cli2027-x86_64-pc-windows-gnu[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cli2027-x86_64-pc-windows-gnu.exe
Size 7.2MB
Sample260929-2bs8bsztfs
SHA256 778bb762d2cc71c25bdd720c20c94b011d9b7a766609f5408315cccbef13261f
MD5 58054b46a8e0ebcf283e43f23bab354a
SHA1 e096aee0a7dec9a326d3f7b31518100f80589b8c
SHA512 3a085267167a5ff0c24725b08607aedde7951640b98f145b956c9b3d0a0434802007021dd0a0d1b8ad23da30a546b36fc98adb2c0eb36f6fe963499bc40883f8
SSDEEP 98304:faBcywVIMHEbSFGY6FB2mwmbHOhvxSfb2wbm8Ix0po7LheRICmi+vwHBf74pxplW:0EMwph27I57am8BfclW
TLSH
T135762943E6A290F8C16AC175835A7633FF22BC4D44367AAB6BD48B313E61F506B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cli2027-x86_64-pc-windows-gnu.exe

File Explorer

cli2027-x86_64-pc-windows-gnu.exe

.exe 7.2MB

cli2027-x86_64-pc-windows-gnu.exe

IMPHASH 390ddcbb3af02f3fb30dc6a81a07c64b
SHA256 778bb762d2cc71c25bdd720c20c94b011d9b7a766609f5408315cccbef13261f
MD5 58054b46a8e0ebcf283e43f23bab354a
SHA1 e096aee0a7dec9a326d3f7b31518100f80589b8c
SHA512 3a085267167a5ff0c24725b08607aedde7951640b98f145b956c9b3d0a0434802007021dd0a0d1b8ad23da30a546b36fc98adb2c0eb36f6fe963499bc40883f8
SSDEEP 98304:faBcywVIMHEbSFGY6FB2mwmbHOhvxSfb2wbm8Ix0po7LheRICmi+vwHBf74pxplW:0EMwph27I57am8BfclW
TLSH
T135762943E6A290F8C16AC175835A7633FF22BC4D44367AAB6BD48B313E61F506B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegGetValueW RegOpenKeyExW SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateFileMappingA CreateFileW CreateHardLinkW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx __C_specific_handler AssignProcessToJobObject CreateJobObjectW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryInformationJobObject TerminateJobObject CancelWaitableTimer CreateEventW CreateWaitableTimerExW FlushConsoleInputBuffer GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetStdHandle ReadConsoleInputW SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetEvent SetWaitableTimer WaitForMultipleObjects

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _exit _fmode _fpreset _initterm _onexit abort calloc exit exp fprintf free fwrite ldexp malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getsockname getsockopt ioctlsocket listen recv select send setsockopt

bcryptprimitives

ProcessPrng

shell32

ShellExecuteW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

578KB

Virtual Size

578KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cli2027-x86_64-pc-windows-gnu.exe

advapi32

bcrypt

kernel32

msvcrt

ntdll

ws2_32

bcryptprimitives

shell32

api-ms-win-core-synch-l1-2-0

generic