clfsw32[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

clfsw32.dll
Size

65KB
MD5

6cd165de3731c2887702f302a82b2787
SHA1

5e2f0824fc027e32be2d8d30117ce854f0a18299
SHA256

2348f0489f1b537b2ffcbeb83cb79c3a8016d78c1f2bcad4b2a04bca2de4a747
SHA512

cb0a74060cceb204d5ccf4a1b9f823a3fbf077ec4516c5f6ff52e4defe01f1e4ef830d6f4b50108f6b353dda07741d04d7fbcaa7dd647d4a656f71282b4ffeed
SSDEEP

1536:lo+DjglOk19RErILfeSNsrAgjv+MGyOF4M:u+wlOS9RErIKSNsrAgjvfGR4M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
clfsw32.dll

Files

clfsw32.dll
.dll windows:10 windows x86 arch:x86

ab68f7978da9d552520f1c31bf449794

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

clfsw32.pdb

Imports

msvcrt

_purecall
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
_callnewh
__iob_func
??_V@YAXPAX@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
??0exception@@QAE@ABV0@@Z
_local_unwind4
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
??3@YAXPAX@Z
fwprintf
wcsncmp
fflush
??1type_info@@UAE@XZ
memset

ntdll

NtQueryInformationFile
RtlEnterCriticalSection
NtCreateFile
RtlNtStatusToDosError
RtlFreeHeap
EtwUnregisterTraceGuids
NtClose
RtlPrefixUnicodeString
EtwGetTraceEnableFlags
RtlLeaveCriticalSection
RtlInitUnicodeString
EtwTraceMessage
RtlInitializeCriticalSectionAndSpinCount
RtlDosPathNameToRelativeNtPathName_U
EtwGetTraceLoggerHandle
RtlAppendUnicodeStringToString
RtlDeleteCriticalSection
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
NtSetInformationFile

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l1-1-0

HeapCreate
HeapDestroy
HeapFree
HeapAlloc

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

CreateEventA
LeaveCriticalSection
WaitForSingleObject

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

IsValidSecurityDescriptor
InitializeSecurityDescriptor

Exports

Exports

AddLogContainer
AddLogContainerSet
AdvanceLogBase
AlignReservedLog
AllocReservedLog
CLFS_LSN_INVALID
CLFS_LSN_NULL
CloseAndResetLogFile
CreateLogContainerScanContext
CreateLogFile
CreateLogMarshallingArea
DeleteLogByHandle
DeleteLogFile
DeleteLogMarshallingArea
DeregisterManageableLogClient
DumpLogRecords
FlushLogBuffers
FlushLogToLsn
FreeReservedLog
GetLogContainerName
GetLogFileInformation
GetLogIoStatistics
GetLogReservationInfo
GetNextLogArchiveExtent
HandleLogFull
InstallLogPolicy
LogTailAdvanceFailure
LsnBlockOffset
LsnContainer
LsnCreate
LsnDecrement
LsnEqual
LsnGreater
LsnIncrement
LsnInvalid
LsnLess
LsnNull
LsnRecordSequence
PrepareLogArchive
QueryLogPolicy
ReadLogArchiveMetadata
ReadLogNotification
ReadLogRecord
ReadLogRestartArea
ReadNextLogRecord
ReadPreviousLogRestartArea
RegisterForLogWriteNotification
RegisterManageableLogClient
RemoveLogContainer
RemoveLogContainerSet
RemoveLogPolicy
ReserveAndAppendLog
ReserveAndAppendLogAligned
ScanLogContainers
SetEndOfLog
SetLogArchiveMode
SetLogArchiveTail
SetLogFileSizeWithPolicy
TerminateLogArchive
TerminateReadLog
TruncateLog
ValidateLog
WriteLogRestartArea

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab68f7978da9d552520f1c31bf449794

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 55KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 55KB - Virtual size: 55KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB