Debloater[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Debloater.exe
Size

1.9MB
MD5

d14f6084c48463fa827b868d20696dce
SHA1

5dd79ab84c76a0dee2555f128199c9ed8c7d8eb3
SHA256

3e0e85bfcc6d1eb8aac56b8389ed849db54993ae2ecb0cdfa3f45530396b2f22
SHA512

aeb8c023c8d353247bafedee9f5f76c391a4905f3f4582c349b5cf2d77a584d3acd86b974b23b871c3a6a47e3fdde74cc9e26042d154392f43bc76923c94bc36
SSDEEP

24576:O6qYs/z+5zzLDc+OlHRZ2yhiGmYPaLMdcb9FnFMpMZvZGySR/HuAaA5uUmMu9Dou:OeDo2LMdUnFMjzHu6u5o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Debloater.exe

Files

Debloater.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\sledok\Desktop\Debloater\obj\Debug\Debloater.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ