chlorinates[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

chlorinates.exe
Size

13.3MB
MD5

7604a8bc5e2f8aa350a0e142388d44ab
SHA1

1f462fbbc10d2ee5e9894a6fc0e9de0706ee525f
SHA256

10acfc44e2ca27846698b4ce3bd09be1fd3a3cae5f4ca1c8d18b51d2493c8a99
SHA512

466ef6b92390738051c71289adf2908725206a85d61b5be1aa867399384bc8f7ef66ac8f9f46518c9ca40e7a1e1c69583d1cb2f6e061c375855ba9c107ce6c8c
SSDEEP

393216:ijxK+okzk1UbMnYnmqJ8NCIXWHfEizt5:ijxK+okg18MYY8IXWHfEG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chlorinates.exe

Files

chlorinates.exe
.dll windows:4 windows x64 arch:x64

aadf689fa92bc31330a0abdc4d11efd6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

ApplicationRecoveryInProgress
CheckElevation
CloseThreadpoolTimer
CreateBoundaryDescriptorA
CreateEventA
CreateFileMappingW
CreateFileW
CreateHardLinkTransactedA
CreateIoCompletionPort
CreateNamedPipeA
CreateNamedPipeW
CreateProcessInternalW
CreateSemaphoreExW
CreateThread
DeleteVolumeMountPointW
DuplicateConsoleHandle
EnableThreadProfiling
EnterCriticalSection
EnumDateFormatsExEx
EnumResourceLanguagesA
EnumSystemCodePagesW
EnumSystemLocalesA
EnumUILanguagesA
FileTimeToSystemTime
FindNextFileNameW
GetActiveProcessorCount
GetAtomNameW
GetCommConfig
GetConsoleAliasExesLengthA
GetConsoleAliasesLengthA
GetConsoleCommandHistoryLengthW
GetConsoleFontSize
GetDefaultCommConfigA
GetDurationFormat
GetExpandedNameA
GetFileAttributesA
GetFileAttributesTransactedW
GetFileMUIPath
GetFileTime
GetLogicalProcessorInformation
GetNumaNodeProcessorMask
GetNumberFormatW
GetProcAddress
GetProcessPreferredUILanguages
GetProcessShutdownParameters
GetProfileSectionA
GetStartupInfoW
GetSystemDefaultLCID
GetSystemPowerStatus
GetTickCount
GetTickCount64
GetUserDefaultUILanguage
GetWindowsDirectoryA
GlobalUnfix
HeapFree
InitOnceBeginInitialize
IsProcessorFeaturePresent
IsThreadpoolTimerSet
IsValidCalDateTime
LZCopy
LoadLibraryA
LoadStringBaseW
MapViewOfFileEx
OpenFileMappingW
OpenJobObjectA
OpenMutexW
PostQueuedCompletionStatus
ProcessIdToSessionId
QueryPerformanceFrequency
ReleaseMutex
RemoveDirectoryW
ReplaceFileW
ReplacePartitionUnit
SetCalendarInfoA
SetCurrentDirectoryA
SetDllDirectoryA
SetFileApisToANSI
SetSystemFileCacheSize
SetThreadIdealProcessorEx
SetThreadLocale
SubmitThreadpoolWork
TzSpecificLocalTimeToSystemTimeEx
UnregisterApplicationRestart
UnregisterWaitEx
UpdateResourceW
WaitNamedPipeW
WakeConditionVariable
WriteConsoleA
WriteConsoleInputA
WriteConsoleInputVDMW
WriteConsoleW
lstrcpynA
lstrcpynW

msvcrt

_chmod
_execlpe
_execlp
_getche
_heapwalk
_sopen
_spawnvp
_strlwr
_tzset
fgetc
fputs
free
iswprint
malloc
memcpy
memset
sinh
sscanf_s
strlen
wcscat_s
wcsncat_s
wcstol

shell32

DriveType
ExtractAssociatedIconExW
ReadCabinetState
SHCreateItemFromIDList
SHFormatDrive
SHHandleUpdateImage
SHQueryUserNotificationState
SHReplaceFromPropSheetExtArray
SHResolveLibrary
SHStartNetConnectionDialogW
SHUpdateRecycleBinIcon
Shell_GetCachedImageIndex

user32

AnyPopup
BlockInput
CallMsgFilter
ChangeDisplaySettingsExW
CharLowerBuffA
CharUpperBuffA
ChildWindowFromPointEx
CloseClipboard
CopyAcceleratorTableW
CreateAcceleratorTableA
CreateDialogParamA
CreateMenu
DestroyReasons
DialogBoxIndirectParamW
DrawTextW
EndDialog
FrameRect
GetAltTabInfoA
GetCapture
GetClassNameA
GetClipboardFormatNameW
GetDC
GetDlgItemInt
GetKeyboardLayoutNameA
GetMenuStringA
GetMessageTime
GetScrollBarInfo
GetTopLevelWindow
GetWindowContextHelpId
GetWindowDC
GetWindowModuleFileName
GetWindowTextLengthA
GetWindowTextW
IMPSetIMEW
IsChild
IsIconic
IsRectEmpty
LoadKeyboardLayoutEx
MessageBoxTimeoutW
MsgWaitForMultipleObjectsEx
OemToCharW
PostThreadMessageW
PrintWindow
SendInput
SendMessageA
SendMessageW
SetDlgItemTextW
SetFocus
SetPhysicalCursorPos
SetTimer
SetWindowDisplayAffinity
SetWindowLongPtrW
SetWindowLongW
TileChildWindows
UnloadKeyboardLayout
VRipOutput
WinHelpW

Exports

Exports

Clinton_disassembled_inorganic
Ethan_enraptured
HTML_perfectionism_detainee
InitHelperDll
MHz_corrugating_budging
Maud_powered_pigtail
Metternich_integrating_proboscises
Test
_cgo_dummy_export
ablaze_habit_keeps
acquisition_lieu_buffaloed
autocracies_plunders_deluges
baton_braising_readouts
burnouses_dangled
burrs_felony
cactus_agonizing_fins
chiselling_belaboring
crocuses_permuted
dehydrateBeatrixMaryanne
disguisingCanadians
draftiest_mortgagor
fallow_waters
farthings_salsas
ficklest_incorrectly
grosses_merchandizing
hurdle_siting
informants_acknowledgements_kookaburra
lands_unworkable
lea_unchanging
liter_oak
louse_throughways
mountain_rev_dais
mover_kickoffs
overshared_apocryphal
predisposes_shampoo
pries_orchestrates
ragamuffins_grunges
rewiring_seeds
rivalled_squabbled
sisesCzerny_snuck
slaps_embassiesPhiladelphia
stalemates_letter_societal
stockyards_modifiableCozumel
subsisted_worthwhile
thorax_ganging
tiled_contraception

Sections

.text
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aadf689fa92bc31330a0abdc4d11efd6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

shell32

user32

Exports

Exports

Sections

.text Size: 10.5MB - Virtual size: 10.5MB

.data Size: 27KB - Virtual size: 26KB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.bss Size: - Virtual size: 5KB

.edata Size: 1KB - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 176B

.tls Size: 512B - Virtual size: 12B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 10.5MB - Virtual size: 10.5MB

.data
Size: 27KB - Virtual size: 26KB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.bss
Size: - Virtual size: 5KB

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 176B

.tls
Size: 512B - Virtual size: 12B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 19KB - Virtual size: 18KB