Static task
static1
Behavioral task
behavioral1
Sample
clop.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
clop.exe
Resource
win10v2004-20230220-en
General
-
Target
clop.exe
-
Size
100KB
-
MD5
8752a7a052ba75239b86b0da1d483dd7
-
SHA1
6eeef883d209d02a05ae9e6a2f37c6cbf69f4d89
-
SHA256
3320f11728458d01eef62e10e48897ec1c2277c1fe1aa2d471a16b4dccfc1207
-
SHA512
57d19e9254ecaeaf301e11598c88b1440f3f85baf0cb8d7a0ac952cd6d63f565df9809b13f50a059302bfb0f81a5c498e49837e2e9480ec9b51c14a409fbdb65
-
SSDEEP
1536:gHIPkRUedYttp2bd/B8quuaOY2IfpW+VQJFsW69cdCeRk28+axHPjsb5:EYtLqJSquu42CW+VwisCgk2DaxHPj+5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource clop.exe
Files
-
clop.exe.exe windows x86
ecf8f06eaa7a27093275957985742b1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatW
GlobalAlloc
DeleteFileW
lstrcpyA
GlobalFree
CloseHandle
CreateThread
MoveFileExW
lstrcpyW
CreateFileMappingW
MapViewOfFile
lstrcmpW
BeginUpdateResourceA
EraseTape
FindFirstVolumeW
GetProfileSectionW
GetCurrentProcess
lstrlenW
CancelDeviceWakeupRequest
TerminateProcess
GlobalUnWire
GetConsoleTitleW
EnumResourceNamesW
CreateMutexW
OpenFile
EnumSystemCodePagesW
CancelThreadpoolIo
GlobalDeleteAtom
QueryMemoryResourceNotification
GetACP
OpenProcess
FindFirstVolumeMountPointA
FindActCtxSectionStringA
CreateToolhelp32Snapshot
Sleep
SetFileAttributesW
GetConsoleAliasesLengthW
CreateFileW
CreateFileA
DefineDosDeviceA
GetSystemFileCacheSize
GetCurrentThread
GetSystemDirectoryA
Process32FirstW
GlobalFindAtomW
QueueUserAPC
LocalSize
FindAtomA
ExitProcess
FreeLibrary
GetSystemTime
GlobalUnlock
GetDriveTypeW
FindFirstFileTransactedA
CreateTimerQueue
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetLastError
UnmapViewOfFile
WaitForSingleObject
ReadFile
FindClose
lstrlenA
SetFilePointer
SetErrorMode
VirtualAlloc
GetProcessHeap
GetStringTypeW
GetFileType
WriteFile
FindNextFileW
VirtualFree
FindFirstFileW
Process32NextW
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
HeapFree
HeapAlloc
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
RaiseException
user32
EqualRect
DestroyIcon
EnumWindows
CharUpperBuffW
GetDesktopWindow
GetWindowTextW
wsprintfW
GetLastActivePopup
gdi32
CreateDIBPatternBrush
advapi32
CryptGenKey
CryptExportKey
CryptEncrypt
CryptAcquireContextW
CryptDestroyKey
CryptReleaseContext
shell32
SHGetSpecialFolderPathW
shlwapi
StrStrW
crypt32
CryptImportPublicKeyInfoEx
CryptStringToBinaryA
CryptDecodeObjectEx
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ