H E R E - J O Y T O K E Y C O M E B A C K[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
H E R E - J O Y T O K E Y C O M E B A C K.exe
Size 8.3MB
Sample261107-3ee1jsge44
SHA256 9925a7741b746cb72927f16e52d3d4fd69daf7924b8b045da2fcfed8ddc40c6c
MD5 8a02168659b30146d8b2502091feb538
SHA1 eef9bc16ad2be74f279e06c178a11ff809926fcc
SHA512 2263cec697f6894d4571f17b510824db44bcc5d49d40d77091b7170ba3d503bc5ea2f3dd16999117391fc0ff8e0a3d1a2728aa52823ffafd5b450f6674264018
SSDEEP 196608:vbgzEjBiXgyzxN2bKRDTyYd6IhqIQzJ1vxc74Qxfp7Bof:sGBagGubyMIs7xcnl
TLSH
T1069633A565C22155DB6D813C5B63BAFD70F2294C01328C0BDC88EFCFB8EB65455BAB42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
H E R E - J O Y T O K E Y C O M E B A C K.exe

File Explorer

H E R E - J O Y T O K E Y C O M E B A C K.exe

.exe 8.3MB

H E R E - J O Y T O K E Y C O M E B A C K.exe

IMPHASH 310c5745d184a4634f01c6a100728963
SHA256 9925a7741b746cb72927f16e52d3d4fd69daf7924b8b045da2fcfed8ddc40c6c
MD5 8a02168659b30146d8b2502091feb538
SHA1 eef9bc16ad2be74f279e06c178a11ff809926fcc
SHA512 2263cec697f6894d4571f17b510824db44bcc5d49d40d77091b7170ba3d503bc5ea2f3dd16999117391fc0ff8e0a3d1a2728aa52823ffafd5b450f6674264018
SSDEEP 196608:vbgzEjBiXgyzxN2bKRDTyYd6IhqIQzJ1vxc74Qxfp7Bof:sGBagGubyMIs7xcnl
TLSH
T1069633A565C22155DB6D813C5B63BAFD70F2294C01328C0BDC88EFCFB8EB65455BAB42
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10563227

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

@$xp$10TImageForm @$xp$11TTextDialog @$xp$13TAssignDialog @$xp$13TDeviceConfig @$xp$13TWizardDialog @$xp$14TAppLinkDialog @$xp$15TDeviceTemplate @$xp$15TGreetingDialog @$xp$16TInputNameDialog @$xp$16TVibrationDialog @$xp$17TAppCaptureDialog @$xp$17TLicenseKeyDialog @$xp$17TPreferenceDialog @$xp$18TAppLinkItemDialog @$xp$18TButtonAliasDialog @$xp$19TDeviceConfigDialog @$xp$21TDeviceTemplateDialog @$xp$9TAboutBox @$xp$9TMainForm @@Appcapturedlg@Finalize @@Appcapturedlg@Initialize @@Appinfo@Finalize @@Appinfo@Initialize @@Applinkdlg@Finalize @@Applinkdlg@Initialize @@Applinkitemdlg@Finalize @@Applinkitemdlg@Initialize @@Applinkmanager@Finalize @@Applinkmanager@Initialize @@Assigndlg@Finalize @@Assigndlg@Initialize @@Buttonaliasdlg@Finalize @@Buttonaliasdlg@Initialize @@Configfilemanager@Finalize @@Configfilemanager@Initialize @@Deviceconfig@Finalize @@Deviceconfig@Initialize @@Deviceconfigdlg@Finalize @@Deviceconfigdlg@Initialize @@Deviceconfigmanager@Finalize @@Deviceconfigmanager@Initialize @@Devicetemplate@Finalize @@Devicetemplate@Initialize @@Devicetemplatedlg@Finalize @@Devicetemplatedlg@Initialize @@Devicetemplatemanager@Finalize @@Devicetemplatemanager@Initialize @@Eventimpl@Finalize @@Eventimpl@Initialize @@Greetingdlg@Finalize @@Greetingdlg@Initialize @@Imagefrm@Finalize @@Imagefrm@Initialize @@Joybutton@Finalize @@Joybutton@Initialize @@Licensekeydlg@Finalize @@Licensekeydlg@Initialize @@Main@Finalize @@Main@Initialize @@Namedlg@Finalize @@Namedlg@Initialize @@Preferencedlg@Finalize @@Preferencedlg@Initialize @@Processing@Finalize @@Processing@Initialize @@Textdlg@Finalize @@Textdlg@Initialize @@Utils@Finalize @@Utils@Initialize @@Vibrationdlg@Finalize @@Vibrationdlg@Initialize @@Wzrddlg@Finalize @@Wzrddlg@Initialize _AboutBox _AppCaptureDialog _AppLinkDialog _AppLinkItemDialog _AssignDialog _ButtonAliasDialog _DeviceTemplateDialog _GreetingDialog _ImageForm _InputNameDialog _LicenseKeyDialog _MainForm _PreferenceDialog _TextDialog _VibrationDialog _WizardDialog ___CPPdebugHook ___setRaiseListFuncAddr __dbk_fcall_wrapper dbkFCallWrapperAddr

Name

.text

Size

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.?Y.

Size

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.$eA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.61B

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

H E R E - J O Y T O K E Y C O M E B A C K.exe

dinput8

advapi32

kernel32

version

winspool.drv

comctl32

comdlg32

gdi32

shell32

user32

winmm

ole32

oleaut32

wtsapi32

generic