CatClawAgent[.]exewinhttp[.]lib;user32[.]lib;gdi32[.]lib;gdiplus[.]lib;ole32[.]lib

Sharing

Copy URL Twitter E-mail

General

Target
CatClawAgent.exewinhttp.lib;user32.lib;gdi32.lib;gdiplus.lib;ole32.lib
Size 42KB
Sample260705-syetsagy7l
SHA256 6abeef2a43904c28c859e6acecdc70719da8cec0bd9aa1a480f7efcec6a7c6cb
MD5 682fef48817c5ba9f44aea3081d72be2
SHA1 ea722fc2017f0681dcb40da92d07d8a3bc59a178
SHA512 1b26cd0e7c49e152b1720cb8f29d2711209d13aa2db8b0543f2dd0bd4c1b4d1a9cfa87a4358614a8fde00232ff0e5247ca0e6c03d9de8e82bdaefa709abed553
SSDEEP 768:Wg0y5m/ciT2AFrxFyUO6bV/Yaeku/o2e94pH7Ge:W5y5mNxcUO6bV/YaMIelGe
TLSH
T16813D72ADE17907BD31D8DB4DA431D01DE62BCC68BD1B9CF67401CE60969BE46B3E602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CatClawAgent.exewinhttp.lib;user32.lib;gdi32.lib;gdiplus.lib;ole32.lib

File Explorer

CatClawAgent.exewinhttp.lib;user32.lib;gdi32.lib;gdiplus.lib;ole32.lib

.exe 42KB

CatClawAgent.exewinhttp.lib;user32.lib;gdi32.lib;gdiplus.lib;ole32.lib

IMPHASH 13dc10c735924eccc706fb43cd3a2c49
SHA256 6abeef2a43904c28c859e6acecdc70719da8cec0bd9aa1a480f7efcec6a7c6cb
MD5 682fef48817c5ba9f44aea3081d72be2
SHA1 ea722fc2017f0681dcb40da92d07d8a3bc59a178
SHA512 1b26cd0e7c49e152b1720cb8f29d2711209d13aa2db8b0543f2dd0bd4c1b4d1a9cfa87a4358614a8fde00232ff0e5247ca0e6c03d9de8e82bdaefa709abed553
SSDEEP 768:Wg0y5m/ciT2AFrxFyUO6bV/Yaeku/o2e94pH7Ge:W5y5mNxcUO6bV/YaMIelGe
TLSH
T16813D72ADE17907BD31D8DB4DA431D01DE62BCC68BD1B9CF67401CE60969BE46B3E602
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vd201\source\repos\CatClawAgent\x64\Release\CatClawAgent.pdb

kernel32

ExitProcess GetModuleHandleW GlobalUnlock InitializeSListHead GlobalLock QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime MoveFileExW CloseHandle CreateFileA Sleep GetModuleFileNameW SetUnhandledExceptionFilter WriteFile

user32

SetWindowsHookExW MapVirtualKeyW GetDC CallNextHookEx GetSystemMetrics GetKeyNameTextA OpenClipboard CloseClipboard GetClipboardData UnhookWindowsHookEx ReleaseDC

gdi32

DeleteObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteDC

ole32

GetHGlobalFromStream CreateStreamOnHGlobal

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

winhttp

WinHttpReadData WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpOpen

gdiplus

GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipSaveImageToStream

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_exception_destroy __C_specific_handler _CxxThrowException memmove memcmp memcpy __std_terminate __current_exception_context __current_exception

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argv __p___argc terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen