CLAW[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CLAW.exe
Size 1.3MB
Sample260930-s9mnrsyerc
SHA256 33cf6e2663823f073d769c3d05a1ad5e13e3e4993ad2cb6822617737395004c6
MD5 27a55102cff34a83eec08eb88af594c2
SHA1 75f44621520b635da54299c7e0fe0e04b72db43f
SHA512 69040b11f8709461763a8e51a293bec2d8ca0e19b4754cf13aff158ca877881f8b786771365ce46d76a4901acaa4102ab0a0e4d85f98307593674ae08d3e77be
SSDEEP 24576:fpX7psFeYuOzJnBQ16T+QKXJpBaxZFRXC5dt5FYQ07:fpX7dABysRKXxx
TLSH
T1C6659E41FB8240B5D94235F0995AB373EA709E8A8B7D565363B0FE2CAC32193ED1B14D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CLAW.exe

File Explorer

CLAW.exe

.exe 1.3MB

CLAW.exe

IMPHASH 0ba4b19e1e99df3533803949b3de6028
SHA256 33cf6e2663823f073d769c3d05a1ad5e13e3e4993ad2cb6822617737395004c6
MD5 27a55102cff34a83eec08eb88af594c2
SHA1 75f44621520b635da54299c7e0fe0e04b72db43f
SHA512 69040b11f8709461763a8e51a293bec2d8ca0e19b4754cf13aff158ca877881f8b786771365ce46d76a4901acaa4102ab0a0e4d85f98307593674ae08d3e77be
SSDEEP 24576:fpX7psFeYuOzJnBQ16T+QKXJpBaxZFRXC5dt5FYQ07:fpX7dABysRKXxx
TLSH
T1C6659E41FB8240B5D94235F0995AB373EA709E8A8B7D565363B0FE2CAC32193ED1B14D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

681433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapSize ExitThread SetStdHandle GetFileType LCMapStringA LCMapStringW HeapReAlloc CreateThread HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA RaiseException GetEnvironmentVariableA GetVersionExA ExitProcess GetACP SetFilePointer GetStringTypeW SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr CompareStringA CompareStringW SetEnvironmentVariableA TerminateProcess RtlUnwind HeapFree HeapAlloc FreeEnvironmentStringsW GetEnvironmentStrings GetCommandLineA lstrcpynA MulDiv FormatMessageA LocalFree GetStartupInfoA GetLocalTime GetSystemTime GetTimeZoneInformation FindNextFileA GetOEMCP GetCPInfo GetFileTime GetFileSize GetFileAttributesA TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc GlobalHandle TlsAlloc CreateEventA SuspendThread SetThreadPriority ResumeThread SetEvent GetProcessVersion GlobalFlags GlobalFree LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection LocalAlloc EnterCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime FindResourceA LoadResource LockResource GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA SizeofResource MultiByteToWideChar GetFullPathNameA FindFirstFileA FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle GetLastError lstrcpyA lstrcatA SetErrorMode GlobalAlloc GlobalDeleteAtom lstrcmpA lstrcmpiA GetCurrentThread GetCurrentThreadId GlobalLock GlobalUnlock SetLastError GetStdHandle GetStringTypeA GetEnvironmentStringsW SetHandleCount WideCharToMultiByte CreateProcessA GetCurrentDirectoryA GetTickCount GetPrivateProfileIntA Sleep GetPrivateProfileStringA WritePrivateProfileStringA FreeLibrary GetVersion LoadLibraryA WinExec GetWindowsDirectoryA GetDriveTypeA GetVolumeInformationA OutputDebugStringA CloseHandle OpenProcess GetModuleHandleA GetProcAddress GetModuleFileNameA WaitForSingleObject InterlockedIncrement InterlockedDecrement lstrlenA OpenFile SetCurrentDirectoryA

user32

DestroyWindow GetMenuState LoadBitmapA GetMenuCheckMarkDimensions IsDialogMessageA ShowWindow IsWindowEnabled GetClassNameA LoadCursorA GetSysColorBrush GetMessageA DestroyMenu GetMenuItemID GetWindowTextA GetDlgCtrlID GetKeyState SetMenuItemBitmaps ModifyMenuA CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetLastActivePopup GetForegroundWindow GetWindow SetWindowPos RegisterWindowMessageA OffsetRect SystemParametersInfoA GetWindowPlacement EnableMenuItem GrayStringA TabbedTextOutA GetNextDlgTabItem MapWindowPoints DefWindowProcA FindWindowA GetWindowLongA SetWindowLongA SetFocus KillTimer SetTimer FillRect GetSystemMetrics LoadIconA MessageBeep TranslateMessage PeekMessageA DispatchMessageA BeginPaint EndPaint GetActiveWindow GetWindowRect InvalidateRect MoveWindow UpdateWindow GetCursorPos PtInRect SetCursor SetRectEmpty IntersectRect GetAsyncKeyState EnableWindow GetClientRect ValidateRect IsIconic CheckDlgButton wsprintfA MessageBoxA GetDlgItemInt IsDlgButtonChecked SetDlgItemInt GetSysColor InflateRect LoadStringA DialogBoxParamA DrawTextA EndDialog GetFocus SetActiveWindow IsWindow GetDlgItemTextA AdjustWindowRectEx IsWindowVisible CheckMenuItem SetWindowTextA GetParent GetTopWindow GetClassInfoA GetCapture WinHelpA CharUpperA PostQuitMessage GetMenuItemCount SetDlgItemTextA GetDlgItem SendMessageA IsRectEmpty PostMessageA ShowCursor CopyRect SetRect RegisterClassA GetMenu GetDC GetSubMenu ReleaseDC SetForegroundWindow ClientToScreen SendDlgItemMessageA DestroyCursor CreateDialogIndirectParamA DrawFocusRect FrameRect DrawIcon DestroyIcon DrawEdge DrawFrameControl DestroyAcceleratorTable UnionRect LoadAcceleratorsA LoadMenuA TranslateAcceleratorA SetCursorPos

gdi32

DeleteObject BitBlt StretchBlt GetTextExtentPoint32A CreateCompatibleDC SetTextColor SelectClipRgn SetBkMode CreateRectRgn TextOutA SetBkColor GetDeviceCaps CreateBitmap PatBlt CreateFontA ExtTextOutA CreateFontIndirectA DPtoLP DeleteDC SaveDC RestoreDC GetStockObject SelectObject SetStretchBltMode SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox MoveToEx LineTo CreatePen CreateSolidBrush PtVisible RectVisible Escape GetObjectA CreateCompatibleBitmap GetTextMetricsA Rectangle CreateDCA GetSystemPaletteEntries

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

advapi32

RegQueryValueExA RegCloseKey RegQueryValueA RegCreateKeyExA RegOpenKeyExA RegDeleteValueA RegSetValueExA

comctl32

ImageList_Destroy ImageList_Create ord17 ImageList_ReplaceIcon

winmm

joyGetNumDevs joyGetPosEx joyGetDevCapsA mciSendCommandA timeGetTime

mss32

_AIL_resume_sequence@4 _AIL_midiOutOpen@12 _AIL_set_XMIDI_master_volume@8 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_sequence_loop_count@8 _AIL_start_sequence@4 _AIL_end_sequence@4 _AIL_set_sequence_tempo@12 _AIL_sequence_status@4 _AIL_stop_sequence@4 _AIL_init_sequence@12 _AIL_release_sequence_handle@4 _AIL_XMIDI_master_volume@4 _AIL_allocate_sequence_handle@4

dplayx

ord4 ord2 ord1

smackw32

ord32 ord38 ord14 ord17 ord19 ord23 ord27 ord18 ord21 ord28

wsock32

inet_ntoa send recv WSAGetLastError gethostbyname socket WSAAsyncSelect recvfrom bind ioctlsocket accept connect htons sendto closesocket htonl inet_addr WSASetLastError gethostname

wininet

InternetQueryDataAvailable InternetGetLastResponseInfoA InternetCrackUrlA InternetCanonicalizeUrlA InternetQueryOptionA InternetOpenA InternetCloseHandle InternetOpenUrlA InternetSetStatusCallback InternetSetFilePointer InternetWriteFile InternetReadFile

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

dsound

DirectSoundCreate

ddraw

DirectDrawCreate