e6d1edc862b899a68c4b47f317b82764b7ea24bf904e91d23fbe9676f3d273c5

Sharing

Copy URL Twitter E-mail

General

Target

e6d1edc862b899a68c4b47f317b82764b7ea24bf904e91d23fbe9676f3d273c5
Size

4.0MB
MD5

2a0c4ff4278dc5d639e00c250ab4a49a
SHA1

5579ba5efce3484537d030b621167b2fa2f3ea9d
SHA256

e6d1edc862b899a68c4b47f317b82764b7ea24bf904e91d23fbe9676f3d273c5
SHA512

4db98539905b3c5c87b41a020305a6244c2406229da462619e0631a5277b2b1c2ea98d08fbf8fd631b185c46d42c33197eeeb0c3b63410d8293b1b37c746382a
SSDEEP

49152:jjAiuQSKIFqFqFCxlEAlFfGQWNcGopiJ2GS3E/jiMtggAQpJT4hyEH4ad8bUyK:nxu+Fiy9lFfGQWNcb1GWEbiMtgdQnMN

Score

N/A

Malware Config

Signatures

Files

e6d1edc862b899a68c4b47f317b82764b7ea24bf904e91d23fbe9676f3d273c5
.dll windows x86

3b1c1cbc96cab2546e0a1012a6205b1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile
InternetSetOptionW

kernel32

GetSystemInfo
HeapSetInformation
ResumeThread
GetTempFileNameW
GetFileSize
FindFirstFileW
GetLogicalDriveStringsW
CreateDirectoryW
ReplaceFileW
GetTempPathW
GetCurrentDirectoryW
GetLongPathNameW
FindClose
RemoveDirectoryW
QueryDosDeviceW
FindNextFileW
GetFileAttributesExW
GetCommandLineW
LocalFree
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForMultipleObjects
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
GetFileInformationByHandle
WideCharToMultiByte
ExpandEnvironmentStringsW
IsDebuggerPresent
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetFileSizeEx
CancelIo
LockResource
GetStdHandle
GlobalAlloc
GlobalUnlock
GlobalFree
FlushInstructionCache
GetPrivateProfileIntW
GetLocalTime
VirtualProtect
OutputDebugStringW
CopyFileW
AssignProcessToJobObject
DeviceIoControl
GetVolumeInformationW
MoveFileW
HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
VirtualAlloc
LoadLibraryA
GetACP
GetTimeZoneInformation
CreateFileA
SetStdHandle
GetFileType
HeapReAlloc
RtlUnwind
ExitThread
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleFileNameA
HeapSize
HeapCreate
HeapDestroy
GetOEMCP
IsValidCodePage
SetHandleCount
GlobalSize
GetStartupInfoA
FreeEnvironmentStringsA
ReadFile
TerminateProcess
GlobalLock
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
GetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsProcessorFeaturePresent
GetSystemPowerStatus
SleepEx
GetSystemDirectoryA
PeekNamedPipe
GetWindowsDirectoryW
GetSystemDirectoryW
FileTimeToSystemTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
RtlCaptureStackBackTrace
GetCurrentThread
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetVersionExW
GetCurrentProcess
GetNativeSystemInfo
SetUnhandledExceptionFilter
MulDiv
OpenProcess
GetThreadLocale
ReleaseMutex
OutputDebugStringA
SetLastError
CreateFileW
WriteFile
FormatMessageA
CreateProcessW
SetFilePointer
CreateMutexW
InterlockedExchangeAdd
InterlockedExchange
CreateEventW
UnhandledExceptionFilter
GetTickCount
GetModuleHandleA
LocalAlloc
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
RaiseException
lstrlenW
MultiByteToWideChar
LeaveCriticalSection
SizeofResource
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FindResourceW
CreateThread
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
GetExitCodeThread
Process32FirstW
GetFileAttributesW
TerminateThread
LoadLibraryW
WaitForSingleObject
FreeLibrary
GetLastError
DeleteFileW
InterlockedCompareExchange
GetSystemDefaultLangID
lstrcpyW
WritePrivateProfileStringW
WritePrivateProfileStructW
GetPrivateProfileStructW
GetPrivateProfileStringW
GetCurrentThreadId
GetProcAddress
GetStartupInfoW
lstrcmpW
Sleep
GetModuleFileNameW
ExitProcess
GetConsoleMode
GetConsoleCP
GetCommandLineA
FileTimeToLocalFileTime
FormatMessageW
FindFirstFileA

user32

GetKeyState
WindowFromPoint
CloseClipboard
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
OpenClipboard
RegisterClipboardFormatW
SetClipboardData
GetSystemMenu
TrackPopupMenu
MonitorFromWindow
GetMonitorInfoW
MonitorFromRect
LoadCursorW
BeginPaint
DrawIconEx
CreateIconIndirect
FillRect
DrawTextW
GetGuiResources
SetTimer
PostQuitMessage
UnregisterClassW
KillTimer
WaitMessage
GetQueueStatus
RegisterClassExW
CallMsgFilterW
PeekMessageW
MsgWaitForMultipleObjectsEx
CharLowerW
CharUpperW
GetWindowDC
MonitorFromPoint
GetWindowInfo
GetCursorPos
InvalidateRect
EnumDisplayMonitors
RedrawWindow
SetLayeredWindowAttributes
MoveWindow
GetMessagePos
IsChild
SystemParametersInfoW
EnumChildWindows
ClientToScreen
GetAsyncKeyState
SetWindowTextW
SetScrollInfo
DestroyWindow
NotifyWinEvent
SetWindowRgn
UpdateLayeredWindow
SetCursor
SetWindowPlacement
SetMenuItemInfoW
DrawTextExW
DestroyMenu
EndMenu
UnhookWindowsHookEx
SetWindowsHookExW
GetMenuInfo
GetMenuItemCount
SetMenuInfo
CreatePopupMenu
GetMenuState
InsertMenuItemW
InflateRect
FrameRect
DrawFrameControl
UnregisterClassA
PostMessageW
GetIconInfo
GetWindowTextW
MessageBoxW
DestroyIcon
CreateWindowExW
GetSysColor
CharNextW
DefWindowProcW
GetClassLongW
GetMenuItemInfoW
DrawEdge
FindWindowW
GetComboBoxInfo
IsRectEmpty
ValidateRect
ReleaseCapture
GetDlgItem
EnableMenuItem
UnionRect
IntersectRect
SetRect
OffsetRect
GetWindowPlacement
GetCapture
GetUpdateRect
SetFocus
IsWindowEnabled
TrackMouseEvent
GetFocus
GetDoubleClickTime
AdjustWindowRectEx
SetWindowLongW
GetDesktopWindow
IsZoomed
EnumWindows
PtInRect
GetWindowLongW
GetWindowRgn
SetWindowPos
EnumThreadWindows
SetParent
CopyAcceleratorTableW
LoadAcceleratorsW
FlashWindowEx
wsprintfW
keybd_event
MapVirtualKeyW
GetWindowRect
RegisterWindowMessageW
GetWindowTextLengthW
GetClassInfoExW
GetKeyboardLayout
GetCaretPos
UpdateWindow
ActivateKeyboardLayout
SetRectEmpty
GetSysColorBrush
CallWindowProcW
IsIconic
RegisterShellHookWindow
SetForegroundWindow
GetParent
UnhookWinEvent
GetClientRect
GetDC
LoadIconW
SetWinEventHook
GetClassNameW
ReleaseDC
ShowWindow
GetSubMenu
CallNextHookEx
DeregisterShellHookWindow
GetActiveWindow
FindWindowExW
GetSystemMetrics
IsWindowVisible
SendMessageW
MapWindowPoints
GetWindow
AttachThreadInput
GetWindowThreadProcessId
TranslateMessage
DispatchMessageW
ScreenToClient
GetForegroundWindow
GetAncestor
IsWindow
EnableWindow
DrawFocusRect
InvertRect
SetCapture
EndPaint

gdi32

EndPath
CreateRectRgnIndirect
SelectClipRgn
SetArcDirection
SetBkColor
SetDCBrushColor
SetBrushOrgEx
AbortPath
BeginPath
GetObjectW
GdiAlphaBlend
RestoreDC
GetStockObject
IntersectClipRect
SetDCPenColor
CreateBitmap
SetMapMode
GetTextMetricsW
GetTextExtentPoint32W
CreateCompatibleBitmap
EqualRgn
GetRgnBox
ExcludeClipRect
CreateSolidBrush
GetBkColor
SetViewportOrgEx
SetLayout
SetPolyFillMode
SetStretchBltMode
SetROP2
PolyBezier
PathToRegion
SetGraphicsMode
SetTextColor
DeleteDC
CreateDIBSection
CreateFontIndirectW
GdiFlush
SetBkMode
SelectObject
CreateCompatibleDC
ExtTextOutW
GetOutlineTextMetricsW
SetWorldTransform
GetGlyphOutlineW
SetTextAlign
GetFontData
GetGlyphIndicesW
GetDeviceCaps
CreatePolygonRgn
StretchBlt
DeleteObject
PtInRegion
SaveDC
BitBlt
CreateRectRgn

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
RegQueryValueExW
CreateProcessAsUserW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW

shell32

SHBrowseForFolderW
SHGetSpecialFolderPathW
SHAppBarMessage
DragFinish
ShellExecuteExW
DragQueryFileW
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
SHGetFileInfoW
ord155
SHGetPathFromIDListW
SHCreateShellItem
ord18
SHGetDesktopFolder
ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemFree
OleInitialize
CoCreateInstance
CoInitialize
CoUninitialize
OleUninitialize
CoTaskMemAlloc
RevokeDragDrop
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CreateBindCtx
RegisterDragDrop

oleaut32

VarUI4FromStr
SysAllocString
SysStringLen
SysFreeString
LoadTypeLi
LoadRegTypeLi

shlwapi

UrlCreateFromPathA
PathIsUNCA
PathFileExistsA
PathFindFileNameW
PathFindExtensionW
PathRemoveExtensionW
UrlCreateFromPathW
PathIsUNCW
PathRemoveFileSpecW
PathCreateFromUrlW
PathIsDirectoryW
PathFileExistsW
ord8
ord9
StrCpyW

dbghelp

SymSetOptions
SymFromAddr
StackWalk64
SymInitialize
SymGetModuleBase64
SymFunctionTableAccess64
SymGetLineFromAddr64

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcesses

oleacc

ObjectFromLresult
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmGetCompositionStringW
ImmReleaseContext

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create

msimg32

AlphaBlend

wldap32

ord46
ord41
ord27
ord301
ord167
ord147
ord79
ord142
ord127
ord133
ord26
ord118
ord14
ord145
ord216
ord208

ws2_32

WSACleanup
WSAStartup
WSAGetLastError
closesocket
gethostname
ioctlsocket
select
__WSAFDIsSet
listen
accept
recv
send
recvfrom
sendto
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
WSASetLastError
connect
getsockname
ntohs
bind
htons
getsockopt
socket
getpeername
setsockopt

Exports

Exports

CloverMain

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 715KB - Virtual size: 715KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b1c1cbc96cab2546e0a1012a6205b1d

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

dbghelp

winmm

userenv

usp10

psapi

oleacc

imm32

urlmon

iphlpapi

comctl32

msimg32

wldap32

ws2_32

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 715KB - Virtual size: 715KB

.data Size: 55KB - Virtual size: 102KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 170KB - Virtual size: 170KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 715KB - Virtual size: 715KB

.data
Size: 55KB - Virtual size: 102KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 170KB - Virtual size: 170KB