9594e32c5c85245d042911d5b8befc9aaf030af41928de4f8c998aec76ad4677[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

9594e32c5c85245d042911d5b8befc9aaf030af41928de4f8c998aec76ad4677.exe
Size

2.5MB
MD5

4fa5eba03acf872fca20c57cd3bcfae9
SHA1

1a97877d8337cdd4caf87d3100f2725ddae75fc3
SHA256

9594e32c5c85245d042911d5b8befc9aaf030af41928de4f8c998aec76ad4677
SHA512

169221af644a0d98580c9bbf720923efb7454834e7c75462b044e7d1b7f604afc692057fd74ca995e1136b3bc9cfd0a2b55a9973befe1b62566533fcd494e1fe
SSDEEP

49152:sYca3eYR0SDvM543jRaDd5wUgyPQrPAaPdjdtdwCJeYBnJ0Rv0C:sYnvvM54TRaXvguOAydtdwkeY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9594e32c5c85245d042911d5b8befc9aaf030af41928de4f8c998aec76ad4677.exe

Files

9594e32c5c85245d042911d5b8befc9aaf030af41928de4f8c998aec76ad4677.exe
.exe windows:5 windows x86 arch:x86

34f28cdb341b12279153c8295a930b47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\xwork_vs2015\JJDownLoader\Bin\JJDownLoader_a.pdb

Imports

kernel32

GetSystemTime
GlobalMemoryStatus
FlushConsoleInputBuffer
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
FreeLibrary
LoadLibraryW
DeleteFileW
WaitForSingleObject
ReadFile
SetFilePointer
SetConsoleMode
CreateProcessW
GetStartupInfoW
CreatePipe
CopyFileW
GetTempPathW
Sleep
WriteFile
CreateFileW
FindClose
FindFirstFileW
FreeResource
GetCommandLineW
SetCurrentDirectoryW
WideCharToMultiByte
GetSystemInfo
GetModuleHandleW
GetProcAddress
GetComputerNameW
GetSystemDirectoryW
WritePrivateProfileStringW
GetTickCount
CreateDirectoryW
GetLocalTime
CloseHandle
GetPrivateProfileStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
GetLastError
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SetEndOfFile
GetFileAttributesExW
WriteConsoleW
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
FlushFileBuffers
SetStdHandle
GetFullPathNameW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetACP
GlobalLock
GlobalUnlock
lstrlenW
GetCurrentDirectoryW
ExitProcess
MulDiv
GetFileSize
LocalFree
FormatMessageW
VerSetConditionMask
GetCurrentProcess
GetFileType
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
lstrcpyW
InitializeCriticalSection
SleepEx
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
SetLastError
FormatMessageA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetStringTypeW
GetTimeZoneInformation
CompareStringW
LCMapStringW

user32

BringWindowToTop
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
SetWindowPos
SetFocus
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
GetClientRect
GetWindowRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
DestroyWindow
IsWindowVisible
IsZoomed
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
ShowWindow
GetCursorPos
CreateCaret
GetCaretBlinkTime
KillTimer
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
SetWindowRgn
LoadIconW
SetCaretPos
MoveWindow
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
HideCaret
ShowCaret
GetCaretPos
ClientToScreen
IsWindowEnabled
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
SetTimer
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetWindowTextW
FindWindowW
IsIconic
PostMessageW
GetDesktopWindow
InvalidateRect
MessageBoxW
GetDC
SetWindowTextW
wsprintfW
UpdateLayeredWindow

gdi32

SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
SelectClipRgn
CreateEnhMetaFileW
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
GetObjectW
GetObjectA
MoveToEx
TextOutW
GdiFlush
GetBitmapBits
SetBitmapBits
CloseEnhMetaFile
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
GetTextExtentPoint32W
SelectObject
GetTextMetricsW
PlayEnhMetaFile
SetTextColor
GetEnhMetaFileHeader
CreateCompatibleBitmap
CreateCompatibleDC
ExtSelectClipRgn
BitBlt

advapi32

DeregisterEventSource
ReportEventA
RegOpenKeyW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegisterEventSourceA

shell32

DragQueryFileW
ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHChangeNotify
SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW

ole32

CoCreateGuid
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoInitialize
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoCreateInstance
CoUninitialize

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW

imagehlp

MakeSureDirectoryPathExists

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

ws2_32

bind
getservbyname
htonl
shutdown
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
gethostbyname
gethostname
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
getsockname
getpeername
connect
closesocket
getsockopt

wldap32

ord27
ord26
ord22
ord41
ord50
ord32
ord33
ord60
ord211
ord46
ord35
ord79
ord30
ord200
ord301
ord143

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCloneBrush
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34f28cdb341b12279153c8295a930b47

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

imagehlp

version

urlmon

ws2_32

wldap32

oleaut32

imm32

comctl32

gdiplus

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 445KB - Virtual size: 445KB

.data Size: 44KB - Virtual size: 58KB

.gfids Size: 512B - Virtual size: 480B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 199KB - Virtual size: 199KB

.reloc Size: 86KB - Virtual size: 85KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 445KB - Virtual size: 445KB

.data
Size: 44KB - Virtual size: 58KB

.gfids
Size: 512B - Virtual size: 480B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 199KB - Virtual size: 199KB

.reloc
Size: 86KB - Virtual size: 85KB