clp8[.]exe | Triage™

General

Target
clp8.exe
Size 232KB
Sample260620-akanssdv4y
SHA256 cc11ed29c8244abc04aa05618154317c550f90a519809849b7cba0aa8badc7c8
MD5 234ce8b2531070f273ececb213be9366
SHA1 d626aa5c9870c9281c613d4b064a5a84585958c9
SHA512 17b480bb5ad790f591aa78c94bcd51c1e0ae9302896658bd7511912d0d9fa171f08517996b39b36a768f4658f8aebc5035019c580488bba95335d997820cd617
SSDEEP 6144:q0WoKA+vzDrCztDMcwW00M+wbv2dB+c/s/kO:hyzDrCwF+Gv2+1
TLSH
T10E34CF5BB3A034F9D5768278C8145A06E776B8350771DBAF03A043A67F232D19D3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
clp8.exe

File Explorer

clp8.exe

.exe 232KB

clp8.exe

IMPHASH 3026ee54c6af015fafd94f2b564c4ba9
SHA256 cc11ed29c8244abc04aa05618154317c550f90a519809849b7cba0aa8badc7c8
MD5 234ce8b2531070f273ececb213be9366
SHA1 d626aa5c9870c9281c613d4b064a5a84585958c9
SHA512 17b480bb5ad790f591aa78c94bcd51c1e0ae9302896658bd7511912d0d9fa171f08517996b39b36a768f4658f8aebc5035019c580488bba95335d997820cd617
SSDEEP 6144:q0WoKA+vzDrCztDMcwW00M+wbv2dB+c/s/kO:hyzDrCwF+Gv2+1
TLSH
T10E34CF5BB3A034F9D5768278C8145A06E776B8350771DBAF03A043A67F232D19D3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

advapi32

AdjustTokenPrivileges RegOpenKeyExA OpenProcessToken RegCloseKey LookupPrivilegeValueA RegSetValueExA

kernel32

RaiseException WriteConsoleW GetConsoleOutputCP FlushFileBuffers GetModuleFileNameA Process32First WriteProcessMemory GetCurrentProcess WriteFile SetFileTime GetEnvironmentVariableA CreateMutexA WaitForSingleObject GetCurrentThreadId GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA CopyFileA GetLastError CreateFileA DeleteFileA Process32Next CloseHandle SetFileAttributesA GetProcAddress VirtualAllocEx ReadProcessMemory SystemTimeToFileTime CreateRemoteThread lstrcmpiA CreateDirectoryA VirtualFreeEx GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapReAlloc CreateFileW HeapSize SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW LCMapStringW GetProcessHeap SetFilePointerEx GetConsoleMode

ntdll

RtlUnwindEx RtlPcToFileHeader

Name

.text

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

112KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

clp8.exe

user32

advapi32

kernel32

ntdll

generic