RunLegacyCPLElevated[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RunLegacyCPLElevated.exe
Size

66KB
MD5

6c47b937fd6b890b201b451fe7b1ff76
SHA1

a73a58f87ac036b65e4e2ed68641efb88b60625f
SHA256

d74c1659560e1244d9097a3f61de5a588c4bace7f5e6676b5d65bbed6ff1675c
SHA512

35407747b8786844a4caa7765d4fa23dd4003de924797dd4c9b4118a132dac6ceb787219bdca8669ba406c887ce2b94a96b4198a93976388ae537659762d53dd
SSDEEP

768:gO7X3ZwhXXv4U5xYFhMty8jSGSkVhWakkbB5eT905WGnUKxHUe7n8jKBFFptX/7z:lKLy8jSxakkn6oYY0ewiP8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RunLegacyCPLElevated.exe

Files

RunLegacyCPLElevated.exe
.exe windows x86

932b565960425ee7fa367e4081afa26b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
lstrlenW
ReleaseSemaphore
GetModuleHandleExW
SetErrorMode
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapSetInformation
HeapAlloc
GetProcAddress
CreateMutexExW
LocalFree
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
CreateActCtxW
ActivateActCtx
DeactivateActCtx
ReleaseActCtx

user32

SetClassLongW
GetClassLongW
LoadCursorW
GetWindow
DefWindowProcW
GetClassNameW
RegisterClassW
SetWindowLongW
DestroyWindow
LoadIconW
CreateWindowExW
GetWindowLongW

msvcrt

_wcmdln
_lock
_initterm
__setusermatherr
__dllonexit
_except_handler4_common
_controlfp
?terminate@@YAXXZ
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
memcpy_s
_vsnwprintf
_onexit
_unlock
memset

shell32

Control_RunDLLW

shlwapi

PathIsRelativeW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetStartupInfoW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processenvironment-l1-1-0

SearchPathW

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-file-l1-1-0

GetFileAttributesW

api-ms-win-core-string-l2-1-0

CharNextW

ntdll

RtlSetSearchPathMode

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

932b565960425ee7fa367e4081afa26b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcrt

shell32

shlwapi

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l2-1-0

ntdll

Sections

.text Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 1024B - Virtual size: 872B

.text
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 1024B - Virtual size: 872B