cli2027-x86_64-pc-windows-gnu[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cli2027-x86_64-pc-windows-gnu.exe
Size 6.6MB
Sample260928-vs4basygrb
SHA256 46b92d23f3f843799998863af72538f8c77b5b097128e2404feab5cbd8a44195
MD5 9e2dae9d49dee4b1dee352c419779741
SHA1 a3f4ce775d0b6ad1632f7115f51f2345c48f6a76
SHA512 af1dd7c2e30df30f475c3bfa561f6be7807785b79234dad5fa7dbcb0f7cf21aab60954673ebfeedd78ab1eef00f2577f5ae1b9d8a2ff0ae3685a0853e60d6b47
SSDEEP 98304:cYilBuQOjTrlcwrcAru+Mw/6bLpV04j8SMty8C5PzGEl4T70uU882Ip4pxgpNcJ5:SDWteVFZRM0s82InpN6
TLSH
T1FD661943E6A290FCC16AC175835A7633FF62BC4D44327AAA5BE48B313E61F506B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cli2027-x86_64-pc-windows-gnu.exe

File Explorer

cli2027-x86_64-pc-windows-gnu.exe

.exe 6.6MB

cli2027-x86_64-pc-windows-gnu.exe

IMPHASH a222446af4ea906d61a8a03ef475a3d1
SHA256 46b92d23f3f843799998863af72538f8c77b5b097128e2404feab5cbd8a44195
MD5 9e2dae9d49dee4b1dee352c419779741
SHA1 a3f4ce775d0b6ad1632f7115f51f2345c48f6a76
SHA512 af1dd7c2e30df30f475c3bfa561f6be7807785b79234dad5fa7dbcb0f7cf21aab60954673ebfeedd78ab1eef00f2577f5ae1b9d8a2ff0ae3685a0853e60d6b47
SSDEEP 98304:cYilBuQOjTrlcwrcAru+Mw/6bLpV04j8SMty8C5PzGEl4T70uU882Ip4pxgpNcJ5:SDWteVFZRM0s82InpN6
TLSH
T1FD661943E6A290FCC16AC175835A7633FF62BC4D44327AAA5BE48B313E61F506B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegGetValueW RegOpenKeyExW SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateFileMappingA CreateFileW CreateHardLinkW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx __C_specific_handler AssignProcessToJobObject CreateJobObjectW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryInformationJobObject TerminateJobObject CancelWaitableTimer CreateEventW CreateWaitableTimerExW FlushConsoleInputBuffer GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetStdHandle ReadConsoleInputW SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetEvent SetWaitableTimer WaitForMultipleObjects

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _exit _fmode _fpreset _initterm _onexit abort calloc exit exp fprintf free fwrite ldexp log malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getsockname getsockopt ioctlsocket listen recv select send setsockopt

bcryptprimitives

ProcessPrng

shell32

ShellExecuteW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

544KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cli2027-x86_64-pc-windows-gnu.exe

advapi32

bcrypt

kernel32

msvcrt

ntdll

ws2_32

bcryptprimitives

shell32

api-ms-win-core-synch-l1-2-0

generic