C:\Users\stress\Downloads\Cleo-main(1)\Cleo-main\Cleo\Release\Cleo.pdb
Static task
static1
General
-
Target
Cleo.exe
-
Size
938KB
-
MD5
21e8e09e8152c3a673b5a22a7657a6c6
-
SHA1
2a37f9e3ba7478f46656a25a4b9de8d297f34d03
-
SHA256
1d0e781783d807489d26f88a4d02230c582634d6c9981e2a8904932174ab6707
-
SHA512
d787ed1abecacb9d3d5f85cd3a13e78b36bae7d389ca69184a9bcee1a15b895fdc30bfb43f51208231a11c089b56e2e29e6d1a75b2c96c8c02fd0adbb5777bf8
-
SSDEEP
24576:cNk0IyH8+AjQ/6c82xoKSpv2OFc3GC4Bc:QII/AjQ/Lp4puTGF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Cleo.exe
Files
-
Cleo.exe.exe windows:6 windows x86 arch:x86
29f6251e221a231d74bc027e97dc4668
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
InternetCheckConnectionA
advapi32
CryptEncrypt
CryptDestroyKey
RegOpenKeyExA
GetUserNameA
RegGetValueA
GetCurrentHwProfileA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptImportKey
kernel32
GetComputerNameA
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
PeekNamedPipe
FormatMessageW
GetEnvironmentVariableA
SleepEx
LoadLibraryW
GetSystemDirectoryW
CreateEventW
WaitForSingleObject
SetEvent
GetTickCount
SetEndOfFile
WriteConsoleW
OpenProcess
SetStdHandle
GetSystemInfo
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
ReadFile
HeapReAlloc
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetConsoleWindow
SetFileInformationByHandle
CreateFileW
GetModuleFileNameW
GetModuleFileNameA
CheckRemoteDebuggerPresent
IsDebuggerPresent
DebugBreak
GetProcAddress
GetThreadContext
CloseHandle
Process32Next
GetCurrentThread
OutputDebugStringW
GetLastError
Sleep
GetProcessHeap
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetLastError
Process32First
CreateToolhelp32Snapshot
FileTimeToSystemTime
HeapSize
CopyFileW
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileAttributesW
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
DeleteFileW
MoveFileExW
GetFileInformationByHandleEx
CreateSymbolicLinkW
MultiByteToWideChar
WideCharToMultiByte
LocalFree
FormatMessageA
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RaiseException
WakeAllConditionVariable
SleepConditionVariableSRW
LCMapStringEx
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
user32
ShowWindow
ws2_32
htonl
freeaddrinfo
getaddrinfo
listen
accept
sendto
recvfrom
WSAIoctl
socket
setsockopt
recv
getsockname
getpeername
connect
bind
htons
select
WSAStartup
inet_ntop
ntohs
WSAGetLastError
WSASetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
inet_pton
ioctlsocket
__WSAFDIsSet
gethostname
WSACleanup
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
bcrypt
BCryptGenRandom
Sections
.text Size: 758KB - Virtual size: 758KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ