Jitter[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Jitter.exe
Size 12.2MB
Sample260628-evy7csfs2n
SHA256 451544c00916dbbb817e7f3f5e0ffb99181a70bbf561ea524ca4e066e31624e8
MD5 b720233189fd6dad1d4c95718451dea5
SHA1 62e8e5f8f7972f8c5fc137fce7abe529f27cdb70
SHA512 c1068ab561805fee28fbb96d9e7652a121acc7cb7cc9a1c29d6c8d775a75e2842b88942ce4c76c638d3abfb1442fbd10c3398c03ff93d8788468c7cf027824b9
SSDEEP 98304:KngetWBt/OHB0XTCmHW540OcYISCY6OkgFvfkHU09mlP:H/OHBSTCmHhiYIhY6N000
TLSH
T153D68D19B7A680E6D45A8134CD9BD74AE772BC044B3187EB32D173AE6E337D02E76610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Jitter.exe

File Explorer

Jitter.exe

.exe 12.2MB

Jitter.exe

IMPHASH 8c108560511ecde47617991c82965878
SHA256 451544c00916dbbb817e7f3f5e0ffb99181a70bbf561ea524ca4e066e31624e8
MD5 b720233189fd6dad1d4c95718451dea5
SHA1 62e8e5f8f7972f8c5fc137fce7abe529f27cdb70
SHA512 c1068ab561805fee28fbb96d9e7652a121acc7cb7cc9a1c29d6c8d775a75e2842b88942ce4c76c638d3abfb1442fbd10c3398c03ff93d8788468c7cf027824b9
SSDEEP 98304:KngetWBt/OHB0XTCmHW540OcYISCY6OkgFvfkHU09mlP:H/OHBSTCmHhiYIhY6N000
TLSH
T153D68D19B7A680E6D45A8134CD9BD74AE772BC044B3187EB32D173AE6E337D02E76610
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6067712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW K32GetProcessMemoryInfo CreateDirectoryW GetTempPathW GetFinalPathNameByHandleW ContinueDebugEvent WaitForDebugEvent DebugActiveProcess DebugActiveProcessStop GetTickCount64 FreeLibrary LoadLibraryExW DebugSetProcessKillOnExit DebugBreakProcess Heap32ListFirst Heap32ListNext Heap32First Heap32Next WriteFile GetModuleFileNameW GetModuleHandleExW LoadLibraryW GetModuleFileNameA DeleteFileA LockFileEx SetEvent CreateEventA OpenEventA MoveFileExA GetCurrentProcessId LocalFree GetComputerNameA GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryA AttachConsole FindFirstFileA FindNextFileA GetFileAttributesA GetEnvironmentVariableA FlushFileBuffers GetFileType SetFilePointer SetFilePointerEx SetErrorMode GetStdHandle OutputDebugStringW GetConsoleMode WriteConsoleW GetCurrentThreadId GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection ReleaseSemaphore WaitForSingleObjectEx CreateSemaphoreW GetCurrentProcess ExitProcess GetSystemInfo RaiseException AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateThread GetCurrentThread SetThreadPriority SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetLocaleInfoW SetThreadExecutionState QueryPerformanceCounter QueryPerformanceFrequency CreateEventW GetTickCount IsWow64Process EnumResourceNamesW HeapFree GetProcessHeap VerSetConditionMask GetOverlappedResult CancelIo ResetEvent FormatMessageW VerifyVersionInfoW GetCommandLineW HeapAlloc WaitForMultipleObjects GetFileTime OpenProcess TlsGetValue TlsSetValue TlsFree FindFirstFileExW GetFileAttributesExW GetLogicalDrives RemoveDirectoryW GetActiveProcessorCount MoveFileExW DuplicateHandle SetHandleInformation CreatePipe SetNamedPipeHandleState GenerateConsoleCtrlEvent MulDiv GlobalSize CompareStringA GetSystemPowerStatus GetLocaleInfoA GetFileAttributesW GetFileInformationByHandle VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapSize SetEnvironmentVariableW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext ReadConsoleW GetConsoleOutputCP SetStdHandle SetEndOfFile SetConsoleCtrlHandler TzSpecificLocalTimeToSystemTime SetFileTime FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable WakeConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime GetThreadTimes FlushInstructionCache SetThreadContext GetThreadContext GetProcessIdOfThread CreateProcessW ResumeThread SuspendThread GetExitCodeThread TerminateThread RtlUnwind OpenThread CreateRemoteThread GetExitCodeProcess TerminateProcess GetProcessTimes CreateToolhelp32Snapshot QueryThreadCycleTime GetProcAddress GetModuleHandleW VirtualFreeEx WriteProcessMemory ReadProcessMemory VirtualQueryEx VirtualProtectEx VirtualAllocEx GetSystemTimeAsFileTime CopyFileExW GlobalMemoryStatusEx Sleep WaitForSingleObject ReadFile GetFileSizeEx FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCurrentDirectoryW WideCharToMultiByte GetTempPathA SetConsoleTitleA IsProcessorFeaturePresent FormatMessageA DeviceIoControl GetLastError CloseHandle CreateFileA TlsAlloc MultiByteToWideChar

user32

SetCursorPos ReleaseCapture SetCapture EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode GetKeyboardState GetKeyboardLayout SetWindowRgn IsClipboardFormatAvailable EnumClipboardFormats RegisterClipboardFormatW GetClipboardSequenceNumber SystemParametersInfoW SystemParametersInfoA DrawTextW SetFocus GetDlgItem GetWindowTextA EnumWindows GetClassNameA EndDialog DialogBoxIndirectParamW GetDesktopWindow PostThreadMessageW GetMessageW RegisterRawInputDevices GetRawInputData LoadCursorW CreateIconIndirect SetPropW ReleaseDC RegisterClassW GetWindowThreadProcessId GetActiveWindow MessageBoxA OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard ShowWindow GetWindowLongW SetWindowLongW GetDoubleClickTime DestroyCursor CreateIconFromResourceEx RegisterWindowMessageA TrackMouseEvent TranslateMessage DispatchMessageW SetWindowLongPtrW GetWindowLongPtrW SetForegroundWindow SetMenuItemInfoW GetMenuItemInfoW DeleteMenu InsertMenuW EnableMenuItem CheckMenuItem DestroyMenu CreatePopupMenu CreateWindowExW AttachThreadInput SetLayeredWindowAttributes GetQueueStatus CreateIconFromResource UnhookWindowsHookEx SetWindowsHookExW SetParent PtInRect IntersectRect ClipCursor GetClipCursor GetWindowTextLengthW GetWindowTextW SetWindowTextW RemovePropW SetActiveWindow EnableWindow GetFocus GetClipboardFormatNameA IsWindow FlashWindowEx RegisterWindowMessageW DestroyWindow CreateWindowExA PeekMessageW GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW SetWindowPos GetWindowPlacement IsIconic IsZoomed GetKeyState GetAsyncKeyState MapVirtualKeyW MsgWaitForMultipleObjects SetTimer KillTimer GetSystemMetrics GetMenu GetForegroundWindow GetDC BeginPaint EndPaint GetUpdateRect ValidateRect GetPropW GetClientRect GetWindowRect AdjustWindowRectEx SetCursor GetCursorPos RegisterClassExA UnregisterClassA UnregisterDeviceNotification RegisterDeviceNotificationW GetMessageA GetRawInputDeviceList GetRawInputBuffer GetRawInputDeviceInfoA GetMonitorInfoW MonitorFromWindow MonitorFromPoint DestroyIcon LoadIconW CallNextHookEx SetRectEmpty FillRect ScreenToClient ClientToScreen TrackPopupMenu

gdi32

CombineRgn CreateRectRgn CreateCompatibleBitmap SwapBuffers GetDIBits GetPixelFormat GetICMProfileW BitBlt SetPixelFormat DescribePixelFormat ChoosePixelFormat GetTextMetricsW GetTextExtentPoint32A GetDeviceCaps CreateFontIndirectW CreateDIBSection SetPixel SelectObject DeleteDC CreateCompatibleDC CreateBitmap CreateDCW CreateSolidBrush DeleteObject

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetIMEFileNameA ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmGetCompositionFontW ImmNotifyIME ImmGetContext

ole32

ReleaseStgMedium CoCreateInstance CoInitializeEx CoUninitialize OleUninitialize OleInitialize CoTaskMemFree CLSIDFromString PropVariantClear RevokeDragDrop RegisterDragDrop

oleaut32

SysFreeString

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

advapi32

CryptReleaseContext RegCreateKeyExW RegOpenKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam RegCloseKey CryptAcquireContextW RegSetValueExW RegQueryValueExW

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyW CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA

shell32

ShellExecuteA SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW DragQueryFileW DragFinish Shell_NotifyIconW CommandLineToArgvW SHGetFolderPathW DragAcceptFiles

comdlg32

GetSaveFileNameW GetOpenFileNameW

dbghelp

SymCleanup SymSetOptions SymInitializeW SymLoadModuleExW SymEnumSymbols StackWalk64 SymFromAddr SymInitialize SymGetModuleBase64 SymFunctionTableAccess64

winhttp

WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSendRequest WinHttpSetTimeouts WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

142KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

234KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Jitter.exe

kernel32

user32

gdi32

winmm

imm32

ole32

oleaut32

version

advapi32

setupapi

shell32

comdlg32

dbghelp

winhttp

generic