Clipback-0[.]5[.]4-portable[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Clipback-0.5.4-portable.exe
Size 14.5MB
Sample261029-2sc8fafv5t
SHA256 80a24852786b5236f414b5a68674036b8023c437073d1051bd72a55713fb589a
MD5 c337823924a6f58392378fb304cb78d6
SHA1 08073fab6846454f426612d46c10388140ab7f44
SHA512 11f397c1400bd7c7e04431ddecbbb3d23d3ebe0f05485d508698b928e7b013c7abe56c041302b10cc55b440010f4cce8e2f704fef3052c0fa6a7fc5d1074ba38
SSDEEP 98304:VdHkl9d6ggfCtwiNeFudiWKvWGtAem1fEGyDeim0Bj8EIG2ZNWRn+e3Lkf4gzEm3:VdKd6NfseIzlEGfTZNWRLM3
TLSH
T10FE61811BA2B98ACD55BC8B083478A734E2130DB1A36B9BF45C442393F7DBF05B39659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Clipback-0.5.4-portable.exe

File Explorer

Clipback-0.5.4-portable.exe

.exe 14.5MB

Clipback-0.5.4-portable.exe

IMPHASH eb87859bbba245aa41ea49c5dd75cbd1
SHA256 80a24852786b5236f414b5a68674036b8023c437073d1051bd72a55713fb589a
MD5 c337823924a6f58392378fb304cb78d6
SHA1 08073fab6846454f426612d46c10388140ab7f44
SHA512 11f397c1400bd7c7e04431ddecbbb3d23d3ebe0f05485d508698b928e7b013c7abe56c041302b10cc55b440010f4cce8e2f704fef3052c0fa6a7fc5d1074ba38
SSDEEP 98304:VdHkl9d6ggfCtwiNeFudiWKvWGtAem1fEGyDeim0Bj8EIG2ZNWRn+e3Lkf4gzEm3:VdKd6NfseIzlEGfTZNWRLM3
TLSH
T10FE61811BA2B98ACD55BC8B083478A734E2130DB1A36B9BF45C442393F7DBF05B39659
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11156976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clipback.pdb

bcryptprimitives

ProcessPrng

kernel32

HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetUserDefaultUILanguage LCIDToLocaleName GetModuleHandleA RtlUnwindEx GetProcAddress Sleep GetLastError GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind SetUnhandledExceptionFilter RtlCaptureContext GetExitCodeProcess UnhandledExceptionFilter SetEnvironmentVariableW AddVectoredExceptionHandler ReleaseMutex SwitchToThread GlobalFree GetLocalTime GlobalUnlock QueryFullProcessImageNameW Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalLock GlobalAlloc QueryPerformanceFrequency QueryPerformanceCounter DeleteCriticalSection GetCurrentProcessId FindNextFileW InitializeSListHead DeviceIoControl CreateSymbolicLinkW SetWaitableTimer MoveFileExW GetFinalPathNameByHandleW DeleteFileW RemoveDirectoryW GetTempPathW GetFileAttributesW CreateProcessW WaitForSingleObject GetSystemTimePreciseAsFileTime CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetSystemTimes CreateMutexA RtlLookupFunctionEntry SetLastError WaitForSingleObjectEx GetCurrentProcess WideCharToMultiByte FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber CloseHandle SleepEx SetHandleInformation ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle TlsSetValue LoadLibraryA LoadLibraryW TlsGetValue TlsAlloc lstrlenW HeapAlloc CreateFileW EncodePointer RaiseException RtlPcToFileHeader TerminateProcess IsProcessorFeaturePresent CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx IsDebuggerPresent CreateEventW GetSystemTimeAsFileTime SleepConditionVariableSRW GetSystemInfo SetFilePointerEx InitializeCriticalSectionAndSpinCount CreateMutexW SetFileAttributesW WakeAllConditionVariable AcquireSRWLockExclusive CopyFileExW LoadLibraryExA FreeLibrary HeapFree GetDiskFreeSpaceExW FindClose CreateThread OutputDebugStringA OutputDebugStringW LoadLibraryExW GetProcessHeap CreateWaitableTimerExW GlobalMemoryStatusEx ReleaseSRWLockExclusive GetCurrentThreadId GetModuleHandleW TlsFree OpenProcess

advapi32

EventRegister RegGetValueW EventSetInformation EventUnregister RegCloseKey RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegOpenKeyExW RegQueryValueExW EventWriteTransfer RegSetValueExW RegDeleteValueW SystemFunction036

ntdll

RtlGetVersion NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

user32

VkKeyScanW CheckMenuItem GetKeyboardLayout DrawTextW GetWindowDC OffsetRect ToUnicodeEx MapWindowPoints GetMenuBarInfo PostQuitMessage CreateAcceleratorTableW SystemParametersInfoA DestroyMenu RemoveMenu IsWindowVisible IsIconic DestroyAcceleratorTable MonitorFromWindow GetWindowLongPtrW EnableWindow IsWindowEnabled ClientToScreen GetMenu RegisterHotKey GetAsyncKeyState DrawIconEx GetActiveWindow RegisterRawInputDevices EnumDisplayMonitors CreateMenu CreatePopupMenu InsertMenuW SetPropW MapVirtualKeyExW AppendMenuW TrackPopupMenu IsProcessDPIAware RegisterWindowMessageA EnableMenuItem GetClientRect GetWindowTextLengthW CreateIcon FindWindowExW GetParent GetSystemMenu SetWindowLongW LoadImageW SetWindowRgn SetWindowTextW GetWindowTextW KillTimer SendMessageTimeoutW ShowCursor GetClipCursor MonitorFromPoint GetWindowRect AllowSetForegroundWindow SendMessageW GetSystemMetrics GetWindowThreadProcessId RedrawWindow FindWindowW GetWindow UnregisterHotKey CreateIconIndirect InvalidateRgn GetCursorPos SetFocus PostMessageW TranslateAcceleratorW GetUpdateRect ValidateRect GetRawInputData DrawMenuBar SetMenu GetMenuItemInfoW ChangeWindowMessageFilterEx FlashWindowEx GetForegroundWindow SetParent EnumChildWindows DispatchMessageA GetMessageA SetWindowPos AdjustWindowRect ShowWindow MsgWaitForMultipleObjectsEx GetMessageW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard DestroyIcon ReleaseDC UpdateLayeredWindow GetDC GetDpiForSystem RegisterClassW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW PostThreadMessageW DispatchMessageW TranslateMessage PeekMessageW GetMonitorInfoW SystemParametersInfoW SetCursor LoadCursorW ClipCursor MonitorFromRect CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture ReleaseCapture FillRect GetWindowLongW ScreenToClient GetKeyboardState SetWindowLongPtrW SetMenuItemInfoW GetIconInfo RegisterTouchWindow SetWindowDisplayAffinity DefWindowProcW CreateWindowExW AdjustWindowRectEx RegisterClassExW UpdateWindow InvalidateRect GetKeyState SetCursorPos SendInput MapVirtualKeyW SetForegroundWindow SetTimer

gdi32

CreateRectRgn CreateDIBSection CreateSolidBrush CreateCompatibleDC DeleteDC SetBkMode GetDIBits CombineRgn CreateBitmap GetObjectW DeleteObject SetTextColor BitBlt SelectObject GetDeviceCaps

oleaut32

SysFreeString GetErrorInfo VariantClear SetErrorInfo SysStringLen

shell32

Shell_NotifyIconW SHAppBarMessage Shell_NotifyIconGetRect ILFree SHCreateItemFromParsingName SHOpenFolderAndSelectItems SHCreateShellItemArrayFromIDLists ILCreateFromPathW DragQueryFileW SHFileOperationW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW DragFinish SHGetStockIconInfo

ole32

RegisterDragDrop CoCreateInstance OleInitialize CoInitializeEx DoDragDrop CoUninitialize RevokeDragDrop PropVariantClear

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

imm32

ImmReleaseContext ImmGetCompositionStringW ImmGetContext

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc

comctl32

SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass DefSubclassProc

shlwapi

SHCreateMemStream

propsys

PropVariantToBSTR

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSACleanup WSAStartup getsockopt getaddrinfo freeaddrinfo bind send ioctlsocket WSASocketW closesocket recv setsockopt getsockname WSAGetLastError getpeername shutdown WSAIoctl WSASend connect

crypt32

CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChainEngine CertAddEncodedCertificateToStore CertFreeCertificateContext CertCreateCertificateChainEngine CertCloseStore CertSetCertificateContextProperty CertFreeCertificateChain

bcrypt

BCryptGenRandom

winmm

timeEndPeriod PlaySoundW timeBeginPeriod

dxgi

CreateDXGIFactory1

pdh

PdhAddEnglishCounterW PdhCollectQueryData PdhGetFormattedCounterArrayW PdhCloseQuery PdhOpenQueryW

mfplat

MFTEnumEx MFCreateDXGIDeviceManager MFCreateMediaType MFStartup MFShutdown MFCreateDXGISurfaceBuffer MFCreateSample MFCreateAttributes MFCreateMemoryBuffer

d3d11

D3D11CreateDevice

mmdevapi

ActivateAudioInterfaceAsync

d3dcompiler_47

D3DCompile

mfreadwrite

MFCreateSourceReaderFromURL

windowscodecs

WICConvertBitmapSource

api-ms-win-crt-math-l1-1-0

log10f pow tanhf ceil powf sinf expf floor round __setusermatherr roundf trunc

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s strlen wcsncmp _wcsicmp wcslen strcmp

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _initialize_onexit_table __p___argc __p___argv _cexit _c_exit _initialize_narrow_environment _register_thread_local_exe_atexit_callback _configure_narrow_argv _register_onexit_function _set_app_type _crt_atexit _get_initial_narrow_environment terminate _seh_filter_exe abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode free malloc