25072024_1537_jdconstructnOrder%E2%80%AEfdp[.]zip[.]gz

Sharing

Copy URL Twitter E-mail

General

Target
25072024_1537_jdconstructnOrder%E2%80%AEfdp.zip.gz
Size 78KB
Sample240725-s2jbdaxgnm
SHA256 341a207b9ea09cce9a212455cec88e52ee0fe61d64cfb68f4fd9d979b7ee267c
MD5 b48c919ebc7b71fa1b86c6fcde102477
SHA1 41ff5290a466eb9a645921a2c5025fd14cc4e951
SHA512 17510f0dad338c04e9c2d7ce08506423d6977d694d28b750166149ccf9e8baa02d94cd76fdddf21ef20968eeb9935c2b7d06d6b191ec9c0351303797d50c3bc7
SSDEEP 1536:DqX0QfIue19WOLp4bkrlsoLj6VefwKaLrzI73+ZSVKLmXLQ37+c4dA:DmFe19WOV4gBso3oefuI73+WKLmXLQrB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/jdconstructnOrder‮fdp..exe

File Explorer

25072024_1537_jdconstructnOrder%E2%80%AEfdp.zip.gz

.gz 78KB
jdconstructnOrderâ®fdp.zip

.zip 78KB
jdconstructnOrder‮fdp..exe

.exe 288KB

25072024_1537_jdconstructnOrder%E2%80%AEfdp.zip.gz

SHA256 341a207b9ea09cce9a212455cec88e52ee0fe61d64cfb68f4fd9d979b7ee267c
MD5 b48c919ebc7b71fa1b86c6fcde102477
SHA1 41ff5290a466eb9a645921a2c5025fd14cc4e951
SHA512 17510f0dad338c04e9c2d7ce08506423d6977d694d28b750166149ccf9e8baa02d94cd76fdddf21ef20968eeb9935c2b7d06d6b191ec9c0351303797d50c3bc7
SSDEEP 1536:DqX0QfIue19WOLp4bkrlsoLj6VefwKaLrzI73+ZSVKLmXLQ37+c4dA:DmFe19WOV4gBso3oefuI73+WKLmXLQrB
MD5 SHA1 SHA512 SSDEEP

Password

infected

jdconstructnOrder‮fdp..exe

IMPHASH 5877688b4859ffd051f6be3b8e0cd533
SHA256 8636f8c4fe1fe4859a3feec23a0cecf12391ddbffbb3d2bec5efe8f3aaac74b3
MD5 7e900eb50f9dc1cb5c68ffea4b9e7bcc
SHA1 4dcc14dc2b98fbc171308fb55b5b8551dd96ea96
SHA512 a77aeffc4f80358940e40789a67f67df5adc1bde4790a400665a98871498b10c3206981d3f18efa1149c9ec246f0343d133dd77de4f5a1f5816506a204276b1a
SSDEEP 3072:6q6+ouCpk2mpcWJ0r+QNTBfRuk1qXkXRA4XTZK:6ldk1cWQRNTBpd8t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW