freshclam[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

freshclam.exe
Size

148KB
MD5

47ba95a930f4e37f21ce0e5b54b7e9b9
SHA1

671cb4d021ff0b9cbdf29af180ba75570371298d
SHA256

2d1620b5916b09535ccfeb2f047d5a6b43977f0842d5858b7b7a05f3bddb05ff
SHA512

c69af7348de00dd15f793fe4383cb9c27b8e54a30d915812e4869ebd6ddbbd73630eb984c369b7926c02f3eec23e122c921ad8616b7e9f1fcd2da9ccaac1b809
SSDEEP

3072:rny+Pvzz0cN35KpNmnzHitUlnV11pbR4r+0PZCRD+QBJ6cox:rSAp0gznXR4S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
freshclam.exe

Files

freshclam.exe
.exe windows:6 windows x64 arch:x64

c86a32d3fb10e1e1a9d94a3a6c548255

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

libfreshclam

fc_cleanup
fc_initialize
fc_download_url_databases
fc_prune_database_directory
fc_set_fccb_download_complete
fc_update_databases
fc_strerror
fc_dns_query_update_info
fc_test_database

libclamav

cli_rmdirs
cli_gentemp_with_prefix
cli_regcomp
cli_regexec
cli_strdup
cli_ctime
cl_retdbdir
cl_cvdhead
cl_cvdfree
cli_realloc
cl_retflevel
cli_regfree
cl_init
cl_set_clcb_msg
cl_strerror
cli_strbcasestr
cli_calloc

pthreadvc3

pthread_mutex_unlock
pthread_mutex_lock

wsock32

connect
closesocket
WSAGetLastError
socket
send
recv

ws2_32

getaddrinfo
freeaddrinfo

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext
FindNextFileW
FindFirstFileW
FindClose
GetCommandLineW
GetCommandLineA
GetFileAttributesExW
CreateFileA
GetCurrentDirectoryW
CloseHandle
SetConsoleCtrlHandler
CreateThread
CreateEventA
WaitForSingleObject
SetEvent
WideCharToMultiByte
MultiByteToWideChar
MoveFileA
GetLastError
Sleep
GetCurrentProcessId
lstrcmpiA
GetModuleFileNameA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ChangeServiceConfig2A
CloseServiceHandle
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

vcruntime140

strchr
strstr
__C_specific_handler
memset
strrchr
memcpy
wcsstr
wcsrchr
memmove

api-ms-win-crt-runtime-l1-1-0

_cexit
_set_app_type
_get_initial_narrow_environment
_errno
_initterm_e
_exit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_crt_atexit
exit
_set_errno
_register_onexit_function
signal
system
__p___argv
__p___argc
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_initterm

api-ms-win-crt-string-l1-1-0

strpbrk
wcsncat
strncmp
_strnicmp
_strdup
strncpy
wcsncmp
wcsncpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
_setmode
__stdio_common_vsprintf
_set_fmode
__stdio_common_vfprintf
fgets
_fileno
fclose
__acrt_iob_func
fopen
fflush
__p__commode

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
malloc
calloc
free

api-ms-win-crt-time-l1-1-0

_time64
_ctime64
_localtime64_s
strftime

api-ms-win-crt-convert-l1-1-0

strtoul
atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_umask
_unlink
_mkdir

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c86a32d3fb10e1e1a9d94a3a6c548255

Headers

DLL Characteristics

File Characteristics

Imports

libfreshclam

libclamav

pthreadvc3

wsock32

ws2_32

kernel32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 85KB - Virtual size: 85KB

.data Size: 2KB - Virtual size: 68KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 85KB - Virtual size: 85KB

.data
Size: 2KB - Virtual size: 68KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 3KB - Virtual size: 2KB