jq-windows-amd64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
jq-windows-amd64.exe
Size 1011KB
Sample260818-pmqkcstthy
SHA256 a6fc67fedaf9128a3309a1e2ebb8b986aeccf70122ee46d2cb4849e423f0c627
MD5 55867572f8d52382d5f4d9dd57b1ec81
SHA1 a51b3c3eba0b2123c0a5dcd125dd01fa5bf46f7f
SHA512 f4e9e7d37b2f490ac796344fc95f797a04e313cfef627c3e32550143b8820b8e3aee857bd10f820fab06bbc556111e12c1cbc066e5beb24408eb41ab2cc1dab1
SSDEEP 24576:iFUBAloIgP4Vp9Dg2iE92YmbFpqYLfEIrolQxU:iFUeotPup9E2i06pn
TLSH
T19B250807FA93D2A8C1AEE570C851C3F5A931FC5446108E1B2794BE377D73B205EAE668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jq-windows-amd64.exe

File Explorer

jq-windows-amd64.exe

.exe 1011KB

jq-windows-amd64.exe

IMPHASH b296b398ac5e3ef6f043d6f9b02cb313
SHA256 a6fc67fedaf9128a3309a1e2ebb8b986aeccf70122ee46d2cb4849e423f0c627
MD5 55867572f8d52382d5f4d9dd57b1ec81
SHA1 a51b3c3eba0b2123c0a5dcd125dd01fa5bf46f7f
SHA512 f4e9e7d37b2f490ac796344fc95f797a04e313cfef627c3e32550143b8820b8e3aee857bd10f820fab06bbc556111e12c1cbc066e5beb24408eb41ab2cc1dab1
SSDEEP 24576:iFUBAloIgP4Vp9Dg2iE92YmbFpqYLfEIrolQxU:iFUeotPup9E2i06pn
TLSH
T19B250807FA93D2A8C1AEE570C851C3F5A931FC5446108E1B2794BE377D73B205EAE668
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection GetCPInfo GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStdHandle GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread SetConsoleMode SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbsrtowcs strtol wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _fullpath _lock_file _stat64 _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen _j1 _jn _j0 _y1 _y0 _yn acos acosh asin asinh atan atan2 atanh cbrt ceil cos cosh erf erfc exp exp2 expm1 fdim floor fma fmax fmin fmod frexp hypot log log10 log1p log2 logb modf nearbyint nextafter pow remainder round sin sinh sqrt tan tanh tgamma trunc

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _assert _beginthreadex _cexit _configure_wide_argv _crt_atexit _endthreadex _errno _exit _getpid _seh_filter_exe _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler _wassert abort exit perror raise strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _close _fileno _get_osfhandle _isatty _open _read _setmode _wfopen _write clearerr fclose feof ferror fflush fgets fputc fputs fread fwrite getc putchar puts setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _strnicmp isalnum isalpha isspace memset strcmp strcpy strlen strncmp strnlen strspn wcslen wcsnlen

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _gmtime64 _localtime64 _localtime64_s _mkgmtime64 _mktime64 _time64 _tzset strftime

api-ms-win-crt-utility-l1-1-0

qsort rand_s

shlwapi

PathIsRelativeA

Name

.text

Size

564KB

Virtual Size

564KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

378KB

Virtual Size

378KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jq-windows-amd64.exe

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

shlwapi

generic