Clin Vip[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Clin Vip.exe
Size

15.4MB
MD5

c36a2cc33c0c7da65e9f618a727104e2
SHA1

547d921b513cde5381d8432c5381d415d31cbd37
SHA256

8f0f4cf714b5d18c1a1edd666befc136d9c00014e37848647be7909458121d87
SHA512

0bc87fde61dc86162bd7933863e6799d05dd1a93fcb959ce1af77f351317d057ac516596de98da9f4c3754b7eaf50457c4a96d3e0180c7b0e65bb8d00101fb5f
SSDEEP

393216:NCxEki1zr+A/lH//fNjs6P1G2JuTab7clk:NCxkBr+A/x/XNjsiDjbQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Clin Vip.exe

Files

Clin Vip.exe
.exe windows:6 windows x64 arch:x64

52567219b7b06f0a63bcc62f8552fbfe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeviceIoControl
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

TranslateMessage

shell32

ShellExecuteW

msvcp140

??1_Lockit@std@@QEAA@XZ

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

ws2_32

getpeername

imm32

ImmGetContext

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr

api-ms-win-crt-runtime-l1-1-0

_set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-heap-l1-1-0

_aligned_free

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-time-l1-1-0

_time64

Sections

.text
Size: - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 563KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.'G`
Size: - Virtual size: 9.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.i4(
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.6kF
Size: 15.4MB - Virtual size: 15.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

52567219b7b06f0a63bcc62f8552fbfe

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

msvcp140

dwmapi

d3d9

ws2_32

imm32

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

Sections

.text Size: - Virtual size: 625KB

.rdata Size: - Virtual size: 563KB

.data Size: - Virtual size: 176KB

.pdata Size: - Virtual size: 28KB

.'G` Size: - Virtual size: 9.1MB

.i4( Size: 4KB - Virtual size: 4KB

.6kF Size: 15.4MB - Virtual size: 15.4MB

.reloc Size: 512B - Virtual size: 296B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 625KB

.rdata
Size: - Virtual size: 563KB

.data
Size: - Virtual size: 176KB

.pdata
Size: - Virtual size: 28KB

.'G`
Size: - Virtual size: 9.1MB

.i4(
Size: 4KB - Virtual size: 4KB

.6kF
Size: 15.4MB - Virtual size: 15.4MB

.reloc
Size: 512B - Virtual size: 296B

.rsrc
Size: 512B - Virtual size: 480B