Jinshan_x64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Jinshan_x64.exe
Size 13.2MB
Sample260819-e85lasdn9w
SHA256 459919673f8284b9888dcd2663187920cddb59cdc8fcdb95733dbb7f4676e35f
MD5 3008ccf1a125b55bcba760e62a9113a3
SHA1 ee7e7db7c1b68d709160c2035be7ec80c5d3a870
SHA512 45b61ccdeabc74603673062480c23dff08837f7889ca2583db6206ca79e60261bc610a8842d6a044e3deb674c838e320ee2be1a4c17546a382391687c1c3e511
SSDEEP 196608:BewU1GC4Ghz3gie0ouOvnEJwR1z/0J1H0s+CwdAXpaay3nA6MzqQokCu9fK0w2O:uD43ie04C0l2llLXpdIZMuQokCwfK9
TLSH
T1F3D6338B0BCE8C00CDF6F974C7D908BCF6AEF8EA41058D54271A29569FEC5FA9039552
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
Jinshan_x64.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

Jinshan_x64.exe

.exe 13.2MB
$PLUGINSDIR/$R6

1.6MB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/nsExec.dll

.dll 6KB

Jinshan_x64.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 459919673f8284b9888dcd2663187920cddb59cdc8fcdb95733dbb7f4676e35f
MD5 3008ccf1a125b55bcba760e62a9113a3
SHA1 ee7e7db7c1b68d709160c2035be7ec80c5d3a870
SHA512 45b61ccdeabc74603673062480c23dff08837f7889ca2583db6206ca79e60261bc610a8842d6a044e3deb674c838e320ee2be1a4c17546a382391687c1c3e511
SSDEEP 196608:BewU1GC4Ghz3gie0ouOvnEJwR1z/0J1H0s+CwdAXpaay3nA6MzqQokCu9fK0w2O:uD43ie04C0l2llLXpdIZMuQokCwfK9
TLSH
T1F3D6338B0BCE8C00CDF6F974C7D908BCF6AEF8EA41058D54271A29569FEC5FA9039552
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
MD5 09c2e27c626d6f33018b8a34d3d98cb6
SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
TLSH
T136D1D63B6AD029F3D0498930286779368BF988360F614210EFAB19E535E5DEBDA20647
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Jinshan_x64.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/$R6

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic