Static task
static1
General
-
Target
DiamondClipper.exe
-
Size
672KB
-
MD5
3f5cff2459e696b40b2e217b01405736
-
SHA1
640e5566f4d1d2a20fcf2328b00eb1069c3fb604
-
SHA256
0f2a69e2fca602ae6716c2580a74be3953610523612e6f6aae20aac334dfc3b1
-
SHA512
403ee7cf2e491ef2906909d2178cfacb847f27e2b886f2e13af155b9a3bee140ca8838924cf832f209bc2d3f32f0019db71ecb6ecf85bbff555aa02914f99ae4
-
SSDEEP
12288:c52nzopPMrLwttwkJoq+OJVO23l4o7YB/eShZl+gqrJB5p+8R:cfMrLe3oqXJTSo7YJg9JB5g
Malware Config
Signatures
Files
-
DiamondClipper.exe.exe windows x64
ef9d4e02ac71b0dc17f8cea47dd7b745
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
Sleep
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetProcessHeap
HeapAlloc
HeapReAlloc
GlobalLock
GlobalSize
WideCharToMultiByte
GlobalUnlock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
FindClose
GetModuleHandleW
FormatMessageW
GetTempPathW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
FindFirstFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
GetCurrentProcessId
CreateNamedPipeW
ReadFileEx
SleepEx
WriteFileEx
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetHandleInformation
HeapFree
RtlLookupFunctionEntry
GetCurrentThreadId
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
WriteFile
ExitProcess
TerminateProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
advapi32
GetUserNameW
SystemFunction036
user32
GetForegroundWindow
GetWindowTextW
OpenClipboard
GetAsyncKeyState
GetClipboardData
CloseClipboard
ws2_32
WSACleanup
send
recv
freeaddrinfo
WSAGetLastError
getaddrinfo
closesocket
WSASocketW
connect
WSAStartup
bcrypt
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
Sections
.text Size: 440KB - Virtual size: 440KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ