Static task
static1
Behavioral task
behavioral1
Sample
clwc.exe
Resource
win11-20240221-en
General
-
Target
clwc.exe
-
Size
384KB
-
MD5
1c04d986e2fdbef2bd462fe2dc3e0047
-
SHA1
0548259c01b5391463e0524f2cdeeed0af7da5e8
-
SHA256
cbb488de7c6fb7b1c91dec1f4ead20e7ac276e762c42bcd5c309ee0992c67758
-
SHA512
d9598e7c650521fee11b4f6a4886946ceca06774b23c23527b86aa891fccd956ab2818cbcb83e5440017ec2eeaa9e2373be0aa81fc8cb4dd0dd42d8c85d6e5ab
-
SSDEEP
12288:Gs67RZNnNm/vdqjtZIh3gk48zGt0s5tq4:/67RZNN0vdqZZIh3n430s5tq4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource clwc.exe
Files
-
clwc.exe.exe .pdf windows:4 windows x86 arch:x86 polyglot
Password: infected
42e8d8d0e7aa5de09a244354708d115e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
SetLastError
ExitProcess
GetStartupInfoA
GetStdHandle
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
FreeLibrary
GetSystemInfo
LoadLibraryA
GetProcAddress
CreateFileW
GetFileAttributesW
CreateDirectoryW
GetConsoleMode
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsGetValue
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
FindResourceA
FindResourceExA
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
GetWindowsDirectoryA
GetVersionExA
CompareStringA
GetLocaleInfoA
GetDateFormatA
EnumCalendarInfoA
FormatMessageW
LoadLibraryW
GetModuleFileNameW
GetCommandLineW
GetSystemDirectoryW
CompareStringW
GetLocaleInfoW
FreeResource
LockResource
VirtualFree
VirtualQuery
LoadResource
SizeofResource
GetFileTime
SetFileTime
GetLocalTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
Wow64DisableWow64FsRedirection
Wow64EnableWow64FsRedirection
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SafeArrayCreate
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayPtrOfIndex
VariantChangeTypeEx
VariantClear
VariantCopy
VariantInit
user32
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
SystemParametersInfoA
GetSystemMetrics
MessageBeep
advapi32
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegFlushKey
Sections
.text Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 19KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ