pclient[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

pclient.exe
Size

2.8MB
MD5

ae13c23cad4370cdaaaa690a8a7e3c14
SHA1

5e2b3b31bdfce478d7a6d3ad681d84b40c911a9c
SHA256

1dd4c3eec793d5bed9593e1fa3970f99ce907d1b2c342006fbadc96859b73882
SHA512

ddbb0bd84ec98a451e2d4b214826dc94a8ceb00b2daa7f54d27d837b439d662be0ab691a022b5e1f911a583a3be6dd2dd1271f94068b5932e55f7e041b4ecdc9
SSDEEP

49152:Ls8YbWXeSziEMyLqwCvOvlRO5VK1wTeJxx:IB2lROPKWTeH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pclient.exe

Files

pclient.exe
.exe windows:6 windows x64 arch:x64

e03c67dc1555404d61b3dc09454d4ca5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapCreate
LoadLibraryA
GetProcAddress
GetModuleHandleA
WriteConsoleW
CloseHandle
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx

gdi32

PlayMetaFile
GdiFlush
SetBitmapDimensionEx
ScaleViewportExtEx
OffsetWindowOrgEx
Arc
BitBlt
Chord
CombineRgn
CopyMetaFileW
CreateHatchBrush
EnumFontFamiliesW
EqualRgn
GetBkColor
GetDCBrushColor
GetCharWidthW
GetMetaRgn
GetCurrentObject
GetCurrentPositionEx
GetPixel
GetStockObject
GetTextAlign
GetTextExtentPoint32W
GetGlyphIndicesW
GetViewportOrgEx
IntersectClipRect
PlgBlt
GetObjectW
ResizePalette
SetDCBrushColor
SetBoundsRect
SetDIBits
SetMetaFileBitsEx
SetPaletteEntries
StretchBlt
PlayMetaFileRecord
EnumEnhMetaFile
GetEnhMetaFileDescriptionW
GetWinMetaFileBits
PlayEnhMetaFileRecord
PolyPolyline
GetDIBColorTable
GetColorAdjustment
SelectClipPath
StrokePath
GetMiterLimit
GetArcDirection
MoveToEx

shell32

Shell_NotifyIconW
SHBrowseForFolderW
ord75

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e03c67dc1555404d61b3dc09454d4ca5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

shell32

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 241KB - Virtual size: 241KB

.data Size: 208KB - Virtual size: 232KB

.pdata Size: 4KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 241KB - Virtual size: 241KB

.data
Size: 208KB - Virtual size: 232KB

.pdata
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB