jmxxkhns479fmm1vxt61rpk61j5dfb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
jmxxkhns479fmm1vxt61rpk61j5dfb.exe
Size 116.9MB
Sample261026-wwpgzsbf72
SHA256 6dc27f072922e29741f32163990e53ac38f38fd1c275bbdca27893ffee8a00b8
MD5 1227280f5c1475936b3acd88272840d8
SHA1 7d6c50b32a94bb16ebceb3bd02bf6c451def3617
SHA512 815b443177e8cf838e8590a1b0b00ca36153084ea47ff4461b2b745d7c3e35c42b2dd5dbe3e41b407e0e37ca87b81421cc6c48b51b963e971837fe78163a047b
SSDEEP 3145728:o9RRccGar43PHY1VVU/1ISbneSxuvSnbJ4zPeD:ozdGI2PHAVVU9f6SkvOb6zPG
TLSH
T1BA483312FAC684E8C0E9C97893879623B63178DB052AF55F07C54A143FE5BB09F1D78A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

jmxxkhns479fmm1vxt61rpk61j5dfb.exe

.exe 116.9MB

jmxxkhns479fmm1vxt61rpk61j5dfb.exe

IMPHASH ff2a581c72bcbbc6f8c52785657b5e2d
SHA256 6dc27f072922e29741f32163990e53ac38f38fd1c275bbdca27893ffee8a00b8
MD5 1227280f5c1475936b3acd88272840d8
SHA1 7d6c50b32a94bb16ebceb3bd02bf6c451def3617
SHA512 815b443177e8cf838e8590a1b0b00ca36153084ea47ff4461b2b745d7c3e35c42b2dd5dbe3e41b407e0e37ca87b81421cc6c48b51b963e971837fe78163a047b
SSDEEP 3145728:o9RRccGar43PHY1VVU/1ISbneSxuvSnbJ4zPeD:ozdGI2PHAVVU9f6SkvOb6zPG
TLSH
T1BA483312FAC684E8C0E9C97893879623B63178DB052AF55F07C54A143FE5BB09F1D78A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

76:90:2d:97:52:54:88:cf:aa:6f:36:3f:af:e1:15:a7:0b:0b:a1:17:55:dc:b1:3b:3b:d2:8c:44:c7:31:23:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0804226889,CN=CT Tech Group LLC,O=CT Tech Group LLC,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13055465786173,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 29, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

0a:0c:65:5f:c7:4f:15:e9:6d:18:aa:01:8b:05:6e:68

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 30, 2025 - Mar 29, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4483844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

setup.pdb

kernel32

GetModuleHandleExW GetModuleFileNameW SetThreadErrorMode LoadLibraryExW HeapSize SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformationForYear CloseHandle GetCommandLineW SetLastError SetCurrentDirectoryW GetModuleHandleA RtlUnwindEx GetNativeSystemInfo GetCurrentProcess DuplicateHandle GetSystemInfo SetThreadStackGuarantee GetCurrentThread SetUnhandledExceptionFilter GetFileInformationByHandleEx SetFileInformationByHandle FindClose GetFullPathNameW WakeAllConditionVariable WakeConditionVariable ReleaseSRWLockExclusive SwitchToThread SleepConditionVariableSRW AcquireSRWLockExclusive GetFileInformationByHandle MultiByteToWideChar WaitForSingleObject GetModuleHandleW GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte GetCurrentThreadId FlsAlloc FlsFree FlsSetValue IsThreadAFiber GetEnvironmentVariableW CreateThread ReadFileEx SleepEx WriteFileEx CompareStringOrdinal CreateFileW SetFileTime FindFirstFileExW TryAcquireSRWLockExclusive SetHandleInformation GetProcAddress CreateDirectoryW ExitProcess GetExitCodeProcess GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetTempPathW RemoveDirectoryW CopyFileExW MoveFileExW CreateSymbolicLinkW Sleep CreateWaitableTimerExW SetWaitableTimer FindNextFileW GetLongPathNameW ExpandEnvironmentStringsW UnhandledExceptionFilter VirtualQuery GetConsoleOutputCP SetStdHandle RtlPcToFileHeader IsDebuggerPresent RaiseException EncodePointer SetFilePointerEx FlushFileBuffers LCMapStringW CompareStringW InitializeCriticalSectionEx FlsGetValue GetStringTypeW GetFileType SetEnvironmentVariableW TerminateProcess OpenProcess QueryFullProcessImageNameW IsWow64Process GetLastError VerSetConditionMask VerifyVersionInfoW GetDiskFreeSpaceExW GetUserPreferredUILanguages LoadLibraryExA GetCPInfo GetOEMCP GetSystemTimeAsFileTime GetACP IsValidCodePage FreeLibrary GetProcessHeap HeapFree HeapAlloc FormatMessageW GetConsoleMode GetStdHandle WriteConsoleW RtlLookupFunctionEntry SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo OutputDebugStringA OutputDebugStringW CreateFileMappingW MapViewOfFile VirtualProtect UnmapViewOfFile AddVectoredExceptionHandler GetCommandLineA WriteFile TlsFree RtlCaptureContext RtlVirtualUnwind HeapReAlloc TlsSetValue QueryPerformanceFrequency QueryPerformanceCounter TlsGetValue TlsAlloc InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount

user32

SendMessageW AllowSetForegroundWindow ReleaseDC PostMessageW EndPaint UpdateLayeredWindow BeginPaint InvalidateRect SetWindowPos GetWindowLongPtrW EndDialog DispatchMessageW TranslateMessage GetMessageW PeekMessageW SetTimer ShowWindow SetWindowLongPtrW GetDC GetDesktopWindow CreateWindowExW RegisterClassExW SystemParametersInfoW LoadCursorW GetMonitorInfoW GetDpiForSystem MonitorFromPoint GetCursorPos DestroyWindow GetSystemMetrics DefWindowProcW

ntdll

NtReadFile NtWriteFile NtCreateFile RtlInitUnicodeString RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile

combase

CoTaskMemFree CoTaskMemAlloc

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jmxxkhns479fmm1vxt61rpk61j5dfb.exe

kernel32

user32

ntdll

combase

generic