clp4[.]exe | Triage™

General

Target
clp4.exe
Size 436KB
Sample260825-pmjrtayvcv
SHA256 edc70802d8f65d3ee1a9706050e191bd73e486e1c1c5cb0423dadd41b1b87829
MD5 2834978c19712420ebfef4776e98979f
SHA1 4bbe31b1f73a96e4b494759f247708e33a7e767c
SHA512 dafa4c7715f6e26df9d9e2b58c7569a0c2108f9f9f240c0eabe1a86764beb57b9d8f28d949f68c62e57e3c2068d0c73a172723240d23a3318092ce22da576117
SSDEEP 12288:C4cVXKSS5lyf/g5FK/OtocaF0V0NwAPaF0KFAxJA:xU6naTa
TLSH
T1B0948D874754E4B7C2F327B3F4B626401BAB7538B65224EC81BE818606E318D574EFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
clp4.exe

File Explorer

clp4.exe

.exe 436KB

clp4.exe

IMPHASH 6b5677b85aae7623d82801dd89982758
SHA256 edc70802d8f65d3ee1a9706050e191bd73e486e1c1c5cb0423dadd41b1b87829
MD5 2834978c19712420ebfef4776e98979f
SHA1 4bbe31b1f73a96e4b494759f247708e33a7e767c
SHA512 dafa4c7715f6e26df9d9e2b58c7569a0c2108f9f9f240c0eabe1a86764beb57b9d8f28d949f68c62e57e3c2068d0c73a172723240d23a3318092ce22da576117
SSDEEP 12288:C4cVXKSS5lyf/g5FK/OtocaF0V0NwAPaF0KFAxJA:xU6naTa
TLSH
T1B0948D874754E4B7C2F327B3F4B626401BAB7538B65224EC81BE818606E318D574EFA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WaitForSingleObject GetSystemDirectoryW ResumeThread GetModuleHandleA Sleep GetTickCount64 GetLastError LoadLibraryA QueryPerformanceFrequency GetSystemInfo GetCurrentDirectoryW GetTempPathW GetComputerNameW QueryPerformanceCounter WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetEnvironmentVariableW lstrlenW GetProcAddress CompareStringW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers

user32

IsWindow GetDC GetDesktopWindow ReleaseDC GetCursorPos GetForegroundWindow MessageBeep

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Name

.text

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

207KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

169KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

824B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

clp4.exe

kernel32

user32

advapi32

generic