Jeva[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Jeva.exe
Size 43.6MB
Sample261023-e1kadsby7l
SHA256 db0b506f3f274a9b63ed83fe9a8df57d0f73fdb24e0ae8590053ae02c23c1856
MD5 8205335edcd44a360225117105564ce5
SHA1 269104f613c9c340ec5fcfd66a2241105c6c23b9
SHA512 90b5b12821cef7db28373999983cdce0818080ea9d289a8ec334bfb510835421f7e102a2747dc51ec737bd76502cfd2ae7117690397dd1e2b969618521d919c4
SSDEEP 786432:MHJnQcVSXzgC05kSTUQL++EzOBI9Fmfz+cNTHmsPv4Lbu6QPXoxH:MuOIgC0JTUJrOBLdNbALK12
TLSH
T1F3A7BE107E5B99A9D19BC470834A8AA71D6130DB0B36B9FF44C496383F79BF46F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Jeva.exe

File Explorer

Jeva.exe

.exe 43.6MB

Jeva.exe

IMPHASH df238a23e046344b4b267c2a9bda256b
SHA256 db0b506f3f274a9b63ed83fe9a8df57d0f73fdb24e0ae8590053ae02c23c1856
MD5 8205335edcd44a360225117105564ce5
SHA1 269104f613c9c340ec5fcfd66a2241105c6c23b9
SHA512 90b5b12821cef7db28373999983cdce0818080ea9d289a8ec334bfb510835421f7e102a2747dc51ec737bd76502cfd2ae7117690397dd1e2b969618521d919c4
SSDEEP 786432:MHJnQcVSXzgC05kSTUQL++EzOBI9Fmfz+cNTHmsPv4Lbu6QPXoxH:MuOIgC0JTUJrOBLdNbALK12
TLSH
T1F3A7BE107E5B99A9D19BC470834A8AA71D6130DB0B36B9FF44C496383F79BF46F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12858928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

jeva.pdb

bcryptprimitives

ProcessPrng

kernel32

RtlPcToFileHeader GetConsoleMode WriteFileEx GetConsoleOutputCP ReadFileEx IsDebuggerPresent GetSystemTimeAsFileTime CancelIo SleepConditionVariableSRW SetFileCompletionNotificationModes WriteConsoleW GetStdHandle TerminateProcess CreateMutexW RaiseException GetCurrentThreadId CreateThread ReleaseMutex GetModuleHandleW SetNamedPipeHandleState LCIDToLocaleName GetUserDefaultUILanguage lstrlenW SetEvent LoadLibraryW WaitForMultipleObjectsEx CreateEventW LoadLibraryA EncodePointer TlsAlloc TlsGetValue TlsSetValue SwitchToThread GetSystemInfo CreateFileW CompareStringOrdinal SleepEx SetLastError GetFullPathNameW GetCurrentProcess DuplicateHandle QueryPerformanceCounter WaitForSingleObject IsProcessorFeaturePresent SetHandleInformation RtlLookupFunctionEntry SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WaitForMultipleObjects GetExitCodeProcess CreateDirectoryW SetThreadStackGuarantee GetCurrentThread RemoveDirectoryW FindFirstFileExW ExitProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA GetFinalPathNameByHandleW CreateSymbolicLinkW DeleteFileW GetModuleFileNameW MultiByteToWideChar CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FormatMessageW GetTempPathW FindNextFileW GetQueuedCompletionStatusEx CancelIoEx CreateIoCompletionPort WriteFile GetOverlappedResult ReadFile PostQueuedCompletionStatus SetThreadExecutionState FindClose CreateEventA GetLastError HeapAlloc CloseHandle HeapFree GetProcessHeap GetComputerNameExW DeviceIoControl QueryPerformanceFrequency GetSystemTimePreciseAsFileTime HeapReAlloc FreeLibrary LoadLibraryExW OutputDebugStringW GetModuleHandleA OutputDebugStringA Sleep WakeAllConditionVariable LoadLibraryExA GetProcAddress ReleaseSRWLockExclusive AcquireSRWLockExclusive TlsFree GetEnvironmentVariableW GetCommandLineW GetCurrentDirectoryW AddVectoredExceptionHandler FreeEnvironmentStringsW RtlVirtualUnwind RtlCaptureContext RtlUnwindEx SetEnvironmentVariableW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead DeleteCriticalSection GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount

advapi32

RegOpenKeyExW SystemFunction036 RegQueryValueExW RegEnumValueW RegQueryInfoKeyW RegCloseKey RegGetValueW RegCreateKeyTransactedW RegOpenKeyTransactedW RegCreateKeyExW EventUnregister EventRegister EventWriteTransfer EventSetInformation

ntdll

NtDeviceIoControlFile NtCancelIoFileEx RtlGetVersion NtCreateFile NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ole32

OleInitialize CoInitialize StringFromIID CoCreateInstance RegisterDragDrop CoUninitialize CoInitializeEx RevokeDragDrop

combase

CoTaskMemAlloc CoTaskMemFree CoCreateFreeThreadedMarshaler

oleaut32

SysStringLen SetErrorInfo SysFreeString GetErrorInfo

mmdevapi

ActivateAudioInterfaceAsync

shell32

DragQueryFileW ShellExecuteExW SHGetStockIconInfo SHAppBarMessage DragFinish SHChangeNotify SHGetKnownFolderPath ILCreateFromPathW ShellExecuteW SHOpenFolderAndSelectItems ILFree

gdi32

SetTextColor DeleteObject CreateRectRgn CreateCompatibleDC CreateSolidBrush SetBkMode GetDIBits CombineRgn GetDeviceCaps BitBlt DeleteDC SelectObject CreateDIBSection

user32

InvalidateRgn CreateIcon IsProcessDPIAware DrawTextW GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo VkKeyScanW DestroyMenu GetWindowRect ShowWindow GetKeyboardState GetAsyncKeyState GetKeyState ToUnicodeEx PostQuitMessage SystemParametersInfoA TrackPopupMenu GetKeyboardLayout GetClipCursor AppendMenuW InsertMenuW ClipCursor ShowCursor DestroyIcon GetMenu DrawIconEx ReleaseDC GetDC MsgWaitForMultipleObjectsEx SetMenuItemInfoW SetWindowPlacement CheckMenuItem SetWindowLongW LoadImageW GetParent GetMenuItemInfoW RemoveMenu CreatePopupMenu CreateMenu DrawMenuBar RegisterWindowMessageA CreateAcceleratorTableW SetCursor DestroyAcceleratorTable GetIconInfo SendMessageTimeoutW GetWindowTextLengthW GetWindowTextW MonitorFromRect CloseTouchInputHandle GetTouchInputInfo GetSystemMenu GetWindowThreadProcessId TrackMouseEvent SetCapture ReleaseCapture FillRect FindWindowW GetSystemMetrics ClientToScreen GetWindowLongW ScreenToClient SetWindowTextW SetFocus GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData PostThreadMessageW PeekMessageW LoadCursorW PostMessageW TranslateAcceleratorW DispatchMessageW TranslateMessage GetMessageW IsWindowEnabled EnableWindow MonitorFromWindow IsIconic IsWindowVisible RegisterRawInputDevices SendMessageW GetCursorPos GetClientRect RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint SystemParametersInfoW SetWindowDisplayAffinity DestroyWindow SetWindowRgn DefWindowProcW GetWindowLongPtrW SetWindowLongPtrW CreateWindowExW RegisterClassExW RegisterTouchWindow EnumChildWindows DispatchMessageA GetMonitorInfoW SetParent ChangeDisplaySettingsExW GetMessageA GetWindowPlacement AllowSetForegroundWindow AdjustWindowRectEx FindWindowExW SetPropW FlashWindowEx MessageBoxW SetMenu SetWindowPos EnableMenuItem SendInput SetForegroundWindow GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetWindow MapVirtualKeyExW

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

imm32

ImmGetCompositionStringW ImmReleaseContext ImmGetContext

shlwapi

SHCreateMemStream

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcrypt

BCryptGenRandom

ws2_32

WSAStartup getpeername getsockname recvfrom getaddrinfo connect shutdown getsockopt sendto freeaddrinfo WSASend recv WSAIoctl WSAGetLastError closesocket setsockopt bind ioctlsocket WSASocketW send

iphlpapi

GetAdaptersAddresses

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertDuplicateCertificateContext CertOpenStore CertFreeCertificateChain CertDuplicateStore CertAddCertificateContextToStore CertFreeCertificateChainEngine CertSetCertificateContextProperty CertAddEncodedCertificateToStore CertCreateCertificateChainEngine CertCloseStore

secur32

DecryptMessage FreeCredentialsHandle QueryContextAttributesW ApplyControlToken FreeContextBuffer AcceptSecurityContext AcquireCredentialsHandleA InitializeSecurityContextW EncryptMessage DeleteSecurityContext

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strlen strcpy_s strcmp wcslen wcscmp

api-ms-win-crt-math-l1-1-0

roundf floor round pow __setusermatherr trunc

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _get_initial_narrow_environment _set_app_type _initterm _initterm_e _initialize_onexit_table _register_onexit_function _c_exit exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _seh_filter_exe _crt_atexit abort _cexit terminate _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh calloc free malloc