P1AE[.]Javaw (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
P1AE.Javaw (1).exe
Size 2.6MB
Sample260925-tspbps1bjd
SHA256 f20057ba35dd1cbb2750e43b728fdb108a1fd3d93aed4ddff9a7e05c0f26fb76
MD5 e7151ded787520b94f5514fa38d90b6b
SHA1 1c66aa787957bf6e3745270245c5056d5e7c3641
SHA512 2902f40189f13fb39177bdc514b9f37837ae5afc36fcd0d18af58bdbd18ca87c4951378ad7efb37eebe995eaa6358dd5b59d25a5d2e5a0970971c1214d2f1319
SSDEEP 49152:RKseVr2NvcSY8+kGHe+FStcXz5Ln9njbVwj64O7yy5T:wSQYtADVwj64O7yyJ
TLSH
T1D5C55C9673924A9CC17980BDC49F7357A2B1FC880F559BCF2658752D3E33AE815BAB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
P1AE.Javaw (1).exe

File Explorer

P1AE.Javaw (1).exe

.exe 2.6MB

P1AE.Javaw (1).exe

IMPHASH 1f73663a2901951b38bf4ce338c3240d
SHA256 f20057ba35dd1cbb2750e43b728fdb108a1fd3d93aed4ddff9a7e05c0f26fb76
MD5 e7151ded787520b94f5514fa38d90b6b
SHA1 1c66aa787957bf6e3745270245c5056d5e7c3641
SHA512 2902f40189f13fb39177bdc514b9f37837ae5afc36fcd0d18af58bdbd18ca87c4951378ad7efb37eebe995eaa6358dd5b59d25a5d2e5a0970971c1214d2f1319
SSDEEP 49152:RKseVr2NvcSY8+kGHe+FStcXz5Ln9njbVwj64O7yy5T:wSQYtADVwj64O7yyJ
TLSH
T1D5C55C9673924A9CC17980BDC49F7357A2B1FC880F559BCF2658752D3E33AE815BAB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1199092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glViewport glClear

dwmapi

DwmSetWindowAttribute

shell32

DragQueryPoint DragQueryFileW ShellExecuteA ShellExecuteW DragFinish DragAcceptFiles

advapi32

CryptAcquireContextW CryptImportKey CryptDestroyKey CryptReleaseContext RegQueryValueExA RegOpenKeyExA QueryServiceStatus OpenServiceA OpenSCManagerA CloseServiceHandle FreeSid RegCloseKey AllocateAndInitializeSid CheckTokenMembership

ws2_32

getaddrinfo freeaddrinfo WSAStartup WSACleanup __WSAFDIsSet closesocket gethostname WSASend WSAIoctl WSAGetLastError socket shutdown setsockopt send select recv getsockopt ioctlsocket connect

ncrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider NCryptOpenStorageProvider NCryptImportKey NCryptFreeObject BCryptGenRandom BCryptDeriveKeyPBKDF2 BCryptDestroyHash

dnsapi

DnsFree DnsQuery_UTF8

kernel32

GetCurrentProcess GetFileType CreateFileW GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode FlushFileBuffers IsProcessorFeaturePresent ReadFile FreeLibraryAndExitThread ExitThread CreateThread UnhandledExceptionFilter HeapFree HeapAlloc GetModuleFileNameW CloseHandle GetProcessTimes OpenProcess SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo GetEnvironmentVariableA GetSystemInfo VirtualQueryEx ReadProcessMemory GetModuleHandleA GetProcAddress GetFirmwareEnvironmentVariableA Sleep GetStartupInfoW GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetThreadExecutionState MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree VerSetConditionMask GetLastError GetModuleHandleExW FormatMessageW WideCharToMultiByte FreeLibrary LoadLibraryA OutputDebugStringA SetWaitableTimer CreateWaitableTimerW GetVersionExA InitOnceExecuteOnce LocalFree FormatMessageA InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS VerifyVersionInfoW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive TerminateProcess WakeAllConditionVariable GetSystemTimeAsFileTime GetCurrentProcessId FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx SleepConditionVariableSRW TryAcquireSRWLockExclusive RaiseException RtlPcToFileHeader GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFullPathNameW GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx GetSystemTimePreciseAsFileTime GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx HeapReAlloc SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP ExitProcess GetStdHandle RtlCaptureContext RtlVirtualUnwind AcquireSRWLockShared IsDebuggerPresent GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize WaitForSingleObject RtlUnwind

user32

RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW RegisterDeviceNotificationW LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW OffsetRect SetRect ClipCursor UnregisterDeviceNotification UnregisterClassW ToUnicode ChangeDisplaySettingsExW EnumDisplaySettingsW EnumDisplaySettingsExW EnumDisplayDevicesW EnumDisplayMonitors DestroyIcon GetRawInputDeviceInfoA WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetWindowRect GetClientRect GetRawInputDeviceList RemovePropW GetPropW SetPropW ReleaseDC GetDC SetForegroundWindow GetSystemMetrics MsgWaitForMultipleObjects ReleaseCapture SetCapture MapVirtualKeyW GetKeyState GetActiveWindow SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed BringWindowToTop IsIconic IsWindowVisible PtInRect GetWindowPlacement SetWindowPos MoveWindow FlashWindow SetLayeredWindowAttributes GetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW WaitMessage PostMessageW SendMessageW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent SetWindowRgn GetMessageExtraInfo CallWindowProcW SetPropA GetPropA GetWindowLongPtrW SetWindowLongPtrW SetWindowTextW SetWindowPlacement

gdi32

SetPixelFormat DescribePixelFormat ChoosePixelFormat SetDeviceGammaRamp GetDeviceGammaRamp CreateRectRgn GetDeviceCaps DeleteDC CreateRoundRectRgn DeleteObject CreateBitmap SwapBuffers CreateDIBSection CreateDCW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

crypt32

CertSetCertificateContextProperty CertCreateCRLContext CertFreeCRLContext CertCreateCertificateContext CertCloseStore CertAddCertificateContextToStore CertAddCRLContextToStore CryptDecodeObjectEx CryptStringToBinaryA CertFreeCertificateContext CertOpenStore

secur32

DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesA ApplyControlToken DeleteSecurityContext InitializeSecurityContextA FreeCredentialsHandle AcquireCredentialsHandleA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

P1AE.Javaw (1).exe

opengl32

dwmapi

shell32

advapi32

ws2_32

ncrypt

dnsapi

kernel32

user32

gdi32

imm32

crypt32

secur32

generic