Clash-X64[.]exe | Triage™

General

Target
Clash-X64.exe
Size 45.4MB
Sample260708-clc7esh18l
SHA256 24b1c3f96179633ed7a40190ea103c558cc182c32cab38e3399a81524cb578b5
MD5 2edb118e4db7268d2b51963f1fbbe72a
SHA1 9606c6cf4d6ad6cfa143845e80461539f942d589
SHA512 6d2f942cd6beca8d705e8cdbab3c0efc8a1a9b2e80cf41274ac7ea3e915b342a132e34fae5d4a46c2c7220d436323b731c6a8f5fcc910de8c3c7e51cd6edd491
SSDEEP 786432:MqYWNfsvVp1VhX1D7k2Jhk0SCiQ/Kr2fAz+oGij+xzUqz4AOG6ai:M/W0L1VhZk2s0SBMKq4WxjvR
TLSH
T150A73347914E94E2CBA8B4B21016098C277850F33C30A6DB77AF0D49D7696DB2FE9D9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Clash-X64.exe

File Explorer

Clash-X64.exe

.exe 45.4MB

Clash-X64.exe

IMPHASH 4fac38a977655de0f2858087be1ed60a
SHA256 24b1c3f96179633ed7a40190ea103c558cc182c32cab38e3399a81524cb578b5
MD5 2edb118e4db7268d2b51963f1fbbe72a
SHA1 9606c6cf4d6ad6cfa143845e80461539f942d589
SHA512 6d2f942cd6beca8d705e8cdbab3c0efc8a1a9b2e80cf41274ac7ea3e915b342a132e34fae5d4a46c2c7220d436323b731c6a8f5fcc910de8c3c7e51cd6edd491
SSDEEP 786432:MqYWNfsvVp1VhX1D7k2Jhk0SCiQ/Kr2fAz+oGij+xzUqz4AOG6ai:M/W0L1VhZk2s0SBMKq4WxjvR
TLSH
T150A73347914E94E2CBA8B4B21016098C277850F33C30A6DB77AF0D49D7696DB2FE9D9C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\85023\Desktop\项目代码库\ExeBundler\bin\Release\Loader.pdb

kernel32

CreateDirectoryW ReadFile GetFileSizeEx WriteFile ExpandEnvironmentStringsW GetModuleFileNameW WaitForSingleObject CreateFileW CloseHandle SetFilePointerEx CreateProcessW WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Clash-X64.exe

kernel32

generic