6653c11f66695b82d3bcfb5aac2830d7

Sharing

Copy URL Twitter E-mail

General

Target

6653c11f66695b82d3bcfb5aac2830d7
Size

2.8MB
MD5

6653c11f66695b82d3bcfb5aac2830d7
SHA1

30d08c09f0a9458f6277e38ad7e39c51805ff819
SHA256

564d2dbaaf68712794aed4313a4c66ab3aa51b76fb5de2fef7958b6a0885e2f5
SHA512

7ad77a8c9e4412b43f241323859bd9238e5321aaa7f7bf690dd89ee958ed723cd91a00cd3173be3c4031978bd5fa40dce9e1d31e01dbae1c51f337fa849a3e14
SSDEEP

49152:Eig/yU3FVHAC24jB7vtUeJ7UMGW8Twq5Yv6ucm0bxBkrDpMjCfSDsFiY77y8Ff:xg/yU3nHg4jBpUk7UMU5Yv6Ws0MCSo7H

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/JkDefragGUI.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/JkDefragGUI.exe
unpack001/Programs/JkDefrag.exe
unpack001/Programs/JkDefragCmd.exe
unpack001/Programs/JkDefragScreenSaver.exe
unpack001/Programs/JkDefragScreenSaver.scr

Files

6653c11f66695b82d3bcfb5aac2830d7
.rar
ChangeLog.txt
Help/JkDefragGUI.chm
.chm
Help/新云软件.url
.url
JkDefragGUI.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 246KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 619KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Programs/7za-readme.txt
Programs/GNULGPL.txt
Programs/JkDefrag.exe
.exe windows:5 windows x86 arch:x86

ead96d400dfee134a61c6cea43fb45d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
SetTimer
RegisterClassExA
PostQuitMessage
FillRect
LoadIconA
GetClientRect
BeginPaint
GetDC
TranslateMessage
InvalidateRect
ReleaseDC
DefWindowProcA
ShowWindow
CreateWindowExW
DispatchMessageA
MessageBoxW
LoadCursorA

gdi32

MoveToEx
GetTextExtentPoint32W
LineTo
SetTextColor
CreateFontA
SetBkColor
SetBkMode
DeleteObject
SelectObject
SetDCPenColor
TextOutW
GetStockObject
CreateSolidBrush

shell32

CommandLineToArgvW

advapi32

RegCreateKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

kernel32

GetLocaleInfoA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapSize
GetStringTypeW
GetStringTypeA
SetEndOfFile
GetProcessHeap
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalFileTimeToFileTime
GetCommandLineW
Process32First
WaitForSingleObject
SetThreadExecutionState
GetModuleFileNameW
GetLastError
GetLongPathNameW
Process32Next
CreateMutexA
CreateToolhelp32Snapshot
GetShortPathNameW
ReleaseMutex
GetVersionExA
CloseHandle
GetCurrentProcessId
CreateThread
FormatMessageW
Sleep
CreateFileW
DeviceIoControl
GetFileInformationByHandle
FlushFileBuffers
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetCurrentProcess
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
ReadFile
DosDateTimeToFileTime
DeleteFileW
GetTimeZoneInformation
GetModuleHandleW
GetProcAddress
ExitProcess
HeapReAlloc
HeapAlloc
HeapFree
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WideCharToMultiByte
WriteFile
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
GetStdHandle
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
MultiByteToWideChar
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
LCMapStringA
LCMapStringW

Exports

Exports

AddArrayString
CallShowStatus
ColorizeItem
DeleteItemTree
FragmentCount
GetItemLcn
GetLongPath
GetShortPath
IsFragmented
MatchMask
RunJkDefrag
ShowDiskmap
ShowHex
SlowDown
StopJkDefrag
SystemErrorStr
TreeBiggest
TreeDetach
TreeFirst
TreeInsert
TreeNext
TreeNextPrev
TreePrev
TreeSmallest
stristr
stristrW

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 599KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Programs/JkDefragCmd.exe
.exe windows:5 windows x86 arch:x86

d72dfec31d076dd1c2c13dc92af6e6f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges

kernel32

CloseHandle
Process32Next
Process32First
GetCurrentProcessId
GetLastError
CreateToolhelp32Snapshot
GetVersionExA
SetConsoleCtrlHandler
GetModuleFileNameW
FormatMessageW
Sleep
CreateFileW
DeviceIoControl
GetFileInformationByHandle
FlushFileBuffers
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetCurrentProcess
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
ReadFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
HeapReAlloc
HeapAlloc
GetTimeZoneInformation
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
WriteFile
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleW
GetProcAddress
ExitProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleHandleA
HeapCreate
VirtualFree
VirtualAlloc
GetModuleFileNameA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
SetEndOfFile
GetProcessHeap
HeapSize
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

AddArrayString
CallShowStatus
ColorizeItem
DeleteItemTree
FragmentCount
GetItemLcn
GetLongPath
GetShortPath
IsFragmented
MatchMask
RunJkDefrag
ShowDiskmap
ShowHex
SlowDown
StopJkDefrag
SystemErrorStr
TreeBiggest
TreeDetach
TreeFirst
TreeInsert
TreeNext
TreeNextPrev
TreePrev
TreeSmallest
stristr
stristrW

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Programs/JkDefragScreenSaver.exe
.exe windows:5 windows x86 arch:x86

105af1cbf212f8054524a559bfb28966

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharNextA
LoadIconA
GetSystemMetrics
FindWindowA
SetForegroundWindow
RegisterWindowMessageA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetForegroundWindow
PeekMessageA
SendMessageA
DialogBoxParamA
GetParent
IsWindow
PostMessageA
DefWindowProcA
SetCursor
PostQuitMessage
GetCursorPos
SystemParametersInfoA
SetTimer
FillRect
GetClientRect
GetWindowTextLengthA
GetDC
ReleaseDC
GetDlgItem
EndDialog
LoadStringW
SendMessageW

gdi32

TextOutW
GetClipBox
MoveToEx
LineTo
SetTextColor
CreateFontA
SetBkColor
SetBkMode
DeleteObject
SelectObject
SetDCPenColor
GetStockObject
CreateSolidBrush

shell32

CommandLineToArgvW

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
RegCreateKeyExW
AdjustTokenPrivileges
RegSetValueExW
RegCloseKey
RegQueryValueExW

comctl32

InitCommonControlsEx

powrprof

CallNtPowerInformation

kernel32

LCMapStringW
LCMapStringA
VirtualQuery
QueryPerformanceCounter
GetStringTypeA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
HeapSize
GetLocaleInfoA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEndOfFile
GetProcessHeap
CreateFileA
GetExitCodeProcess
CreateProcessW
GetFileAttributesW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetFileType
GetVolumePathNameW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
FindFirstFileW
FreeLibrary
Process32First
WaitForSingleObject
SetThreadExecutionState
LoadLibraryW
Sleep
GetModuleFileNameW
GetLastError
GetLongPathNameW
FindClose
Process32Next
CreateMutexA
FindNextFileW
CreateToolhelp32Snapshot
GetShortPathNameW
ReleaseMutex
GetVersionExA
CloseHandle
GetCurrentProcessId
CreateThread
FormatMessageW
CreateFileW
DeviceIoControl
GetFileInformationByHandle
FlushFileBuffers
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExW
GetVolumeNameForVolumeMountPointW
GetCurrentProcess
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
ReadFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetTickCount
GetSystemPowerStatus
UnhandledExceptionFilter
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapFree
HeapAlloc
DeleteFileW
GetTimeZoneInformation
GetModuleHandleW
HeapReAlloc
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode

Exports

Exports

AddArrayString
CallShowStatus
ColorizeItem
DeleteItemTree
FragmentCount
GetItemLcn
GetLongPath
GetShortPath
IsFragmented
MatchMask
RunJkDefrag
ShowDiskmap
ShowHex
SlowDown
StopJkDefrag
SystemErrorStr
TreeBiggest
TreeDetach
TreeFirst
TreeInsert
TreeNext
TreeNextPrev
TreePrev
TreeSmallest
stristr
stristrW

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Programs/JkDefragScreenSaver.scr
.exe windows:5 windows x86 arch:x86

12801de287126a6b34e2da85cbbe86b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

CommandLineToArgvW

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW

kernel32

FreeEnvironmentStringsA
GetCommandLineW
GetModuleFileNameW
GetLongPathNameW
GetShortPathNameW
HeapAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessW
GetFileAttributesW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
SetEnvironmentVariableW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Programs/JkHistory.txt
ReadMeFirst.txt
Sounds/finished.wav

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.0MB

UPX1 Size: 246KB - Virtual size: 248KB

.rsrc Size: 619KB - Virtual size: 620KB

ead96d400dfee134a61c6cea43fb45d3

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

shell32

advapi32

kernel32

Exports

Exports

Sections

.text Size: 133KB - Virtual size: 133KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 5KB - Virtual size: 599KB

.rsrc Size: 40KB - Virtual size: 39KB

d72dfec31d076dd1c2c13dc92af6e6f5

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 129KB - Virtual size: 129KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 11KB - Virtual size: 19KB

.rsrc Size: 40KB - Virtual size: 39KB

105af1cbf212f8054524a559bfb28966

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

shell32

advapi32

comctl32

powrprof

kernel32

Exports

Exports

Sections

.text Size: 147KB - Virtual size: 147KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 5KB - Virtual size: 600KB

.rsrc Size: 39KB - Virtual size: 38KB

12801de287126a6b34e2da85cbbe86b5

Headers

DLL Characteristics

File Characteristics

Imports

shell32

advapi32

kernel32

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 39KB - Virtual size: 38KB

UPX0
Size: - Virtual size: 1.0MB

UPX1
Size: 246KB - Virtual size: 248KB

.rsrc
Size: 619KB - Virtual size: 620KB

.text
Size: 133KB - Virtual size: 133KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 5KB - Virtual size: 599KB

.rsrc
Size: 40KB - Virtual size: 39KB

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 11KB - Virtual size: 19KB

.rsrc
Size: 40KB - Virtual size: 39KB

.text
Size: 147KB - Virtual size: 147KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 5KB - Virtual size: 600KB

.rsrc
Size: 39KB - Virtual size: 38KB

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 39KB - Virtual size: 38KB