J4N85nNRvc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
J4N85nNRvc.exe
Size 25.1MB
Sample260730-fd2rlabh98
SHA256 3601459f2e0bf97a143ad513607b8efa5ceec3fcfd10fcefe09296c8e5084dcd
MD5 e76ee9bb42c6994fb62918b54f83f0e5
SHA1 5a5c4284fb494edafd9df2a83d7afde36d77eae2
SHA512 d777e5e6b0a896d8c233a235583a1f5b1b76af96077dc04bc267321d55e347ae063ac3d1547fc6b61f9d97375ea2b00c36b291e832c3d7bed90ead7f44437076
SSDEEP 786432:tf9LKRAO0YV9+NgqTNDM0m+D1Djv9AcBsQPnt/6F7:tfAR30Z5dD1Djv9AcOQM
TLSH
T15B47331B33F3EE79D6E9057A3AEB840221C0B0BDE4DE968D5D8AD8713C94901784E5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
J4N85nNRvc.exe

File Explorer

J4N85nNRvc.exe

.exe 25.1MB

J4N85nNRvc.exe

IMPHASH 4772de99a8d1862e6943a2c99f8a3b82
SHA256 3601459f2e0bf97a143ad513607b8efa5ceec3fcfd10fcefe09296c8e5084dcd
MD5 e76ee9bb42c6994fb62918b54f83f0e5
SHA1 5a5c4284fb494edafd9df2a83d7afde36d77eae2
SHA512 d777e5e6b0a896d8c233a235583a1f5b1b76af96077dc04bc267321d55e347ae063ac3d1547fc6b61f9d97375ea2b00c36b291e832c3d7bed90ead7f44437076
SSDEEP 786432:tf9LKRAO0YV9+NgqTNDM0m+D1Djv9AcBsQPnt/6F7:tfAR30Z5dD1Djv9AcOQM
TLSH
T15B47331B33F3EE79D6E9057A3AEB840221C0B0BDE4DE968D5D8AD8713C94901784E5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60601916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

webview2loader

CreateCoreWebView2EnvironmentWithOptions

ws2_32

listen

crypt32

CertAddCertificateContextToStore

secur32

InitSecurityInterfaceW

dwmapi

DwmSetWindowAttribute

kernel32

SetUnhandledExceptionFilter GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

QueryDisplayConfig

gdi32

CreateSolidBrush

advapi32

CryptGetHashParam

shell32

ShellExecuteExW

ole32

CoCreateInstance

oleaut32

VariantClear

msvcp140

?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

ntdll

RtlInitUnicodeString

iphlpapi

GetAdaptersAddresses

tbs

Tbsip_Submit_Command

bcrypt

BCryptDestroyKey

setupapi

SetupDiEnumDeviceInfo

vcruntime140

memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-stdio-l1-1-0

fseek

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-time-l1-1-0

_gmtime64_s

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-runtime-l1-1-0

__p___argc

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

Virtual Size

18.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

577KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.4|Z

Size

Virtual Size

14.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.JE.

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.oVY

Size

25.1MB

Virtual Size

25.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

J4N85nNRvc.exe

webview2loader

ws2_32

crypt32

secur32

dwmapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

ntdll

iphlpapi

tbs

bcrypt

setupapi

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic