ee606f3c58c8695440104c4cb389a325830fbb8c286bc163711981011f7729e6

Sharing

Copy URL Twitter E-mail

General

Target

ee606f3c58c8695440104c4cb389a325830fbb8c286bc163711981011f7729e6
Size

220KB
MD5

9e450bcc98d266f82cd51b46d81edfab
SHA1

1c4e0f6308fd18365487601695cc0121278b8624
SHA256

ee606f3c58c8695440104c4cb389a325830fbb8c286bc163711981011f7729e6
SHA512

97c4f29707c9d1a24ad8190dc1927e8a49bd32b625538c1aa27236e1e7c81329d92640c99600e06c200023b8829c39b4d404988bf2b3512a9aa95eb8726593a6
SSDEEP

3072:kHfh1b2GDLGvuYbqnmT3cqrDCUXzyDnY010UO9IgltJEaQZG3j:kzaGNmTMwuUXuDYodONhE1c3j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee606f3c58c8695440104c4cb389a325830fbb8c286bc163711981011f7729e6

Files

ee606f3c58c8695440104c4cb389a325830fbb8c286bc163711981011f7729e6
.dll windows:4 windows x86 arch:x86

c56a5335a9f537a74503dfabb6aadd71

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\ClipboardHookx32.pdb

Imports

psapi

GetModuleFileNameExA

user32

LoadCursorA
PostThreadMessageA
ReleaseDC
SendMessageA
GetClientRect
InvalidateRect
EnableWindow
PostQuitMessage
DestroyWindow
EndPaint
BeginPaint
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
RegisterClassA
LoadImageA
RegisterClassExA
SetWindowPos
CallWindowProcA
KillTimer
DefWindowProcA
PostMessageA
SetTimer
SetWindowLongA
GetWindowLongA
GetClassNameA
WindowFromDC
GetDesktopWindow
GetWindowDC
GetDCEx
GetDC
MoveWindow
GetWindowRect
GetParent
GetWindowTextA
IsWindow
CreateWindowExW
CreateWindowExA
GetSystemMetrics

gdi32

EndPath
TextOutA
BeginPath
GetTextExtentPointA
SetBkMode
SetTextColor
CreatePen
CreateFontIndirectA
CreateSolidBrush
DeleteObject
GetObjectA
SelectObject
CreateCompatibleBitmap
StretchBlt
BitBlt
DeleteDC
CreateCompatibleDC
CreateDCW
CreateDCA
StrokePath

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

kernel32

GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
HeapDestroy
LCMapStringW
LCMapStringA
CompareStringA
GetACP
GetCPInfo
HeapSize
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapCreate
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStdHandle
SetEndOfFile
RtlUnwind
RaiseException
GetProcessHeap
HeapAlloc
HeapFree
CompareStringW
GetOEMCP
GetCommandLineA
CreateMutexA
GetLastError
OutputDebugStringA
CreateFileMappingA
MapViewOfFile
CloseHandle
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
CreateThread
Sleep
TerminateProcess
OpenProcess
CreateProcessA
CreateProcessW
GetCurrentProcess
GetPrivateProfileStringA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetExitCodeProcess
WritePrivateProfileStringA
CreateFileA
GetVersionExA
ResetEvent
CreateEventA
SetEvent
GetSystemWindowsDirectoryA
GetCurrentProcessId
GetModuleFileNameA
SetEnvironmentVariableA
GetCurrentThread
LoadLibraryA
GetProcAddress
GetModuleHandleA
TerminateThread
DeleteFileA
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
ReadFile
SetFilePointer
GetFileAttributesA
GetTickCount
WriteFile
FlushFileBuffers
WaitNamedPipeA
SetNamedPipeHandleState
OpenThread
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
SetLastError
VirtualQueryEx
VirtualAllocEx
ResumeThread
ExitProcess
GetEnvironmentVariableW
VirtualQuery
GetModuleHandleW
VirtualProtect
InterlockedCompareExchange
FlushInstructionCache
SetThreadContext
GetThreadContext
VirtualFree
SuspendThread
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime

Exports

Exports

??0CClipboardHook@@QAE@XZ
??4CClipboardHook@@QAEAAV0@ABV0@@Z
DetourFinishHelperProcess
QZportedFunction
Test

Sections

.text
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c56a5335a9f537a74503dfabb6aadd71

Headers

File Characteristics

PDB Paths

Imports

psapi

user32

gdi32

shell32

advapi32

kernel32

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 157KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 8KB - Virtual size: 34KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 160KB - Virtual size: 157KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 8KB - Virtual size: 34KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 16KB - Virtual size: 14KB