be76ca99d0f819157c8be662168d2390d82b2fe66ee4ba9de0ad77b2798649a0

Sharing

Copy URL Twitter E-mail

General

Target

be76ca99d0f819157c8be662168d2390d82b2fe66ee4ba9de0ad77b2798649a0
Size

3.9MB
MD5

363f83a2526fa35e87523b23bea0d6f2
SHA1

06cddc5b120a4d5f9342907dbbbeb73e474d177b
SHA256

be76ca99d0f819157c8be662168d2390d82b2fe66ee4ba9de0ad77b2798649a0
SHA512

0b9b1143f54df92aee9b56b7a37120bb215118ec98c39cb69461e5e327425cd73e3e5478be4da6d6571ccf8bd95d46bb8f38060ac2a9c575f86100902617689b
SSDEEP

49152:VSc6bMV5anUOFuNPHkD1hhQqKCoQXxpp+XQzTP7UXKG1pvJy:Vf5aUCuNPHkDnKCoQXwXQ

Score

1^/10

Malware Config

Signatures

Files

be76ca99d0f819157c8be662168d2390d82b2fe66ee4ba9de0ad77b2798649a0
.dll windows x86

b9e7fea8d0a4c0ea592f027520a28a14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile
InternetSetOptionW

kernel32

AssignProcessToJobObject
TerminateProcess
ReadFile
GetStdHandle
GetSystemInfo
HeapSetInformation
ResumeThread
GetTempFileNameW
GetFileSize
FindFirstFileW
CreateDirectoryW
ReplaceFileW
GetCurrentDirectoryW
GetLongPathNameW
FindClose
SetCurrentDirectoryW
RemoveDirectoryW
GetFileAttributesExW
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
GetFileInformationByHandle
WideCharToMultiByte
IsDebuggerPresent
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetFileSizeEx
CancelIo
OpenProcess
LockResource
GlobalSize
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
FlushInstructionCache
GetPrivateProfileIntW
GetLocalTime
VirtualProtect
OutputDebugStringW
FormatMessageW
DeviceIoControl
GetVolumeInformationW
HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
VirtualAlloc
LoadLibraryA
GetACP
GetTimeZoneInformation
CreateFileA
HeapReAlloc
RtlUnwind
MoveFileW
ExitThread
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleFileNameA
HeapCreate
HeapDestroy
HeapSize
GetOEMCP
GetWindowsDirectoryW
GetSystemDirectoryW
FileTimeToSystemTime
IsValidCodePage
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
GetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsProcessorFeaturePresent
GetSystemPowerStatus
SleepEx
GetSystemDirectoryA
PeekNamedPipe
GetSystemTimeAsFileTime
QueryPerformanceCounter
RtlCaptureStackBackTrace
GetCurrentThread
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
SetUnhandledExceptionFilter
LocalFree
GetCommandLineW
GetVersionExW
GetCurrentProcess
GetNativeSystemInfo
WaitForMultipleObjects
ResetEvent
SetEvent
GetThreadLocale
ReleaseMutex
OutputDebugStringA
SetLastError
CreateFileW
WriteFile
FormatMessageA
CreateProcessW
SetFilePointer
CreateMutexW
InterlockedExchangeAdd
InterlockedExchange
CreateEventW
GetTickCount
LocalAlloc
DeleteCriticalSection
UnhandledExceptionFilter
lstrcmpiW
EnterCriticalSection
RaiseException
lstrlenW
MultiByteToWideChar
LeaveCriticalSection
SizeofResource
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FindResourceW
CreateThread
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
GetExitCodeThread
Process32FirstW
GetFileAttributesW
TerminateThread
LoadLibraryW
WaitForSingleObject
FreeLibrary
GetModuleHandleA
DeleteFileW
InterlockedCompareExchange
GetSystemDefaultLangID
lstrcpyW
WritePrivateProfileStringW
WritePrivateProfileStructW
GetPrivateProfileStructW
GetPrivateProfileStringW
GetCurrentThreadId
GetTempPathW
GetStartupInfoW
lstrcmpW
Sleep
GetModuleFileNameW
ExitProcess
GetProcAddress
GetLastError
GetModuleHandleW
GetFileType
SetStdHandle
GetConsoleMode
GetConsoleCP
GetCommandLineA
FileTimeToLocalFileTime
CopyFileW
FindFirstFileA

user32

GetKeyState
WindowFromPoint
GetCursorPos
CloseClipboard
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
OpenClipboard
RegisterClipboardFormatW
SetClipboardData
GetSystemMenu
TrackPopupMenu
MonitorFromWindow
GetMonitorInfoW
MonitorFromRect
LoadCursorW
DrawTextW
EndPaint
BeginPaint
DrawIconEx
CreateIconIndirect
GetGuiResources
SetTimer
PostQuitMessage
UnregisterClassW
KillTimer
WaitMessage
GetQueueStatus
RegisterClassExW
CallMsgFilterW
PeekMessageW
MsgWaitForMultipleObjectsEx
CharLowerW
CharUpperW
GetWindowDC
MonitorFromPoint
GetWindowInfo
InvalidateRect
EnumDisplayMonitors
RedrawWindow
SetLayeredWindowAttributes
MoveWindow
GetMessagePos
IsChild
SystemParametersInfoW
EnumChildWindows
ClientToScreen
GetAsyncKeyState
SetWindowTextW
SetScrollInfo
IsIconic
PostMessageW
SetWindowRgn
UpdateLayeredWindow
SetCursor
SetWindowPlacement
SetMenuItemInfoW
DrawTextExW
DestroyMenu
EndMenu
UnhookWindowsHookEx
SetWindowsHookExW
GetMenuInfo
GetMenuItemCount
SetMenuInfo
CreatePopupMenu
GetMenuState
InsertMenuItemW
GetMenuItemInfoW
DrawFrameControl
UnregisterClassA
GetIconInfo
GetWindowTextW
MessageBoxW
CreateWindowExW
GetSysColor
CharNextW
DefWindowProcW
GetClassLongW
AdjustWindowRectEx
GetDesktopWindow
IsZoomed
EnumWindows
DrawEdge
FindWindowW
GetComboBoxInfo
GetWindowTextLengthW
IsRectEmpty
ValidateRect
ReleaseCapture
EnableMenuItem
UnionRect
IntersectRect
SetRect
OffsetRect
GetWindowPlacement
GetCapture
GetUpdateRect
SetFocus
IsWindowEnabled
TrackMouseEvent
GetFocus
SetCapture
GetDoubleClickTime
PtInRect
GetWindowRgn
SetWindowPos
EnumThreadWindows
SetParent
CopyAcceleratorTableW
LoadAcceleratorsW
FlashWindowEx
wsprintfW
keybd_event
MapVirtualKeyW
RegisterWindowMessageW
RegisterShellHookWindow
SetForegroundWindow
GetParent
UnhookWinEvent
LoadIconW
SetWinEventHook
GetClassNameW
DeregisterShellHookWindow
GetActiveWindow
GetClassInfoExW
GetKeyboardLayout
GetCaretPos
UpdateWindow
ActivateKeyboardLayout
SetRectEmpty
GetSysColorBrush
CallWindowProcW
FindWindowExW
GetSystemMetrics
MapWindowPoints
GetWindow
AttachThreadInput
GetWindowThreadProcessId
TranslateMessage
DispatchMessageW
ScreenToClient
GetForegroundWindow
GetSubMenu
CallNextHookEx
GetAncestor
EnableWindow
DestroyWindow
GetWindowRect
GetClientRect
GetDC
GetWindowLongW
ReleaseDC
SetWindowLongW
ShowWindow
IsWindow
IsWindowVisible
SendMessageW
DestroyIcon
FrameRect
InflateRect
DrawFocusRect
InvertRect
NotifyWinEvent
FillRect

gdi32

EndPath
CreateRectRgnIndirect
SelectClipRgn
SetArcDirection
SetBkColor
SetDCBrushColor
SetBrushOrgEx
AbortPath
BeginPath
GetObjectW
GdiAlphaBlend
CreateBitmap
RestoreDC
SetDCPenColor
IntersectClipRect
SaveDC
SetMapMode
GetTextMetricsW
GetTextExtentPoint32W
CreateCompatibleBitmap
EqualRgn
GetRgnBox
ExcludeClipRect
CreateSolidBrush
GetBkColor
SetViewportOrgEx
SetLayout
SetPolyFillMode
SetStretchBltMode
SetROP2
PolyBezier
PathToRegion
SetGraphicsMode
SetTextColor
CreateFontIndirectW
GdiFlush
SetBkMode
SelectObject
ExtTextOutW
GetOutlineTextMetricsW
SetWorldTransform
GetGlyphOutlineW
SetTextAlign
GetFontData
GetGlyphIndicesW
GetDeviceCaps
PtInRegion
CreateRectRgn
BitBlt
CreatePolygonRgn
StretchBlt
DeleteDC
CreateDIBSection
GetStockObject
CreateCompatibleDC
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

advapi32

RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
CreateProcessAsUserW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW

shell32

ord155
SHGetSpecialFolderPathW
SHAppBarMessage
DragFinish
DragQueryFileW
ShellExecuteExW
SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHCreateShellItem
ord18
SHGetDesktopFolder
ShellExecuteW

ole32

CoInitialize
OleInitialize
CoCreateInstance
CreateBindCtx
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
CoTaskMemAlloc
RevokeDragDrop
ReleaseStgMedium
OleDuplicateData
PropVariantClear
RegisterDragDrop
DoDragDrop
CoUninitialize

oleaut32

VarUI4FromStr
SysAllocString
SysFreeString
SysStringLen
LoadTypeLi
LoadRegTypeLi

shlwapi

SHStrDupW
UrlCreateFromPathA
PathIsUNCA
PathFileExistsA
PathFindFileNameW
PathFindExtensionW
PathRemoveExtensionW
UrlCreateFromPathW
PathIsUNCW
PathRemoveFileSpecW
PathCreateFromUrlW
PathIsDirectoryW
PathFileExistsW
ord8
ord9
StrCpyW

login_ui

CreateCloverUserWrapper

dbghelp

SymGetLineFromAddr64
SymFromAddr
StackWalk64
SymInitialize
SymGetModuleBase64
SymSetOptions
SymFunctionTableAccess64

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

oleacc

ObjectFromLresult
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmGetCompositionStringW
ImmReleaseContext

iphlpapi

GetAdaptersInfo

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create

msimg32

AlphaBlend

wldap32

ord46
ord41
ord27
ord301
ord167
ord147
ord79
ord142
ord127
ord133
ord26
ord118
ord14
ord145
ord216
ord208

ws2_32

WSACleanup
WSAStartup
WSAGetLastError
gethostname
ioctlsocket
select
__WSAFDIsSet
listen
accept
recvfrom
sendto
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
WSASetLastError
connect
setsockopt
socket
recv
send
getsockname
ntohs
bind
htons
closesocket
getsockopt
getpeername

Exports

Exports

CloverMain

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 693KB - Virtual size: 693KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9e7fea8d0a4c0ea592f027520a28a14

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

login_ui

dbghelp

winmm

userenv

usp10

psapi

oleacc

imm32

iphlpapi

comctl32

msimg32

wldap32

ws2_32

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 693KB - Virtual size: 693KB

.data Size: 53KB - Virtual size: 101KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 164KB - Virtual size: 163KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 693KB - Virtual size: 693KB

.data
Size: 53KB - Virtual size: 101KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 164KB - Virtual size: 163KB