Static task
static1
Behavioral task
behavioral1
Sample
cliconfg.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
cliconfg.exe
Resource
win10v2004-20230703-en
General
-
Target
cliconfg.exe
-
Size
30KB
-
MD5
e06c0d21ffe629d45e3f0067b86d2cea
-
SHA1
05eea2a01a7b63b43d8f465d190d206a890f3f30
-
SHA256
5b223b5bd106ff17c7817858cb6c371a055b54486e4c351ca952d6cd83a2da88
-
SHA512
9409d6d1c7ba6f069a551a37a20af278ede5db452974fd7b853722a96fe24b5c1a1d3bf251d52846067ca479b0697f92e16df236e6feb297331aae8db3c419f0
-
SSDEEP
384:+TO+UvOyKBxv9CtYUJW0wWFPXuNvBQAMYJQ2JQSkdowyo:+TO+UvOBxtU5ruI30lJBkvT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cliconfg.exe
Files
-
cliconfg.exe.exe windows x64
e0a4a433a88e43cfe20831b905227e5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FormatMessageW
GetLastError
GetProcAddress
LoadLibraryExW
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
TerminateProcess
user32
LoadIconW
TranslateMessage
RegisterClassW
DispatchMessageW
ShowWindow
CreateWindowExW
SetWindowLongPtrW
MessageBoxW
PostMessageW
DefWindowProcW
GetMessageW
PostQuitMessage
LoadCursorW
msvcrt
?terminate@@YAXXZ
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_commode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_vsnwprintf
_ismbblead
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ