ClipUp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ClipUp.exe
Size

1.1MB
MD5

796bffedc3261812e54ab12bb255704f
SHA1

f14721f99efbff5b5ed1ab91ed6d7fa55002439c
SHA256

38eb13a07067097f67ae43d325b20e327ab4ced6219b031785a99f7f68408856
SHA512

56e29a78fc942128d2f6508831c83064c121fde7e006a5a291cb12681f9584d8c25d431d65d8b36aa7ad79c9810cadce7ee2ba95ce1d5724aa2eec7c779b7298
SSDEEP

24576:uWLQDrbnOE1rhwbQoMXDnUe+K8hkUSmi23:XE37f11Do8z7+NhfJ3

Score

1^/10

Malware Config

Signatures

Files

ClipUp.exe
.exe windows x64

5dd332d22060ceb44d5347fce1989751

Code Sign

33:00:00:03:f1:30:7f:58:4e:59:80:81:54:00:00:00:00:03:f1
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/10/2022, 19:43

Not After

11/10/2023, 19:43

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:06:56:81:74:19:ea:ce:8f:db:8d:56:52:05:87:cb:2f:61:cb:1d:07:34:f4:3e:51:72:63:6f:e3:c0:18:f9
Signer

Actual PE Digest

06:06:56:81:74:19:ea:ce:8f:db:8d:56:52:05:87:cb:2f:61:cb:1d:07:34:f4:3e:51:72:63:6f:e3:c0:18:f9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
memchr
memcmp
memcpy
memmove
memset
?terminate@@YAXXZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
__C_specific_handler
malloc
free
time
__iob_func
qsort
_itow_s
_wcsnicmp
memcpy_s
wcsstr
rand
_wtoi
swscanf_s
srand
wprintf
wcsncmp
vfwprintf
wcschr
_purecall
vwprintf
_wcsicmp
towlower
log10
wcscmp

api-ms-win-core-file-l1-1-0

GetFileType
FindClose
GetFileSize
WriteFileEx
WriteFile
DeleteFileW
CreateDirectoryW
GetFileAttributesW
CompareFileTime
SetFilePointer
FindFirstFileW
FindNextFileW
CreateFileW
ReadFile
GetTempFileNameW

oleaut32

SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
VariantClear
SafeArrayDestroy
VariantInit
SysAllocString
SysFreeString

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryValueExW
RegOpenCurrentUser
RegSetKeySecurity
RegDeleteValueW
RegCloseKey

bcrypt

BCryptKeyDerivation
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptVerifySignature
BCryptGenerateSymmetricKey
BCryptImportKeyPair
BCryptDestroyKey
BCryptExportKey
BCryptCloseAlgorithmProvider
BCryptGenerateKeyPair
BCryptImportKey
BCryptGenRandom
BCryptFinishHash
BCryptDestroyHash
BCryptSignHash
BCryptHashData
BCryptSetProperty
BCryptFinalizeKeyPair
BCryptCreateHash

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
ReleaseSemaphore
SleepEx

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetCommandLineW
ExpandEnvironmentStringsW

ncrypt

NCryptImportKey
NCryptOpenStorageProvider
NCryptFreeObject
NCryptExportKey

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LockResource
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
FindResourceExW
LoadResource
LoadLibraryExA
LoadLibraryExW
FreeLibrary

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoCreateInstance
IIDFromString
CoInitializeEx

api-ms-win-core-processthreads-l1-1-0

InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentThreadId
GetCurrentProcess
GetExitCodeProcess
OpenProcessToken
CreateProcessW
TerminateProcess
GetCurrentProcessId
GetCurrentThread

crypt32

CryptQueryObject
CryptImportPublicKeyInfoEx2
CertFreeCertificateContext

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringEx
LCMapStringW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExA
GetTickCount
GetSystemInfo
GetVersionExW
GetSystemDirectoryW
GetSystemTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect

api-ms-win-security-cryptoapi-l1-1-0

CryptImportKey
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
CryptVerifySignatureW
CryptDestroyKey
CryptHashData
CryptAcquireContextW
CryptGetHashParam

api-ms-win-security-base-l1-1-0

FreeSid
GetLengthSid
GetTokenInformation

rpcrt4

I_RpcMapWin32Status
UuidCreate

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlAddFunctionTable
RtlCaptureContext
RtlDeleteFunctionTable

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlGetPersistedStateLocation

cryptxml

CryptXmlOpenToDecode
CryptXmlClose
CryptXmlEncode
CryptXmlVerifySignature
CryptXmlSign
CryptXmlGetReference
CryptXmlGetDocContext
CryptXmlGetStatus
CryptXmlGetSignature
CryptXmlOpenToEncode
CryptXmlCreateReference

webservices

WsReadElement
WsFreeReader
WsReadStartAttribute
WsReadEndAttribute
WsMoveReader
WsGetReaderNode
WsSetInputToBuffer
WsFreeHeap
WsFindAttribute
WsGetReaderPosition
WsSetReaderPosition
WsReadStartElement
WsCreateError
WsReadChars
WsReadToStartElement
WsFreeError
WsCreateHeap
WsCreateReader
WsSkipNode
WsReadXmlBufferFromBytes
WsDateTimeToFileTime

api-ms-win-appmodel-runtime-l1-1-0

PackageNameAndPublisherIdFromFamilyName

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 836KB - Virtual size: 835KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5dd332d22060ceb44d5347fce1989751

Code Sign

33:00:00:03:f1:30:7f:58:4e:59:80:81:54:00:00:00:00:03:f1Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

06:06:56:81:74:19:ea:ce:8f:db:8d:56:52:05:87:cb:2f:61:cb:1d:07:34:f4:3e:51:72:63:6f:e3:c0:18:f9Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-file-l1-1-0

oleaut32

api-ms-win-core-registry-l1-1-0

bcrypt

api-ms-win-core-console-l2-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

ncrypt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

crypt32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-memory-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-profile-l1-1-0

ntdll

cryptxml

webservices

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 836KB - Virtual size: 835KB

.rdata Size: 202KB - Virtual size: 201KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 26KB - Virtual size: 26KB

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 7KB

33:00:00:03:f1:30:7f:58:4e:59:80:81:54:00:00:00:00:03:f1
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

06:06:56:81:74:19:ea:ce:8f:db:8d:56:52:05:87:cb:2f:61:cb:1d:07:34:f4:3e:51:72:63:6f:e3:c0:18:f9
Signer

.text
Size: 836KB - Virtual size: 835KB

.rdata
Size: 202KB - Virtual size: 201KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 26KB - Virtual size: 26KB

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 7KB