Static task
static1
Behavioral task
behavioral1
Sample
cl2.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
cl2.exe
Resource
win10v2004-20230703-en
General
-
Target
cl2.exe
-
Size
1.6MB
-
MD5
90a4d9d8c5e7c041221c4ad2bc06dadf
-
SHA1
f9c5738e6acd91b8512292d6a505fb7e83bb60ae
-
SHA256
108051f4ef48cef2585d8d31248a751e64ab746028cae0296ca4f90a15ad2b5f
-
SHA512
cc288ab9c06252c962ae04192882a2d2518dfb56bee1693b42de431250614275a832043d31aebb385a0d19517a6cf63dc01aad675716f94bff4221c3c106f0a0
-
SSDEEP
12288:Il6wQZ38IS6mzdmOEz8rxS2qdoQxuSpId7BjT6z/mVMVMlGS9Aiicc914eGBy9Ti:IIwx6mzd0z8mxuSpId7XcC6L4nk0n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cl2.exe
Files
-
cl2.exe.exe windows x64
81e578a8f1af24ddad40a0613f1401d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EnterCriticalSection
RtlUnwindEx
SetFilePointer
GetACP
LocalFree
CloseHandle
SuspendThread
VirtualProtect
GetTickCount
QueryPerformanceFrequency
lstrcmpiA
VirtualFree
GetProcessHeap
HeapAlloc
GetStartupInfoW
ExitProcess
InitializeCriticalSection
GetCPInfoExW
GetThreadPriority
GetCurrentProcess
SetThreadPriority
VirtualAlloc
RtlUnwind
GetCPInfo
GetSystemInfo
GetCommandLineW
ResumeThread
GetProcAddress
LeaveCriticalSection
GetStdHandle
GetVersionExW
VerifyVersionInfoW
GetModuleHandleW
FreeLibrary
HeapCreate
HeapDestroy
ReadFile
LCMapStringW
GetDiskFreeSpaceW
VerSetConditionMask
GetUserDefaultUILanguage
FindFirstFileW
SetLastError
GetModuleFileNameW
GetLastError
GetNativeSystemInfo
lstrlenA
lstrlenW
SetEndOfFile
CompareStringW
QueryPerformanceCounter
CreateThread
lstrcpyA
HeapFree
WideCharToMultiByte
MultiByteToWideChar
FindClose
LoadLibraryW
LoadLibraryA
ResetEvent
SetEvent
GetLocaleInfoW
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetLocalTime
WaitForSingleObject
GetCurrentThread
WriteFile
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
GetLogicalProcessorInformation
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
LoadLibraryExW
EnumCalendarInfoW
LocalAlloc
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
CreateEventW
VirtualQueryEx
GetThreadLocale
SetThreadLocale
Sleep
ole32
CoInitialize
CoUninitialize
user32
GetMessageW
TranslateMessage
CharLowerBuffW
CharUpperW
PeekMessageW
GetSystemMetrics
MessageBoxA
MessageBoxW
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
GetCursorPos
DispatchMessageW
oleaut32
SysFreeString
VariantClear
VariantInit
GetErrorInfo
SysReAllocStringLen
SafeArrayCreate
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType
msvcrt
memcpy
memset
advapi32
CryptDeriveKey
CryptGetKeyParam
CryptSetKeyParam
CryptDecrypt
CryptDestroyKey
CryptImportKey
CryptDestroyHash
RegOpenKeyExW
CryptGetHashParam
CryptReleaseContext
RegQueryValueExW
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 49KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 568B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 109B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.pdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ