mrjohn[.]loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mrjohn.loader.exe
Size 11.1MB
Sample261113-bj59rayv2n
SHA256 9300e66577733b19ee7838b1806629632eef3a71f1150d6bc2ab0519aeebb872
MD5 4d4f865c8227edc8ba3baddd8254b2e7
SHA1 9e204538f7515fd1a67ac6b7ed551e483bee4ab0
SHA512 a1c97758572461c6bb6d6a1de341860e293a340d555e54e562c0ec1ad4554d0ffe8a57dadbe3def86af401d6978d74a543efafb5091733da4b0a12adc1d2eecc
SSDEEP 196608:ZoKHEoyZRbcLDlTaGKLXsmWAHo3k0WaOVbhKEKZ:+vmpTavXLpYkLBbQFZ
TLSH
T1A4C62227A39411FCE0A6C279CA469D47EB72780A07B0EADF17D059512FA73E05E3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mrjohn.loader.exe

File Explorer

mrjohn.loader.exe

.exe 11.1MB

mrjohn.loader.exe

IMPHASH 0d8fab16c461b3acf3e4e0e973f1603e
SHA256 9300e66577733b19ee7838b1806629632eef3a71f1150d6bc2ab0519aeebb872
MD5 4d4f865c8227edc8ba3baddd8254b2e7
SHA1 9e204538f7515fd1a67ac6b7ed551e483bee4ab0
SHA512 a1c97758572461c6bb6d6a1de341860e293a340d555e54e562c0ec1ad4554d0ffe8a57dadbe3def86af401d6978d74a543efafb5091733da4b0a12adc1d2eecc
SSDEEP 196608:ZoKHEoyZRbcLDlTaGKLXsmWAHo3k0WaOVbhKEKZ:+vmpTavXLpYkLBbQFZ
TLSH
T1A4C62227A39411FCE0A6C279CA469D47EB72780A07B0EADF17D059512FA73E05E3A713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

938888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW SHFileOperationW

dbghelp

SymInitializeW SymUnloadModule64 SymFromNameW SymGetOptions ImageRvaToVa SymSetOptions SymCleanup SymLoadModuleExW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptSetProperty BCryptGetProperty BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCreateHash

winhttp

WinHttpReadData WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetLocalTime GetTickCount64 GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetComputerNameW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetEvent ResetEvent CreateEventW CreateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateNamedPipeA OutputDebugStringA CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsWow64Process WideCharToMultiByte Module32FirstW Module32NextW CreateDirectoryW SetLastError GetFullPathNameW GetShortPathNameW CreateFileW GetFileAttributesW GetSystemDirectoryW SetFileAttributesW SetFileInformationByHandle GetThreadContext LocalFree K32EnumDeviceDrivers DeviceIoControl K32GetDeviceDriverBaseNameW GetWindowsDirectoryW LoadLibraryW GetCurrentDirectoryW GetProcAddress GetModuleHandleA LoadLibraryA FreeLibrary GetTickCount K32GetDeviceDriverFileNameW GetFileSizeEx MultiByteToWideChar GetSystemTimeAsFileTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA FindFirstFileW GetEnvironmentVariableA IsDebuggerPresent CheckRemoteDebuggerPresent GetTempPathW HeapAlloc HeapFree GetProcessHeap ExitProcess GetCurrentThread VirtualProtect GlobalSize GetCurrentThreadId CreateFileA SetNamedPipeHandleState PeekNamedPipe RtlUnwindEx InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI GetFinalPathNameByHandleW GetFileAttributesExW FindFirstFileExW IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx FormatMessageA FindClose DeleteFileW GetEnvironmentVariableW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue RtlUnwind TlsFree Sleep SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive WaitForSingleObjectEx WaitForSingleObject GetCurrentProcess LoadLibraryExW ExitThread GetModuleFileNameW GetLastError CloseHandle RaiseException FindNextFileW FreeLibraryAndExitThread GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize WriteConsoleW SetEndOfFile IsDBCSLeadByte

user32

SetWindowRgn MessageBoxW TranslateMessage DispatchMessageW PeekMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow ReleaseCapture GetSystemMetrics UpdateWindow GetKeyboardLayout GetClientRect GetWindowLongPtrW SetWindowLongPtrW LoadCursorA LoadIconW OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetWindow GetWindowThreadProcessId GetTopWindow GetClassNameA EnumWindows GetWindowTextA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos ReleaseDC GetDC GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent

gdi32

SetStretchBltMode SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap DeleteObject CreateRoundRectRgn StretchBlt

ole32

StringFromGUID2 CoInitialize CreateStreamOnHGlobal GetHGlobalFromStream CoCreateInstance CoInitializeEx CoCreateGuid CoUninitialize

advapi32

GetTokenInformation RevertToSelf ImpersonateLoggedOnUser StartServiceW OpenServiceW DuplicateTokenEx QueryServiceStatusEx RegSetValueExW QueryServiceStatus CloseServiceHandle OpenSCManagerW GetUserNameW LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey OpenProcessToken

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty

shlwapi

PathFileExistsW PathIsDirectoryW

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry NtQueryInformationProcess NtSetInformationThread RtlPcToFileHeader

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3dcompiler_47

D3DCompile

ws2_32

WSAStartup WSACleanup

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders

iphlpapi

GetAdaptersAddresses

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

298KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.7MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mrjohn.loader.exe

shell32

dbghelp

bcrypt

winhttp

d3d11

kernel32

user32

gdi32

ole32

advapi32

crypt32

shlwapi

ntdll

imm32

d3dcompiler_47

ws2_32

gdiplus

iphlpapi

generic