clbcatq[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

clbcatq.dll
Size

492KB
MD5

daa88213cbbabc1d7edcd065e9c79e3b
SHA1

c307223d2ad72324ff05c44f2f47232d9a49ce72
SHA256

d6d2aa835b65982716cca908b8676ff5635da69988f400dac0512a2ff0ce8a83
SHA512

30e0b4ae846de10257b08d3fe43b87be717c1fdfdf563527d0cefb4e578ba2fe59424b0b87f739bc6d950a6a484d9a630a55b887f2384dda5e69b180245b455e
SSDEEP

12288:TOXZ/zvRHMhpJquM/6Z+Dy9eiMvTB+rRMkDhXiApEcDDhzDszuWeK45z0JAEUnFx:qzvRHMhpJquM/6Z+Dy9eiMvTB+rykDzN

Score

1^/10

Malware Config

Signatures

Files

clbcatq.dll
.dll regsvr32 windows:10 windows x86 arch:x86

d3fb7ffc72ab4fcab227522c06cc5a9b

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:93:84:ec:93:dd:f1:29:0f:bf:eb:f8:b0:db:32:8b:b0:7d:19:b0:5e:a9:2a:22:5d:0c:84:3e:ba:6e:03:25
Signer

Actual PE Digest

13:93:84:ec:93:dd:f1:29:0f:bf:eb:f8:b0:db:32:8b:b0:7d:19:b0:5e:a9:2a:22:5d:0c:84:3e:ba:6e:03:25

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CLBCatQ.pdb

Imports

msvcrt

_XcptFilter
qsort
_i64tow_s
_vsnprintf
_initterm
__CxxFrameHandler3
_except_handler4_common
wcsrchr
?terminate@@YAXXZ
_vsnprintf_s
free
wcsncmp
_purecall
_local_unwind4
??0exception@@QAE@ABV0@@Z
_amsg_exit
_wcsnicmp
_wsplitpath_s
realloc
_waccess
_wtol
_ltow
wcschr
_CxxThrowException
wcstombs
mbstowcs
memmove
towupper
memcmp
memcpy
??1type_info@@UAE@XZ
wcsstr
_wcslwr
__dllonexit
wcstol
??0exception@@QAE@XZ
malloc
_lock
_unlock
??1exception@@UAE@XZ
_wcsicmp
memcpy_s
_stricmp
_vsnwprintf
_wmakepath_s
_onexit
memset

ntdll

NtQueryEvent
RtlImageNtHeader
NtOpenEvent
RtlInitUnicodeString
RtlAllocateHeap
RtlWow64IsWowGuestMachineSupported
NtQueryInformationProcess
WinSqmSetDWORD
RtlFreeHeap

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegSetValueExW
RegDeleteTreeW
RegDeleteKeyExW
RegFlushKey
RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
RegDeleteValueW

api-ms-win-core-com-l1-1-0

CoGetCallContext
CoCreateInstanceEx
CoRevertToSelf
StringFromCLSID
CoSetProxyBlanket
CoGetObjectContext
StringFromGUID2
CoCreateGuid
CoImpersonateClient
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoGetMalloc
CLSIDFromString
CreateStreamOnHGlobal

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LoadResource
DisableThreadLibraryCalls
LoadStringW
GetModuleFileNameA
LockResource
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection
InitializeSRWLock
InitializeCriticalSectionAndSpinCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetLengthSid
GetTokenInformation
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorGroup
DuplicateTokenEx
GetSecurityDescriptorLength
AddAccessDeniedAce
GetAclInformation
GetSecurityDescriptorDacl

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetExitCodeProcess
OpenThreadToken
OpenProcessToken
GetCurrentProcess
CreateProcessW
GetCurrentThreadId
TerminateProcess
CreateProcessAsUserW
SetThreadStackGuarantee
SetThreadToken
GetCurrentProcessId

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCurrentDirectoryW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GlobalMemoryStatusEx
GetSystemDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsDBCSLeadByte
GetSystemDefaultLCID

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
VirtualAlloc
CreateFileMappingW
VirtualFree

api-ms-win-core-file-l2-1-0

MoveFileWithProgressW
MoveFileExW

api-ms-win-core-file-l1-1-0

GetLongPathNameW
DeleteFileW
SetFileAttributesW
CreateDirectoryW
GetFileType
GetFileSizeEx
WriteFile
SetFilePointer
CreateFileW
FindFirstFileW
FindNextFileW
GetFileAttributesW
ReadFile
SetEndOfFile
GetTempFileNameW
FindClose
FlushFileBuffers

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-security-base-private-l1-1-0

MakeAbsoluteSD2

api-ms-win-core-com-private-l1-1-0

CLSIDFromOle1Class
CoGetModuleType

rpcrt4

UuidFromStringW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernel32

GetComputerNameW

Exports

Exports

ActivatorUpdateForIsRouterChanges
CLSIDFromStringByBitness
CheckMemoryGates
CoRegCleanup
ComPlusEnablePartitions
ComPlusEnableRemoteAccess
ComPlusMigrate
ComPlusPartitionsEnabled
ComPlusRemoteAccessEnabled
CreateComponentLibraryEx
DeleteAllActivatorsForClsid
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DowngradeAPL
GetCatalogObject
GetCatalogObject2
GetComputerObject
GetGlobalBabyJITEnabled
GetSimpleTableDispenser
InprocServer32FromString
OpenComponentLibraryEx
OpenComponentLibraryOnMemEx
OpenComponentLibraryOnStreamEx
ServerGetApplicationType
SetSetupOpen
SetSetupSave
SetupOpen
SetupSave
UpdateFromAppChange
UpdateFromComponentChange

Sections

.text
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3fb7ffc72ab4fcab227522c06cc5a9b

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

13:93:84:ec:93:dd:f1:29:0f:bf:eb:f8:b0:db:32:8b:b0:7d:19:b0:5e:a9:2a:22:5d:0c:84:3e:ba:6e:03:25Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-security-base-private-l1-1-0

api-ms-win-core-com-private-l1-1-0

rpcrt4

api-ms-win-core-version-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 439KB - Virtual size: 439KB

.data Size: 2KB - Virtual size: 15KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 128B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 21KB - Virtual size: 20KB

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

13:93:84:ec:93:dd:f1:29:0f:bf:eb:f8:b0:db:32:8b:b0:7d:19:b0:5e:a9:2a:22:5d:0c:84:3e:ba:6e:03:25
Signer

.text
Size: 439KB - Virtual size: 439KB

.data
Size: 2KB - Virtual size: 15KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 128B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 21KB - Virtual size: 20KB