cli[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cli.exe
Size 7.5MB
Sample261006-tal4mac16r
SHA256 42881e240a8af24157fa2f798b9f47ea5f5dd611bb522e602a13ac1c2e479f27
MD5 cc7067686634c4bfc9535a84b9d5dfbe
SHA1 5211ef087c5d8c43b9cc990d4bcc7788e5b3373c
SHA512 51c70ff5818deda43e982de664a821856cfdeb8efbebf6a8f520c0a8fa62d6a9b3381a9b06a329cf1c4a96eca504766b15d31b7b58fb9c690e8ba6219125f1d7
SSDEEP 98304:washCwHc5QNANsAOpWZg32kmfiaB2vSOzGtCrtbbdco+blKgic:wzTGtMtbbdFxc
TLSH
T1BA866D8BB94A43ECD56ED57EE3193B7AB571784B2961BAE787600E306F026C4070D72C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cli.exe

File Explorer

cli.exe

.exe 7.5MB

cli.exe

IMPHASH 594f6f751fb5bbbf58f3128b6a7ecf2c
SHA256 42881e240a8af24157fa2f798b9f47ea5f5dd611bb522e602a13ac1c2e479f27
MD5 cc7067686634c4bfc9535a84b9d5dfbe
SHA1 5211ef087c5d8c43b9cc990d4bcc7788e5b3373c
SHA512 51c70ff5818deda43e982de664a821856cfdeb8efbebf6a8f520c0a8fa62d6a9b3381a9b06a329cf1c4a96eca504766b15d31b7b58fb9c690e8ba6219125f1d7
SSDEEP 98304:washCwHc5QNANsAOpWZg32kmfiaB2vSOzGtCrtbbdco+blKgic:wzTGtMtbbdFxc
TLSH
T1BA866D8BB94A43ECD56ED57EE3193B7AB571784B2961BAE787600E306F026C4070D72C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CopyFileExW CreateDirectoryW CreateFileMappingA CreateFileW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemInfo GetSystemTimePreciseAsFileTime HeapAlloc HeapFree InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeSRWLock LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush fputc setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf atan2f cosf exp floorf fmodf round roundf sinf truncf

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

memset strlen strncmp strnlen wcslen wcsnlen

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-convert-l1-1-0

mbrtowc strtol wcrtomb

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cli.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

ws2_32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic