P1AE[.]Javaw[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
P1AE.Javaw.exe
Size 1.1MB
Sample260724-tsrrtshe29
SHA256 0c081736651fafb8eee7bfcdc0d91ac1772c44cc5c467ba9c3b81f316f65a3ea
MD5 b3dc759d68dbf240d13452a36665416d
SHA1 f59919b367c68195ab6b85e1d983b9da471f3e4f
SHA512 30d3784220d6dd01f98a630a2c1adde590c9823b6d858960684110a0e11b6c0d4626e3da4f17ed4be497bcbb48bc528022882691d53f685f95b86db5a6dcfcfa
SSDEEP 12288:mjZCXbEu5vONQiCaNABjuEJeLkLuCRE5YFQAtxAijJ9Dho8RvHhn6iC7o6RhXO:6Qs8aNABJgLuuCR3txAijlTHhn6iuj
TLSH
T15D357D15A3B501EDD57B8077CA8BB913D573704C2BF265EF2BD00A982F26AF14A79B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
P1AE.Javaw.exe

File Explorer

P1AE.Javaw.exe

.exe 1.1MB

P1AE.Javaw.exe

IMPHASH 3ab4751f8f2282d65451cb06a318268d
SHA256 0c081736651fafb8eee7bfcdc0d91ac1772c44cc5c467ba9c3b81f316f65a3ea
MD5 b3dc759d68dbf240d13452a36665416d
SHA1 f59919b367c68195ab6b85e1d983b9da471f3e4f
SHA512 30d3784220d6dd01f98a630a2c1adde590c9823b6d858960684110a0e11b6c0d4626e3da4f17ed4be497bcbb48bc528022882691d53f685f95b86db5a6dcfcfa
SSDEEP 12288:mjZCXbEu5vONQiCaNABjuEJeLkLuCRE5YFQAtxAijJ9Dho8RvHhn6iC7o6RhXO:6Qs8aNABJgLuuCR3txAijlTHhn6iuj
TLSH
T15D357D15A3B501EDD57B8077CA8BB913D573704C2BF265EF2BD00A982F26AF14A79B10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

531624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glViewport glClear

dwmapi

DwmSetWindowAttribute

shell32

ShellExecuteA DragQueryFileW DragQueryPoint DragFinish DragAcceptFiles ShellExecuteW

advapi32

QueryServiceStatus OpenServiceA OpenSCManagerA CloseServiceHandle FreeSid AllocateAndInitializeSid CheckTokenMembership

kernel32

Process32NextW K32GetProcessMemoryInfo GetSystemInfo VirtualQueryEx ReadProcessMemory GetModuleHandleA GetProcAddress Sleep GetStartupInfoW GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetThreadExecutionState MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree VerSetConditionMask GetLastError GetModuleHandleExW FormatMessageW WideCharToMultiByte FreeLibrary LoadLibraryA OutputDebugStringA GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW Process32FirstW GetTimeZoneInformation GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId SetUnhandledExceptionFilter GetCPInfo GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx AreFileApisANSI GetFullPathNameW CreateToolhelp32Snapshot FileTimeToSystemTime SystemTimeToTzSpecificLocalTime OpenProcess GetProcessTimes CloseHandle GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile VirtualProtect RtlUnwind FormatMessageA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread LocalFree GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW

user32

EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode UnregisterClassW UnregisterDeviceNotification RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW DestroyIcon LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect OffsetRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW RemovePropW GetPropW SetPropW ReleaseDC GetRawInputDeviceList SetForegroundWindow GetMessageExtraInfo MsgWaitForMultipleObjects ReleaseCapture SetCapture MapVirtualKeyW GetKeyState GetActiveWindow SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed BringWindowToTop IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos MoveWindow FlashWindow SetLayeredWindowAttributes GetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW WaitMessage PostMessageW SendMessageW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent SetWindowRgn GetRawInputDeviceInfoA CallWindowProcW SetPropA GetPropA GetWindowLongPtrW SetWindowLongPtrW GetDC GetSystemMetrics

gdi32

ChoosePixelFormat SetDeviceGammaRamp DescribePixelFormat GetDeviceCaps SetPixelFormat CreateRoundRectRgn SwapBuffers CreateDIBSection DeleteObject CreateRectRgn CreateBitmap GetDeviceGammaRamp DeleteDC CreateDCW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

720KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

P1AE.Javaw.exe

opengl32

dwmapi

shell32

advapi32

kernel32

user32

gdi32

imm32

generic