cleanmgr[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cleanmgr.exe
Size

828KB
MD5

cff6c145eb350ea686f48866937e0a76
SHA1

a2e7e3b13bb6c3d8ba38e350afd7bb4164514407
SHA256

8614fecd71f9f61a8742b4ab97f28d154f2428b4e91a5a5b42a1e05f93cfa477
SHA512

e3af67c14f4d85a656725bbc03a38fde8ecec3fa03b6af973baa18f596401b1a768ed1d6bf82513365609a1600eb914741902f98461df40f0528f0158c252910
SSDEEP

24576:jzIj6o9o//FfodxH+TXwo7w3G4W//b2yRKtCuf7N:jcj6oO1fodk4W/zsX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cleanmgr.exe

Files

cleanmgr.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 826KB - Virtual size: 825KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ