CopySid
GetLengthSid
CreateProcessWithTokenW
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
GetTokenInformation
ole32
CLSIDFromString
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetInstanceFromIStorage
CoTaskMemAlloc
CoInitialize
ws2_32
setsockopt
shutdown
recv
send
closesocket
connect
bind
socket
WSACleanup
getaddrinfo
WSAStartup
accept
select
listen
__WSAFDIsSet
freeaddrinfo
WSAGetLastError
Exports
Exports
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ