cli2027-x86_64-pc-windows-gnu[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cli2027-x86_64-pc-windows-gnu.exe
Size 7.0MB
Sample260929-php32a1x8j
SHA256 9823804e4372014172db3606a2c67edb3fd6566bbd82a2f8b21e647138a408ed
MD5 1efc274788643b7a42dfa5250dd23c0f
SHA1 2cc42102e78eb61e98b40caa4b1b65d2d160593b
SHA512 06890ebe2273051276aef0df58012bf197d62006530d9f6d13f8dfab6e6513837eef35adf49dde62ee46e36f0fe6f717f99eca49c76626bad86d3b354ea3f0ff
SSDEEP 98304:3bl1RuLVUsSo3UEdewSbWfo7xsSXQYKsaZsfdbypAIO8zc4MeO4pxOMPk:3bCZoBWXaFD2jMeOMPk
TLSH
T150762943E5A290F8C16AC175835A7633FF22BC4D44367AAB6BE48B313E61F506B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cli2027-x86_64-pc-windows-gnu.exe

File Explorer

cli2027-x86_64-pc-windows-gnu.exe

.exe 7.0MB

cli2027-x86_64-pc-windows-gnu.exe

IMPHASH 390ddcbb3af02f3fb30dc6a81a07c64b
SHA256 9823804e4372014172db3606a2c67edb3fd6566bbd82a2f8b21e647138a408ed
MD5 1efc274788643b7a42dfa5250dd23c0f
SHA1 2cc42102e78eb61e98b40caa4b1b65d2d160593b
SHA512 06890ebe2273051276aef0df58012bf197d62006530d9f6d13f8dfab6e6513837eef35adf49dde62ee46e36f0fe6f717f99eca49c76626bad86d3b354ea3f0ff
SSDEEP 98304:3bl1RuLVUsSo3UEdewSbWfo7xsSXQYKsaZsfdbypAIO8zc4MeO4pxOMPk:3bCZoBWXaFD2jMeOMPk
TLSH
T150762943E5A290F8C16AC175835A7633FF22BC4D44367AAB6BE48B313E61F506B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegGetValueW RegOpenKeyExW SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateFileMappingA CreateFileW CreateHardLinkW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx __C_specific_handler AssignProcessToJobObject CreateJobObjectW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryInformationJobObject TerminateJobObject CancelWaitableTimer CreateEventW CreateWaitableTimerExW FlushConsoleInputBuffer GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetStdHandle ReadConsoleInputW SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetEvent SetWaitableTimer WaitForMultipleObjects

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _exit _fmode _fpreset _initterm _onexit abort calloc exit exp fprintf free fwrite ldexp malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getsockname getsockopt ioctlsocket listen recv select send setsockopt

bcryptprimitives

ProcessPrng

shell32

ShellExecuteW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

570KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cli2027-x86_64-pc-windows-gnu.exe

advapi32

bcrypt

kernel32

msvcrt

ntdll

ws2_32

bcryptprimitives

shell32

api-ms-win-core-synch-l1-2-0

generic