clusapi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

clusapi.dll
Size

803KB
MD5

8e434da7d395238265d4c8c849b9f23f
SHA1

e5c2b949f94a1b7d5e85a093a466b14de8b079f2
SHA256

cd4faed96f8107f27f6ba0304a0084bcdd8c14bed83617a9cdda7ccad3e35538
SHA512

a19b35ac386693b28e34083d65f5cede6f6130eb4f9c5feaa35d1eb399fc7588b935c2ce953893baeb235f1a2f6303c0b11c597d3e20369b3e03dabe0db869dd
SSDEEP

24576:oeZZ/eULi59Zx6/QEvnmYsJMk55a3JocsV3HMDg/MtH:oeZZRi59Zx6/QEvnmYs6k54Jo5ZHMDgQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
clusapi.dll

Files

clusapi.dll
.dll windows:10 windows x86 arch:x86

c1b46f736191132309b4ab35f29707d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ClusApi.pdb

Imports

rpcrt4

UuidFromStringW
UuidCreate
RpcAsyncInitializeHandle
RpcMgmtSetComTimeout
RpcAsyncCancelCall
NdrAsyncClientCall2
NdrClientCall4
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcErrorGetNextRecord
RpcErrorStartEnumeration
RpcErrorEndEnumeration
RpcBindingReset
RpcSmDestroyClientContext
RpcStringFreeW
RpcAsyncCompleteCall
RpcBindingFree
RpcBindingSetAuthInfoExW

ntdll

RtlLengthSecurityDescriptor
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
EtwEventRegister
EtwEventWrite
RtlAllocateHeap
RtlIpv4StringToAddressW
RtlValidSecurityDescriptor
RtlInitString
RtlIpv6StringToAddressExW
RtlIpv4AddressToStringExW
EtwEventWriteString
EtwEventUnregister
RtlIpv4StringToAddressExW
RtlIpv6AddressToStringExW
NtQuerySystemInformation
RtlUnwind
RtlFreeHeap
RtlNtStatusToDosError
RtlMakeSelfRelativeSD
EtwEventEnabled

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLCID
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
LCMapStringW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TlsSetValue
GetCurrentThread
TlsGetValue
TlsAlloc
ExitProcess
GetStartupInfoW
SetThreadToken
CreateThread
TerminateProcess
GetCurrentProcess
ExitThread
GetCurrentProcessId
GetExitCodeThread
TlsFree
GetCurrentThreadId
OpenThreadToken

api-ms-win-core-heap-l1-1-0

HeapSize
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadStringW
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
FreeLibraryAndExitThread
FreeLibrary
GetProcAddress
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
InitializeSRWLock
AcquireSRWLockShared
ResetEvent
CreateMutexExW
SetEvent
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
CreateEventW
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
ReleaseSemaphore
ReleaseMutex

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
GetComputerNameExW

api-ms-win-security-base-l1-1-0

GetLengthSid
InitializeAcl
FreeSid
GetAce
IsValidAcl
IsValidSid
AreAnyAccessesGranted
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
MapGenericMask
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
GetTokenInformation
CreateWellKnownSid
AdjustTokenPrivileges
ImpersonateSelf
AddAccessAllowedAce
InitializeSecurityDescriptor
MakeAbsoluteSD
MakeSelfRelativeSD
GetSecurityDescriptorDacl
GetSecurityDescriptorLength
SetSecurityDescriptorDacl

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-file-l1-1-0

SetFilePointerEx
WriteFile
GetFileSizeEx
CreateFileW
GetVolumePathNameW
GetFileType
FindClose
FindNextFileW
FindFirstFileExW
FlushFileBuffers

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-registry-l1-1-0

RegGetKeySecurity
RegNotifyChangeKeyValue
RegQueryValueExW
RegRestoreKeyW
RegSaveKeyExW
RegCloseKey
RegFlushKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyExW
RegQueryInfoKeyW

bcrypt

BCryptHashData
BCryptCreateHash
BCryptFinishHash
BCryptDestroyHash

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode
GetConsoleOutputCP

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsGetValue
FlsFree
FlsAlloc

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
RegisterWaitForSingleObject
UnregisterWait

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
LsaFreeMemory

api-ms-win-security-activedirectoryclient-l1-1-0

DsFreeNameResultW
DsUnBindW
DsMakePasswordCredentialsW
DsCrackNamesW
DsFreePasswordCredentials

kernelbase

ResolveDelayLoadedAPI

dnsapi

DnsValidateName_W

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AddClusterGroupDependency
AddClusterGroupSetDependency
AddClusterGroupToGroupSetDependency
AddClusterNode
AddClusterResourceDependency
AddClusterResourceNode
AddClusterStorageNode
AddCrossClusterGroupSetDependency
AddResourceToClusterSharedVolumes
AddResourceToClusterSharedVolumesEx
BackupClusterDatabase
CCHlpAddNodeUpdateCluster
CCHlpConfigureNode
CCHlpCreateClusterNameCOIfNotExists
CCHlpCreateClusterNameInAD
CCHlpGetClusterServiceSecret
CCHlpGetDNSHostLabel
CCHlpRestoreClusterVirtualObjectToInitialState
CanResourceBeDependent
CancelClusterGroupOperation
ChangeClusterResourceGroup
ChangeClusterResourceGroupEx
CloseCluster
CloseClusterGroup
CloseClusterGroupSet
CloseClusterNetInterface
CloseClusterNetwork
CloseClusterNode
CloseClusterNotifyPort
CloseClusterResource
CluFreeFaultDomainInfo
CluFreeGuidArrayPtr
CluFreeStr
CluGetDriveInfo
CluGetFaultDomainObject
CluGetFaultDomainObjects
CluRemoveFaultDomainObject
ClusterAddGroupToAffinityRule
ClusterAddGroupToGroupSet
ClusterAddGroupToGroupSetWithDomains
ClusterAffinityRuleControl
ClusterCaptureLiveDump
ClusterChangeVMSettings
ClusterCloseEnum
ClusterCloseEnumEx
ClusterControl
ClusterCreateAffinityRule
ClusterCreateClusterStorageEnclosure
ClusterCreateFaultDomain
ClusterCreateFaultDomainFromXML
ClusterCreateVMReservation
ClusterCreateVMReservationWithDomains
ClusterEnum
ClusterEnumEx
ClusterFreeMemory
ClusterFreeMrrResponse
ClusterFreeVMReservation
ClusterGetClusterStorageEnclosureObject
ClusterGetClusterStorageEnclosureObjects
ClusterGetDriveInfo
ClusterGetEnumCount
ClusterGetEnumCountEx
ClusterGetFaultDomainObject
ClusterGetFaultDomainObjects
ClusterGetFaultDomainState
ClusterGetFaultDomainXML
ClusterGetPlacementScore
ClusterGroupCloseEnum
ClusterGroupCloseEnumEx
ClusterGroupControl
ClusterGroupEnum
ClusterGroupEnumEx
ClusterGroupGetEnumCount
ClusterGroupGetEnumCountEx
ClusterGroupOpenEnum
ClusterGroupOpenEnumEx
ClusterGroupSetCloseEnum
ClusterGroupSetControl
ClusterGroupSetEnum
ClusterGroupSetGetEnumCount
ClusterGroupSetOpenEnum
ClusterNetInterfaceCloseEnum
ClusterNetInterfaceControl
ClusterNetInterfaceEnum
ClusterNetInterfaceOpenEnum
ClusterNetworkCloseEnum
ClusterNetworkControl
ClusterNetworkEnum
ClusterNetworkGetEnumCount
ClusterNetworkHealthFreeInterfaceConnections
ClusterNetworkHealthFreeNodeConnections
ClusterNetworkHealthGetInterfaceConnections
ClusterNetworkHealthGetNodeConnections
ClusterNetworkOpenEnum
ClusterNodeCloseEnum
ClusterNodeCloseEnumEx
ClusterNodeControl
ClusterNodeEnum
ClusterNodeEnumEx
ClusterNodeGetEnumCount
ClusterNodeGetEnumCountEx
ClusterNodeOpenEnum
ClusterNodeOpenEnumEx
ClusterNodeReplacement
ClusterOpenEnum
ClusterOpenEnumEx
ClusterRegBatchAddCommand
ClusterRegBatchCloseNotification
ClusterRegBatchReadCommand
ClusterRegCloseBatch
ClusterRegCloseBatchEx
ClusterRegCloseBatchNotifyPort
ClusterRegCloseKey
ClusterRegCloseReadBatch
ClusterRegCloseReadBatchEx
ClusterRegCloseReadBatchReply
ClusterRegCreateBatch
ClusterRegCreateBatchNotifyPort
ClusterRegCreateKey
ClusterRegCreateKeyForceSync
ClusterRegCreateReadBatch
ClusterRegDeleteKey
ClusterRegDeleteKeyForceSync
ClusterRegDeleteValue
ClusterRegDeleteValueForceSync
ClusterRegEnumKey
ClusterRegEnumValue
ClusterRegGetBatchNotification
ClusterRegGetKeySecurity
ClusterRegOpenKey
ClusterRegQueryAllValues
ClusterRegQueryInfoKey
ClusterRegQueryValue
ClusterRegReadBatchAddCommand
ClusterRegReadBatchReplyNextCommand
ClusterRegSetKeySecurity
ClusterRegSetValue
ClusterRegSetValueForceSync
ClusterRegSyncDatabase
ClusterRemoveAffinityRule
ClusterRemoveClusterStorageEnclosure
ClusterRemoveFaultDomain
ClusterRemoveGroupFromAffinityRule
ClusterRemoveGroupFromGroupSet
ClusterResourceCloseEnum
ClusterResourceCloseEnumEx
ClusterResourceControl
ClusterResourceControlAsUser
ClusterResourceEnum
ClusterResourceEnumEx
ClusterResourceGetEnumCount
ClusterResourceGetEnumCountEx
ClusterResourceOpenEnum
ClusterResourceOpenEnumEx
ClusterResourceTypeCloseEnum
ClusterResourceTypeControl
ClusterResourceTypeControlAsUser
ClusterResourceTypeEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeOpenEnum
ClusterSendReceiveMrr
ClusterSendReceiveMrrAsUser
ClusterSetAccountAccess
ClusterSetClusterStorageEnclosure
ClusterSetFaultDomain
ClusterSetNodeFaultDomain
ClusterSharedVolumeClearBackupState
ClusterSharedVolumeSetSnapshotState
ClusterStmFindDisk
ClusterUpgradeFunctionalLevel
ClusterUpgradeFunctionalLevelEx
CreateCluster
CreateClusterAvailabilitySet
CreateClusterGroup
CreateClusterGroupEx
CreateClusterGroupSet
CreateClusterManagementPoint
CreateClusterNameAccount
CreateClusterNotifyPort
CreateClusterNotifyPortV2
CreateClusterResource
CreateClusterResourceType
CreateClusterResourceWithId
DeleteClusterGroup
DeleteClusterGroupSet
DeleteClusterResource
DeleteClusterResourceType
DestroyCluster
DestroyClusterGroup
DetermineCNOResTypeFromCluster
DetermineCNOResTypeFromNodelist
DetermineClusterCloudTypeFromCluster
DetermineClusterCloudTypeFromNodelist
EvictClusterNode
EvictClusterNodeEx
FailClusterResource
FreeClusFaultDomainInfo
FreeClusFaultDomainInfoArray
FreeClusFaultDomainXML
FreeClusStorageEnclosureInfo
FreeClusStorageEnclosureInfoArray
GetClusterFromGroup
GetClusterFromNetInterface
GetClusterFromNetwork
GetClusterFromNode
GetClusterFromResource
GetClusterGroupKey
GetClusterGroupState
GetClusterInformation
GetClusterKey
GetClusterNetInterface
GetClusterNetInterfaceKey
GetClusterNetInterfaceState
GetClusterNetworkId
GetClusterNetworkKey
GetClusterNetworkState
GetClusterNodeId
GetClusterNodeKey
GetClusterNodeState
GetClusterNotify
GetClusterNotifyV2
GetClusterQuorumResource
GetClusterResourceDependencyExpression
GetClusterResourceKey
GetClusterResourceNetworkName
GetClusterResourceState
GetClusterResourceTypeKey
GetClusterSharedVolumeNameForFile
GetNodeCloudTypeDW
GetNodeClusterState
GetNotifyEventHandle
InitializeClusFaultDomainInfo
InitializeClusFaultDomainInfoArray
InitializeClusStorageEnclosureInfo
InitializeClusStorageEnclosureInfoArray
IsFileOnClusterSharedVolume
MoveClusterGroup
MoveClusterGroupEx
OfflineClusterGroup
OfflineClusterGroupEx
OfflineClusterResource
OfflineClusterResourceEx
OnlineClusterGroup
OnlineClusterGroupEx
OnlineClusterResource
OnlineClusterResourceEx
OpenCluster
OpenClusterEx
OpenClusterEx2
OpenClusterGroup
OpenClusterGroupEx
OpenClusterGroupSet
OpenClusterNetInterface
OpenClusterNetInterfaceEx
OpenClusterNetwork
OpenClusterNetworkEx
OpenClusterNode
OpenClusterNodeById
OpenClusterNodeEx
OpenClusterResource
OpenClusterResourceEx
PauseClusterNode
PauseClusterNodeEx
RegisterClusterNotify
RegisterClusterNotifyV2
RegisterClusterResourceTypeNotifyV2
RemoveClusterGroupDependency
RemoveClusterGroupSetDependency
RemoveClusterGroupToGroupSetDependency
RemoveClusterNameAccount
RemoveClusterResourceDependency
RemoveClusterResourceNode
RemoveClusterStorageNode
RemoveCrossClusterGroupSetDependency
RemoveResourceFromClusterSharedVolumes
RestartClusterResource
RestoreClusterDatabase
ResumeClusterNode
ResumeClusterNodeEx
SetClusterGroupName
SetClusterGroupNodeList
SetClusterGroupSetDependencyExpression
SetClusterName
SetClusterNetworkName
SetClusterNetworkPriorityOrder
SetClusterQuorumResource
SetClusterResourceDependencyExpression
SetClusterResourceName
SetClusterServiceAccountPassword
SetGroupDependencyExpression

Sections

.text
Size: 741KB - Virtual size: 740KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1b46f736191132309b4ab35f29707d7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

ntdll

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-registry-l1-1-0

bcrypt

api-ms-win-core-realtime-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

kernelbase

dnsapi

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 741KB - Virtual size: 740KB

.data Size: 14KB - Virtual size: 19KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 380B

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 741KB - Virtual size: 740KB

.data
Size: 14KB - Virtual size: 19KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 380B

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 31KB - Virtual size: 31KB