JJSploit[.]exe

Resubmissions

21-09-2024 17:05

240921-vlz1astbna 3

21-09-2024 16:59

240921-vhqx8atcnp 3

21-09-2024 16:41

240921-t7bddssdje 3

21-09-2024 12:11

240921-pclhna1hpn 3

Sharing

Copy URL

Twitter E-mail

General

Target

JJSploit.exe
Size

10.5MB
MD5

7b4a51d94f2d3c22a523b251692795d7
SHA1

471e6ef7fa91437bd77fbfc4fbce5bb09b5db55d
SHA256

d3f39b70276fdc06a4e355218f3cf9239fdcea1c6881bc045812306982218c8a
SHA512

29ed0f0d3860eec3798cb7b9799651d1991c4f29e220f654032a8f0f2e5c98349c3982d78545f7675724f735ada3c78efa2336dce72cc456bbe9e34135eea8c6
SSDEEP

98304:UjBtBqSt4iQx6mxy8PscJCo5m+mGs0ITIECQa99bUHpV3iYgf79N:SDsSt4iQx62Pc+Gw9bUCYQP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JJSploit.exe

Files

JJSploit.exe
.exe windows:6 windows x64 arch:x64

acac435b76aba8f18d55dbc5e53b424a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wearedevs_net.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

ntdll

NtWriteFile
NtReadFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
RtlPcToFileHeader
RtlGetVersion
NtQuerySystemInformation
RtlUnwindEx
NtQueryInformationProcess

user32

RegisterRawInputDevices
MsgWaitForMultipleObjectsEx
SetWindowLongPtrW
SetWindowPlacement
ChangeDisplaySettingsExW
SetCapture
MapVirtualKeyW
GetUpdateRect
ValidateRect
GetKeyboardState
SetCursor
LoadCursorW
GetMonitorInfoW
MonitorFromWindow
DispatchMessageA
GetAsyncKeyState
GetMessageA
GetDC
RegisterWindowMessageA
ToUnicodeEx
GetKeyboardLayout
SetForegroundWindow
RegisterClassExW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
GetKeyState
SystemParametersInfoA
MapVirtualKeyExW
VkKeyScanW
IsWindowVisible
AdjustWindowRectEx
GetWindowRect
MonitorFromPoint
EnumDisplayMonitors
DestroyIcon
IsProcessDPIAware
EnumChildWindows
SendMessageW
DestroyAcceleratorTable
CreateIcon
CloseTouchInputHandle
GetRawInputData
PostQuitMessage
ShowWindow
SendInput
GetSystemMenu
EnableMenuItem
AppendMenuW
SetWindowLongW
TrackMouseEvent
MonitorFromRect
GetWindowLongW
ScreenToClient
CreateMenu
FlashWindowEx
DefWindowProcW
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
GetWindowPlacement
SetMenuItemInfoW
GetForegroundWindow
CheckMenuItem
CreateAcceleratorTableW
GetWindowLongPtrW
SetWindowDisplayAffinity
GetMenu
RegisterTouchWindow
GetSystemMetrics
IsWindow
CreateWindowExW
ShowCursor
SetCursorPos
InvalidateRgn
SetWindowPos
GetClientRect
ClientToScreen
ReleaseCapture
GetCursorPos
IsIconic
GetActiveWindow
SetMenu
RedrawWindow
ClipCursor
GetClipCursor
PostMessageW
DestroyWindow
GetTouchInputInfo

kernel32

DeleteCriticalSection
LocalFree
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
FreeLibrary
GetModuleFileNameW
SetThreadErrorMode
EncodePointer
SetFileCompletionNotificationModes
lstrlenW
SetFileTime
GetProcessIoCounters
RaiseException
LoadLibraryA
IsProcessorFeaturePresent
Sleep
WaitForSingleObject
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetUserDefaultUILanguage
LCIDToLocaleName
GetModuleHandleA
LoadLibraryW
InitializeSListHead
GetSystemTimeAsFileTime
GetOverlappedResult
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandle
SetHandleInformation
GetConsoleMode
SetFileAttributesW
MoveFileExW
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
ReadFile
DuplicateHandle
CloseHandle
GetCurrentThreadId
GetModuleHandleW
GetSystemInfo
VirtualQueryEx
GetCurrentProcess
LoadLibraryExW
GetLastError
GetProcAddress
SetThreadStackGuarantee
ReadProcessMemory
GetCurrentThread
InitializeCriticalSectionAndSpinCount
PostQueuedCompletionStatus
SwitchToThread
CreateMutexA
WaitForSingleObjectEx
GetTempPathW
CreateThread
WideCharToMultiByte
WriteConsoleW
CreateIoCompletionPort
TlsAlloc
TlsGetValue
MultiByteToWideChar
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
GetFullPathNameW
WaitForMultipleObjects
ReadFileEx
CreateNamedPipeW
ExitProcess
SetEnvironmentVariableW
CreateWaitableTimerExW
GetFileAttributesW
OutputDebugStringA
OutputDebugStringW
GetSystemTimes
CancelIo
CreateEventW
OpenProcess
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetFinalPathNameByHandleW
CreateHardLinkW
CreateSymbolicLinkW
DeleteFileW
FindFirstFileW
GetProcessHeap
TlsSetValue
CreateDirectoryW
TlsFree
CreateFileW
GetCurrentProcessId
GetFileInformationByHandleEx
GetExitCodeProcess
GetProcessTimes
GetDiskFreeSpaceExW
GetLogicalDrives
FindClose
GlobalMemoryStatusEx
GetTickCount64
FindNextFileW
ReleaseMutex
HeapReAlloc
GetSystemTimePreciseAsFileTime
QueryPerformanceFrequency
TerminateProcess
SleepEx
WriteFileEx
GetStdHandle
SetWaitableTimer
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
QueryPerformanceCounter
GetQueuedCompletionStatusEx

gdi32

DeleteObject
CreateRectRgn
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CoTaskMemFree
CoSetProxyBlanket
CreateStreamOnHGlobal
OleInitialize
RegisterDragDrop
RevokeDragDrop
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc

shell32

CommandLineToArgvW
SHGetKnownFolderPath
SHCreateItemFromParsingName
DragFinish
SHAppBarMessage
DragQueryFileW
ShellExecuteW

comctl32

TaskDialogIndirect
SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass

pdh

PdhGetFormattedCounterValue
PdhCloseQuery
PdhCollectQueryData
PdhAddEnglishCounterW
PdhOpenQueryA
PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetPerformanceInfo

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2
GetAdaptersAddresses

advapi32

IsValidSid
GetLengthSid
CopySid
LookupAccountSidW
RegCloseKey
RegOpenKeyExW
OpenProcessToken
RegQueryValueExW
EventRegister
GetTokenInformation
EventSetInformation
EventWriteTransfer
SystemFunction036
EventUnregister
RegGetValueW

oleaut32

VariantClear
SysStringLen
GetErrorInfo
SetErrorInfo
SysAllocString
SysFreeString

netapi32

NetUserEnum
NetUserGetInfo
NetUserGetLocalGroups
NetApiBufferFree

secur32

AcquireCredentialsHandleA
FreeCredentialsHandle
LsaEnumerateLogonSessions
LsaGetLogonSessionData
EncryptMessage
AcceptSecurityContext
FreeContextBuffer
InitializeSecurityContextW
QueryContextAttributesW
DeleteSecurityContext
DecryptMessage
LsaFreeReturnBuffer
ApplyControlToken

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

ws2_32

send
WSASend
WSACleanup
WSAStartup
closesocket
getpeername
freeaddrinfo
shutdown
getsockopt
getaddrinfo
ioctlsocket
connect
setsockopt
WSAIoctl
bind
WSASocketW
getsockname
recv
WSAGetLastError

crypt32

CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertGetCertificateChain
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertFreeCertificateChain

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcsncmp
strcpy_s
wcslen
strlen

api-ms-win-crt-math-l1-1-0

round
trunc
floor
__setusermatherr
pow

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_get_initial_narrow_environment
_initterm
_register_onexit_function
_initterm_e
exit
_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
terminate
__p___argc
abort
_c_exit
_cexit
__p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

acac435b76aba8f18d55dbc5e53b424a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

user32

kernel32

gdi32

dwmapi

ole32

shell32

comctl32

pdh

powrprof

psapi

iphlpapi

advapi32

oleaut32

netapi32

secur32

uxtheme

bcrypt

ws2_32

crypt32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 5.7MB - Virtual size: 5.7MB

.rdata Size: 4.4MB - Virtual size: 4.4MB

.data Size: 13KB - Virtual size: 24KB

.pdata Size: 306KB - Virtual size: 306KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 50KB - Virtual size: 50KB

.text
Size: 5.7MB - Virtual size: 5.7MB

.rdata
Size: 4.4MB - Virtual size: 4.4MB

.data
Size: 13KB - Virtual size: 24KB

.pdata
Size: 306KB - Virtual size: 306KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 50KB - Virtual size: 50KB