Debloater[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Debloater.exe
Size

1.9MB
MD5

8390a445bb5b9bd44605d0b7e1775d93
SHA1

e851943fb2df1833a3c3c3ec9d9e3be6edb3d69a
SHA256

e8312888c3495e0c83d2b357916895cee106287ff128f76953541e53c15dbcb7
SHA512

d4eaeb3550c9eb96b4c0f31c111f0b6d3d928ada190a4460730416bbc764081ff1af3a1bd773bf41ee8c2a9e523affd037f1db99c40772ecb16d830227914e85
SSDEEP

24576:N6MYs/z+5zzRDc+OlHRZ2yhiGmYPaLMdcb9FnFMpMZvZGySR/HuAaA5uUmMuTDvu:NODo2LMdUnFMjzHu6uvv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Debloater.exe

Files

Debloater.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\sledok\Desktop\Debloater\obj\Debug\Debloater.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ