r#�� ַ4� ��W�@����+��t �k�d�ܺzj1��͆�k`�H����~�s�N}pEޜ��O������g��/��Y�=]����aB����Gb@,R���}�&0n�4��E������Kk6��C�2��Xt��%��FKN �(/�Ncꯃ�M.Dj�@:#�� �8�� ���3�f_ws{\UB4+:�"���A��O=�������*S�~�.D����Q�"gH��o�fԶ�.2��F9�*"GՓƲ1����1NS��Mz�_�쓃HM�?���ۅ鹤( ���"���j����T����*B��h�I��KX�d�ʵ�0��[������0�Alh���8P������)�8���/!�����O�+�!\�FP��Zz}�����q5�_���u��I�<[��,�t���J\,��i�O��z^��FYw���}�s_�A~��>7��uin�b��j��D�>�&��c���G,�Ԗ;�?t�e�(y� 3�4�/�T���9"r��E�pM�@���=�4= \\T]Y�\Z�j��1X��+ʇL�)4��,u��K��/�݊M`�1 �B# �} 5������`�����~>[r#* r���r� �~���n;;��4���a��F�3�PL��֝�7x�����!�8y�t�C���r#���,�X=F�S�������j�pV�,�о�F����L�S;�z;�@Re�K n���s>�bp��8��/���3��I���e j>�b4����a`и�/|n|JTK�U���Ld����ͬI�(��8���������[p�2F���M��T?�l��))[LV�`2��.�V9R��^6|x�����������XO5J X�%���;�K3��h컸�� �Vʶ���r�E[Ge�2���֩��)��ܯ^�>E�x���6�*�)�`q2}��1�c[<cH���9���3�c����܊���a�E{��ف����''�+g ȩ�3� ��j��]�w���w�����F5R����U1�N�R{�.q�Id�$;�j>�j���! ��d ǃ�h��#�$�>9N�vY��}٤K�WN�x-�w�ѳ��3�bq.K��mTAYaF�R:�z��p!r4 ����GB{Å�\�E����V�Ȃ�Z~(�9 s6�&c�7\�`�q���k{L����'��:7���;����U�'V^���ك^�l+8}�6_<u��~oc&��[$��0��e[�D���Ms�Ϡ�9/-;}�b:$���r��k��H� �q������;,0I�#L<��B"tE��������<����S +��e�z&��=63�i1�CCӫ���ヒ9s:N&����}�&u�=�f9�zE��FF��E}̥D=9���J/pP- x�]!`�2N酴�EgD�Ak3s��P��!���hTz��є6$��a���w�!� j�踿9�e-Z߈� �����#��.�"��T�2�1:P�=�����d�X�VʝpB4��I����[���`��%Ě�;�@L��^�U�I�ǁ�>2G��Y�f�l�ۃ�K�k�U����dQ���������V��M�L���C���(���%^w���?������t�����]�ڸ]\�l����A�z�|g7Y*��Ȼ��GQEl��F0d�<����`��υCj����Ae=�Y������L��Y��[�Lw�^�����8�pR���,u������j��L�Ns,U9�)AR� �g�C�E�Q��4��.�ن��}fv��.�����.���o��mɬ\RזּE>+��Ff�F<��i�׆y�oti��%z�X�mߥ�G/�Ī�e�xI���A?"�h��P�-� ���e�6S��Q5��Y�wi��E�� ��@�7<�Ł�т�k�-8LV������.?��|k|�F�&Ώ�& ��D ƺ(���r*��N��aW�q�`�[��C�s,��!�*+��*�M�*���(�v�"P�aM�E$�*��=���`�}n�m�-��HA��h�$��>����^[j�\߀a�EޟS�e�v��si��`560��$'�)�Q'*֦ˑh���~�8{8�� ���ڲ���jl��4N�ʩ|�S7�ܒ�}�#�'[@�l |Z�[^�I�Aj�O��p��Ѥe*6D3F�3������)]�;p&���va Ұ�}��$ H������R�k��� �%�|rOC��6y6D�l��"s#���z(u静:өD`��k��>��(C�X��B� �(�`�n�6c6ͥx;J��k\�I���LHC�I/=��b�e�<K��^� ��X7�"eh�go�d\�u�ݚ�d.��n����T0�2 �H�8��ks�D��J�N�2]�e��� p��!�����Zv��,�B�u >$sǩָ��:u(�Ъ}�k S�F�8���&�M��^�J^ ]"<L����,��Bj-bY��(Wnď���p��X&Pl������+,p�Ѧ(���'�$jtiͪ÷me��Ճa$Udh���o�����E��C����ԃ�p���*���_�o�8�p3��+�D�!4�[��=�/��i�N�%:� ����d���W[�>eNI����ua?8j/�ޢy�`j� ��X^�К��M��rk�4���})&H#��������ѩ�ȥZtfX��C�釨dk+xk�J:t����k�R�'�Ao�煆�9M�!Y�8 ���+Kb����m��2��efC���W�����HK������dbe�sz��r8 ��\�"� R��,��� T���Z,_��C)kV���텢V��ޅ/5W]$�;~�(�T���+�Ќr���].��5eu���aS��o1�� ��W��v8�N�xK��ӌ.��J�(���un�'c��]eLG�o����t�3h��c( ����������6�J>m��7%��q��P�����EQ2�7X�M|3��<�U��-}Q��◄9����,�X��`����8���L�����V�s\ŗN
Static task
static1
General
-
Target
J2C.dll
-
Size
19.9MB
-
MD5
fccac47cb24565329833a15510edc9a8
-
SHA1
0ca537f6578ede3e86b463904c000ded4441663a
-
SHA256
dcfeb35ba299867d850ef76dadf65f7756c4ceda46934dd875d359e9b77ceab3
-
SHA512
dec187819d96c053876c613e19874a9e406078e974ca7c5c070ae9c761e9c50264570ef4683560f626f54be54ab8f452e9862a873ee6881b800038d074dff981
-
SSDEEP
393216:TR5qKbnUCMDmiJdUfwsEldgDlF3cTjVqIW4cPDDUoxSpnR7JivWwi71LMMnK:TR5Xbnhibl1laMNePDD/IX7Avj2iMnK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource J2C.dll
Files
-
J2C.dll.dll windows:6 windows x64 arch:x64
61ccf4cf3e4a2e0f141eff633918bfa8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 967KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.snQ Size: - Virtual size: 17.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.0V8 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.*AT Size: 19.9MB - Virtual size: 19.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ