JonCut-1.5.0-windows-x64.zip
- SHA256 91a017ea98ca749ddebfe24eda3452cdff47343edd8febf9770da8f52601dffe
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JonCut/JonCut.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
JonCut/JonCut.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
JonCut/WebView2Loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
JonCut/WebView2Loader.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target JonCut-1.5.0-windows-x64.zip
- Size 6.7MB
- Sample261023-appnhsaz8p
- SHA256 91a017ea98ca749ddebfe24eda3452cdff47343edd8febf9770da8f52601dffe
- MD5 737cc72986d847c05b8c6bc20c6c2d1d
- SHA1 190f6b42059400af562b60258951ccc8cdf7a936
- SHA512 4cbbc4070594002fbbb7925e4ba4157140ec145ea5b57530e0955fdb5c420572ce55593274726cbf8e7502637fdedc7d40f5ad2ce9a134461ffb14f47cada329
- SSDEEP 98304:mBuvbUwt0tXZdQH8y5XTCkBj+HG2EHXfkGVLSszENjhVSkWm7rzfe6geLpW+hsG0:mUf0ZZd4N2Ev5LgNjHS9K3e/000AUTw
- TLSH T1106633E94CC0D6AECB06DE49ADFDCA2FD37DB442CAE32D25741651263A0B5F76831A04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/JonCut/JonCut.exe
File Explorer
-
JonCut-1.5.0-windows-x64.zip.zip 6.7MB
-
JonCut/JonCut.exe.exe 11.7MB
-
JonCut/README.txt8KB
-
JonCut/THIRD-PARTY-NOTICES.txt11KB
-
JonCut/WebView2Loader.dll.dll 134KB
JonCut/JonCut.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 43f8251feb401f131bced58820e0a95f727d73765b818a522f626ad5799f1b54
- MD5 2a4ef34aa8107d35bfc9861bb3ca5526
- SHA1 d3670e4fb5f1ee106a005f8d8415a6adf4d5082d
- SHA512 f19775fff1c2f2f36096134e7fe66d3cebb6725e7e53e85cf74ea8c0afe691e69bcd8b30c6769f926b180944b5f6bf68fe07369cf6946b64484a114bc6192e67
- SSDEEP 98304:nskTRSwgfXzc36F7M+YfOl5eEEIvR2nLCkvuwUVeQiPwA/CQjZ:nsKAwUXzc3sfLe9IJ2nZXCeQiPXCQj
- TLSH T18CC69D03E8A105A9C0AAD23486B78253BA71BC495B3263D77F50F3382F77BD069B9754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
492416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
403KB
Virtual Size
747KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
331B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
813KB
Virtual Size
812KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
247KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
558KB
Virtual Size
558KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
JonCut/README.txt
- SHA256 1a7c3f121f10e4aa12728d62deb0ea86013d0b97d04df0cc814f15266b0d4b0b
- MD5 0d8fee85303716e170232ba3f25360f4
- SHA1 098fb078254204f117f23e32871dd74d4bbcb3d3
- SHA512 3019f0d7da5cd50a82bf11aa52ceb781fb1b60f6915f212c458077d179f7c44d72e08a5dfce6b7f8df30ae37938ccc4aec8cd967a7bee5ad4037f6c57bd05885
- SSDEEP 192:eWTuTP+zfmQcDIlTJ8116ZHZfs7+7k3CaEqy1fLiaIY:eWTzLmQ8IlTJ811WZfs7+7oCdfLiaIY
- TLSH T17F12D5AF620B537121711163631E76C6E30D417C2A1E2595FCBF419C3B32A538ABA9F9
- MD5 SHA1 SHA512 SSDEEP TLSH
JonCut/THIRD-PARTY-NOTICES.txt
- SHA256 c17786b42e45ed8c5e70adab5d0a8e91e19ab43706e7226d6f2614cbe74cf42e
- MD5 b26f7b44450c409e0a0245dd7f8834d8
- SHA1 f54e95547cd3f6984c7e0fd13b63dd6802021245
- SHA512 89358c12e97771285c5d7e1d9e178c0d7573b25055db127cb8d35ae7d76c70fa29e7842e3d45b427e70a297eaa5a479f9fbc2305c5f4010361b86d8f0afeef15
- SSDEEP 192:wdDHQHF763rsErsBc1M3b3YgHlW3rsErseJM3b3YgH7W3rsErseJM3b3YgHUBykB:wBY7qrsErsO1ezYgMrsErseJezYgirsC
- TLSH T1C732D61B7F4507B20AD1D241B66AE9C4F11E902D3F6B6944386AD24C237BB2E86FF194
- MD5 SHA1 SHA512 SSDEEP TLSH
JonCut/WebView2Loader.dll
- IMPHASH 3fd78a8f50b85b627af2d0fc485b5e97
- SHA256 c4674acf95f0800793a4a6d61132adf5dfa694c218e482d86093494c4e84100a
- MD5 f9f8ce6ca48034e8dc2502ce95a9f2f0
- SHA1 fd62cb963ef76019e29b5e6cd0dd579469958748
- SHA512 ab4060d81c79b1bae4a540c7a4f163eb65f3149a943f81a242a8a21260a9ccd746a9b2aecb8bcee4bd6ea979ac32a9d0fe04541b34158b611e01d62e7c1b4fcb
- SSDEEP 3072:j1Ua32yCHjjTrxvJ7KP+6hJug3esZTbEtnDzUwsramuLcr:TmyCDj31JGW6fhEt0Ti+
- TLSH T158D35B4B73E5007FE1668274C9A34A0AE776B8511B609B9F03A4436A1F237D1AE3DF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c3:07:aa:ec:6b:6f:5a:97:1a:76:d8:f6:8a:66:f9:77:34:a3:28:9d:37:04:ca:27:7b:58:69:3c:fa:4f:00:91
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 22, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:C4BD-E37F-5FFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:57:44:07:62:dc:6f:e8:be:2a:00:00:00:00:01:57
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
2
Major OS version
5
Entry point
15104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
CloseHandle
CreateEventW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.voltbl
Size
512B
Virtual Size
62B
Characteristics
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ